Ministry of Electronics and Information Technology has drafted the Digital Personal Data Protection Rules, 2025 to facilitate the implementation of the Digital Personal Data Protection Act, 2023 (DPDP Act). It aims to strengthen the legal framework for the protection of digital personal data by providing necessary details and an actionable framework. Stakeholder are invited to share feedback/comments on the draft Rules.
Please Click here to view Draft Digital Personal Data Protection Rules, 2025 and Click here to view Explanatory Note on Draft Digital Personal Data Protection Rules, 2025
In line with the SARAL framework, certain principles like simple language, unnecessary cross referencing, contextual definition, and illustrations etc. have been used while drafting the rules. The text of the Rules along with the simplified explanatory notes to enhance accessibility and understanding of the draft Rules is available on the Ministry’s website at https://www.meity.gov.in/data-protection-framework
Overview of draft rules
The draft Rules details about the various implementation aspects such as the notice by the Data Fiduciary to the individuals, registration and obligations of Consent Manager, processing of personal data for issuance of subsidy, benefit, service etc. by State, applicability of reasonable security safeguards, intimation of personal data breach, providing details about availing of their rights by the individuals, processing of personal data of child or of person with disability, setting up the Data Protection Board, appointment and service conditions of the Chairperson and other members of the Board, functioning of Board as digital office, procedure to appeal to Appellate Tribunal among others.
Feedback/comments for Draft Rules
In this regard, feedback/comments may be submitted via the MyGov portal at the following link: https://innovateindia.mygov.in/dpdp-rules-2025 and the last date for submission is 18th February, 2025.
The DPDP Act which received the assent of the President of India, establishes a framework for processing digital personal data. It balances the individual’s right to protect personal data with the need to process such personal data for lawful purposes.
