The government on Friday released the Digital Personal Data Protection Rules 2025, which will be implemented in phases over 12-18 months. The rules aim to give citizens greater control over their personal data, prevent misuse, and protect privacy in the online space.
According to the notification, some parts of the rules will come into effect immediately, while provisions such as registration and obligations of consent managers, notices from data fiduciaries to individuals for processing their data, and other major norms related to processing personal data will be implemented over a period of 12-18 months.
The rules are also expected to help citizens avoid spam calls and unauthorised access to personal data, including videos and voice recordings, via any digital means.
"Now, therefore, in exercise of powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), the Central Government hereby makes the following rules... These rules may be called the Digital Personal Data Protection Rules, 2025," the notification read.
Data Protection Board and Penalties
The rules set out a mechanism for establishing a Data Protection Board, which will levy penalties based on the nature of the breach as specified in the DPDP Act 2023. The Act allows for penalties of up to Rs 250 per breach, while maintaining a graded penalty system to protect small businesses.
Background and Legal Basis
The DPDP Rules come eight years after the Supreme Court, on August 24, 2017, held that the Right to Privacy is a Fundamental Right, with restrictions specified in relation to constitutional rights.
The rules grant citizens the right to protect their personal data, but also expect individuals to provide accurate information, refrain from filing false complaints, and not suppress information for government-issued IDs or documents.
Citizen Recourse and Protections
- Citizens can seek recourse if their phone numbers are leaked, helping identify and penalise the entities responsible for unauthorised use.
- The provisions exempt certain scenarios, including:
- Enforcement of legal rights or court orders.
- Prevention, detection, investigation, or prosecution of offences.
- Individuals overseas or who have signed contracts with foreign entities.
- Ascertaining financial information and assets of defaulters.
- Specific exemptions for start-ups implementing government schemes or for research and innovation purposes.
The rules are seen as a significant step toward strengthening digital privacy while balancing the needs of government, business, and innovation sectors.