MeitY Releases Draft Rules Of DPDP Act For Public Consultation

The ministry of electronics and information technology (Meity) on Friday introduced comprehensive draft regulations to implement the country's new Digital Personal Data Protection Act, marking a significant step forward in establishing a robust privacy framework for the digital age.

"Ministry of Electronics and Information Technology has drafted the Digital Personal Data Protection Rules, 2025 to facilitate the implementation of the Digital Personal Data Protection Act, 2023 (DPDP Act). It aims to strengthen the legal framework for the protection of digital personal data by providing necessary details and an actionable framework. 

"Stakeholder are invited to share feedback/comments on the draft Rules," a press statement read.

Key Highlights

The ministry announced that the proposed rules include stringent measures for protecting children's data, requiring data handlers to obtain verifiable parental consent before processing any personal information of minors. 

Organisations must implement appropriate technical and operational safeguards to ensure compliance with these requirements.

The draft of rules, which elaborate on the DPDP Act passed by Parliament in August 2023, outline several key provisions. 

Companies seeking to transfer personal data across borders will need explicit government authorisation. 

Additionally, social media platforms must secure parental consent before allowing users under 18 to create accounts.

A central feature of the draft rules details the formation of India's first Data Protection Board, including specific guidelines for appointing its chairperson and members. 

This regulatory body will serve as the primary authority responsible for enforcing the nation's data protection standards.

The ministry has opened these draft regulations for public consultation through the MyGov portal, with stakeholders having until February 18, 2025, to submit their feedback. The rules provide detailed guidance on essential aspects of data protection, including protocols for notifying individuals about data collection practices and frameworks for managing consent.