Draft Data Protection Rules Can Be Improved

Issues around overbreadth, clarity, and discretionary power being placed in the hands of State agencies call for wider discussion

- Gautam Bhatia

On January 3, 2025, the ministry of electronics and information technology released the Draft Digital Personal Data Protection Rules, 2025, for public consultation. These rules are proposed to be enacted under the authority of the Digital Personal Data Protection Act, 2023, and in order to implement the provisions of that Act.

The publication of the draft rules marks a significant milestone, as they are necessary before the Data Protection Act can actually be implemented in a way that effectively protects the rights of Indian citizens. With that said, however, in their present form, the rules suffer from various potential flaws, which might hamper the ability of the law to perform that function.