A step forward, but not without concerns

The draft rules of the data protection law, if retained as is, could present hurdles for implementation, require businesses to make expensive adjustments

- Arun Prabhu Arya Tripathy

Moving a step closer towards the implementation of India's maiden data protection law, the government has released the draft Digital Personal Data Protection Rules, 2025, for public consultation.

The rules make an earnest attempt to bring procedural clarity on some building blocks like notice to seek consent, consent managers, retention periods for certain businesses, certain data principal rights, and breach notification, but not without keeping alive concerns around verifiable parental consent, obligations of significant data fiduciaries, exemptions, and implementation timelines, and reviving some issues which we had hoped were put to rest, such as cross-border data transfers, and use of algorithms.

The long-awaited rules, published following much discussion and inter-ministry consultation, will be open for public comments for at least 45 days. Once finalised, certain parts of the rules (largely, dealing with the Data Protection Board or DPB) and corresponding parts of the DPA, will come into force upon their publication. The rest of the rules will come into force on a later date, to be specified in the final rules.

The Rules require that notice for consent be for specified purposes through a distinct document that is easily understandable. This notice must, at the least, provide descriptions of personal data, the specified purpose of processing, list goods or services and use cases to be enabled through processing, and provide clear means for exercising data principal rights.