India releases the draft Digital Personal Data Protection Rules, 2025, aimed at enforcing the Digital Personal Data Protection Act, 2023, for public comments
The consultation is the implementation phase of a long-running Indian privacy-law effort: an earlier framework proposed a data protection authority and individual rights, and a revised bill was released after criticism before Parliament passed the revised bill in 2023.
The draft matters because it turns the statute into operational expectations for data handlers. Related coverage indicates that this includes verifiable parental consent for users under 18, making compliance questions more concrete for platforms.
First-order effects
Businesses processing personal data in India gain a draft rulebook to assess against their existing consent, governance, and child-user flows while public comments are sought.
Platforms serving minors face an immediate design and compliance question around verifying a parent's age and identity before obtaining consent, as described in the related draft-rule coverage.
Second-order effects
Compliance, identity-verification, and consent-management providers could see demand from platforms seeking to operationalize the proposed requirements; the eventual rules will determine how prescriptive that demand becomes.
Public consultation gives platforms, civil-society groups, and other affected parties a formal channel to contest or refine implementation details before enforcement expectations are fixed.
Third-order effects
If the rules retain detailed consent and child-data obligations, India’s privacy regime will increasingly shape product design and data-governance operations rather than remain a statutory principle alone.
The process points toward a layered data-rights framework in which legislation is followed by implementation rules and governance mechanisms; its practical impact will depend on final requirements and enforcement.
The trend: India is moving from privacy legislation toward an operational data-rights stack, with implementation rules translating broad protections into platform-level controls.
The Ministry of Electronics and Information Technology has published the draft rules for the Digital Personal Data Protection (DPDP) Act for public consultation. Suggestions and objections regarding the draft rules can be submitted through the MyGov portal until February 18, [ima…
.@GoI_MeitY releases Draft Digital Personal Data Protection Rules, 2025 for public consultation; Feedback/comments sought from public by 18th February, 2025 Read here: https://pib.gov.in/...
.@GoI_MeitY has released the long awaited DPDP Rules 16 & a half months after the DPDP Act, 2024 was enacted. We are dismayed that after such a long wait the Rules have failed to rise to the occasion & meet our expectations. 🧵1/9 https://internetfreedom.in/...
Govt has put out draft rules to operationalize the Data Protection Act 2023. The Act amends the RTI law & vests excessive powers in central govt including appointing the oversight body which can impose penalties of 500 crore. Re-upping our article on the perils of the DPDP Act. […
#BreakingNews |Government Of India releases Draft Of Digital Personal Data Protection Rules @AmanKayamHai_ shares more details @JamwalNews18 | #socialmedia #personaldataprotectionrules #children #privacy [video]
India released its draft Data Protection Rules yesterday, and my initial thoughts are that it appears to be disconnected from reality. I'm still reading and will add more, but first the positive change, then the rest. Btw, expect a complete overview of the Rules on @medianama
New: Key points from the draft Digital Personal Data Protection Rules. Some expected things, some new things, some scary things (data localisation, Section 36+Rule22). https://www.hindustantimes.com/ ...
The draft Rules details about the various implementation aspects such as the notice by the Data Fiduciary to the individuals, registration and obligations of Consent Manager, processing of personal data for issuance of subsidy, benefit, service etc. by State, applicability of
16 months after #DataProtectionAct, draft of digital personal data issued - ‘Child below 18 needs consent’ to create social media account - Draft: Consent needed from parents - Draft released for public consultation @anchoranjalip [video]