The draft Digital Personal Data Protection (DPDP) rules aim to safeguard citizens’ rights for the protection of their personal data and address specific challenges like unauthorized commercial use of data and digital harms, the Ministry of Electronics and Information Technology said on Friday.
The rules aim to give citizens greater control over their personal data by introducing provisions for informed consent, data erasure rights, and an effective grievance redressal mechanism. Parents and guardians are also empowered to ensure online safety for their children, the official statement explained.
Designed to empower citizens in a rapidly growing digital economy, the rules strive to achieve the right balance between regulation and innovation, ensuring that the benefits of India’s growing innovation ecosystem are accessible to all citizens and contribute to the country’s digital economy, the statement added.
Data Fiduciaries—entities responsible for handling personal data—are required to provide clear and accessible information about how data is processed, enabling citizens to make informed decisions. The framework places citizens at the core of the data protection system.
The statement highlights that India’s model strikes a unique balance between fostering innovation and protecting personal data. Unlike restrictive global frameworks, these rules encourage economic growth while prioritizing citizen welfare. Stakeholders view this as a potential global template for data governance.
The framework also aims to reduce compliance burdens for smaller businesses and startups. An adequate transition period will be provided to ensure all stakeholders, from small enterprises to large corporations, can smoothly adapt to the new law, the statement said.
Embracing a “digital by design” philosophy, the rules focus on consent mechanisms, grievance redressal, and the functioning of the Data Protection Board, all aimed at ensuring ease of living and ease of doing business. The Board will operate as a digital office, with a platform and app enabling citizens to file complaints digitally and have them adjudicated without requiring physical presence, the statement explained.
From processing complaints to interacting with Data Fiduciaries, workflows are optimized to ensure speed and transparency, reflecting India’s forward-looking approach to governance and fostering trust between citizens and data handlers.
Graded responsibilities outlined in the rules cater to startups and MSMEs with a lower compliance burden, while Significant Data Fiduciaries have higher obligations. Sector-specific data protection measures can complement the core personal data protection framework established by the Act and its rules.
The Data Protection Board’s digital-first approach is expected to ensure quick and transparent resolution of complaints. While imposing penalties for defaults, the Board is required to consider factors such as the nature and gravity of violations and efforts made to mitigate their impact.
Additionally, Data Fiduciaries may voluntarily offer undertakings during proceedings, which, if accepted by the Board, could lead to the proceedings being dropped. This mechanism balances the need to protect citizens’ rights with a fair adjudicatory process for entities handling personal data.
The draft rules are based on extensive inputs from various stakeholders and a study of global best practices. The Ministry of Electronics and Information Technology has invited feedback and comments from the public and stakeholders until February 18 through the MyGov platform, in line with the government’s commitment to an inclusive approach to law-making.
Meanwhile, the government is planning a comprehensive awareness campaign to educate citizens about their rights and responsibilities under the new framework, fostering a culture of data responsibility.
(Inputs from IANS)
