“When we talk about the global future, then
human-centric approaches should be foremost.” These words from our Hon'ble
Prime Minister Shri Narendra Modi at the recent United Nations ‘Summit of the Future’ reflect India’s vision
of putting people first. This philosophy has guided our efforts in shaping the
Draft Digital Personal Data Protection (DPDP) Rules, 2025. The rules, after
being finalized, would operationalize the Digital Personal Data Protection Act,
2023, bringing to life our commitment to safeguarding citizens’ right to
personal data protection.
A New Era of Empowerment
The Indian citizen
lies at the heart of the DPDP Rules, 2025. In a world increasingly dominated by
data, we believe it is imperative to place individuals at the heart of the
governance framework. These rules empower citizens with rights such as informed
consent, data erasure, and the ability to appoint digital nominees. Citizens
will no longer feel helpless in the face of breaches or unauthorized data
usage. They will have tools to protect and manage their digital identities
effectively.
The rules are
designed with simplicity and clarity, ensuring that every Indian, regardless of
their technical knowhow, can understand and exercise their rights. From
ensuring consent is sought in clear terms to mandating that information be
provided to the citizens in English or any of the 22 Indian languages listed in
the Constitution, the framework reflects our commitment to inclusivity.
Safeguarding children
Children requires
special care in the digital age. Recognizing this, the rules mandate verifiable
parental or guardian consent for processing the personal data of minors.
Additional safeguards ensure that children are shielded from exploitation,
unauthorized profiling, and other digital harms. These provisions reflect our
dedication to creating a safer digital space for the future generation.
Balancing Growth with Regulation
India’s digital
economy has been a global success story, and we are determined to keep this momentum
alive. Our framework ensures personal data protection for the citizens while enabling
innovation in the digital economy. Unlike some international models that lean
heavily towards regulation, our approach is pragmatic and growth-oriented. This
balance ensures that citizens are protected without stifling the innovative
spirit that drives our startups and businesses.
Small businesses and
startups will face lower compliance burdens. The rules are designed with graded
responsibilities, taking into account the varying capacities of stakeholders.
Larger companies, based on assessment of data fiduciaries, will have higher
obligations, ensuring accountability without disrupting growth.
A Digital-First Philosophy
At the core of these
rules is a “digital by design” philosophy. The Data Protection Board, tasked
with resolving grievances and enforcing compliance, will function predominantly
as a digital office. By leveraging technology, we ensure efficiency, transparency,
and speed. Citizens can file complaints, track progress, and seek resolutions
without unnecessary physical interactions.
This digital-first
approach extends to consent mechanisms and data management workflows. By
streamlining processes, we make it easier for fiduciaries to comply, and for
citizens to engage, fostering trust in the system.
Inclusive Approach
The journey to these
rules has been as inclusive as their intent. Grounded in the principles of the
Digital Personal Data Protection Act, 2023, the draft rules are a product of wide
ranging inputs gathered from various stakeholders and study of global best
practices.
We have opened a
45-day public consultation period, inviting feedback and suggestions from
citizens, businesses, and civil society. This engagement is a testament to our
belief in collective wisdom and the importance of participatory policymaking,
while ensuring that the framework is not only robust but also adaptable to the
unique challenges of our socio-economic landscape.
To ensure citizens
are aware of their rights and responsibilities, widespread awareness initiatives will be undertaken to educate the
citizens about their rights on their personal data.
A Vision for the Future
As we unveil these
rules, we are not merely addressing present challenges but laying the
groundwork for a secure and innovative digital future. The Draft Digital
Personal Data Protection Rules, 2025, reflect India’s leadership in shaping
global data governance norms. By placing citizens at the center and fostering a
conducive environment for innovation, we are setting a precedent for the world
to follow.
Our commitment is
clear: to protect, empower, and enable every Indian in this digital age. I
encourage every citizen, business, and civil society group to participate in
this dialogue by sharing comments and suggestions during the consultation
period. Together, let us refine these rules to create a framework that truly
represents the aspirations of a secure, inclusive, and thriving digital India.
The Author is the
Hon’ble Minister for Electronics and Information Technology, Information &
Broadcasting, and Railways.
