The DPDP Act and the draft rules are structured to adapt to rapid advancements in digital technologies, it added. The Data Protection Board, envisioned as a fully digital entity, will enable citizens to lodge complaints and resolve disputes online without the need for physical presence. Citizens will be informed of their rights and empowered to manage their personal data through multilingual digital platforms.
In addition to online feedback, the Ministry plans structured consultations with civil society, industry, and government stakeholders to refine the rules. Finalised rules will be submitted to Parliament for approval.
The draft rules aim to protect individual rights without causing disruptions to existing digital practices. Organizations will be given adequate time to comply with the new regulations, with minimal compliance burdens. Data processing based on prior consent will be allowed to continue, with notices issued to individuals, ensuring their rights under the law are upheld.
To safeguard children’s personal data, Data Fiduciaries must implement measures to obtain verifiable parental consent. Additionally, startups will benefit from reduced compliance requirements, while significant Data Fiduciaries will be subject to stricter obligations.
Discover the stories of your interest
The DPDP Act introduces graded financial penalties based on the severity and duration of violations. Businesses may voluntarily submit undertakings to the Data Protection Board to avoid penalties during proceedings, ensuring fair and proportional enforcement. The draft rules do not impose a blanket requirement for storing personal data within India. However, restrictions on cross-border data transfers may apply to specific categories of personal data as recommended by a designated committee.
By integrating digital-first mechanisms and maintaining a balanced regulatory framework, the draft DPDP Rules aim to secure the rights of citizens while ensuring India’s digital economy continues to thrive.
