India's draft data protection rules: Keep data safe, but keep it easy
Digital Personal Data Protection Rules 2025, which are essential provisions of Digital Personal Data Protection Act 2023. The draft rules are open for consultation until Feb 28. They bring much-needed clarity on:
ET Year-end Special Reads
Buying a home in 2025? Here's how property market can shape up
18 top stock picks for 2025 from 6 leading brokers
Five big bangs that shook the corporate world in 2024
- Consent managers and their obligations, processing of personal datafor provision or issue of any subsidy, benefit, service, certificate, licence etc, reasonable security safeguards to ensure proper processing of personal data, etc.
- Rules use illustrations to clarify certain points, making it easy to understand the provision and scope. They provide for the creation of digital offices of Data Protection Board of India and the appellate tribunal. In both offices, proceedings will be virtual. This is a forward-looking initiative.
However, certain issues remain:
Cross-border data transfer
The Act provides for restricting cross-border transfer of personal data to certain countries to be notified by GoI. However, in the draft rules, in the context of providing for additional obligations of significant data fiduciary (SDF), it is clarified that an SDF shall process such personal data as specified on the recommendation of a committee, subject to the restriction that personal data and traffic data pertaining to its flow is not transferred outside the territory of India.
This is a significant restriction that will hinder
