Fine-Tuning Consent And Compliance - A Legal Lens On The DPDP Draft Rules
Author: LawSphereX
Category: General Law
Published:
Updated:
FINE-TUNING CONSENT AND COMPLIANCE: A LEGAL
LENS ON THE DPDP DRAFT RULES
Mathilda Fernandes, KES' Shri Jayantilal H. Patel Law College
ABSTRACT
In 2023, India enacted the Digital Personal Data Protection Act to establish a comprehensive framework for processing personal data, applicable to both online and digitized offline data. Building upon this, the Ministry of Electronics and Information Technology (MeitY) released the Draft Digital Personal Data Protection Rules, 2025, detailing implementation aspects such as data fiduciary obligations, data principal rights, and the establishment of the Data Protection Board of India. These draft rules mandate data fiduciaries to implement robust security measures, including encryption and access controls, to safeguard personal data. They are also required to provide clear notices to individuals (data principals) regarding data processing activities and to facilitate rights such as data access, correction, and erasure.
The draft rules propose the appointment of Data Protection Officers for significant data fiduciaries and outline penalties for non-compliance, ranging from INR 50 million to 2. 5 billion for organizations. Additionally, the rules address the processing of children’s data, cross-border data transfers, and the role of consent managers in managing user consent. Keywords: Right to Privacy, Personal Data, Data fiduciary Security, GDPR vs. DPDP, Regulatory Compliance.
Introduction
The Digital Personal Data Protection Act, 2023 (Data Protection Act), which established a governance framework for personal data protection, was approved by the Ministry of Electronics and Information Technology (MeitY) on August 11, 2023, following years of discussion and multiple revisions of the data protection law. With the historic ruling in Justice K. S. Puttaswamy v. Union of India (2017)1, the enforcement of the fundamental right to privacy under Article 212 of the Constitution was finally made possible. To operationalize this Act, MeitY released the Draft Digital Personal Data Protection Rules, 2025, on January 3, 2025, for public consultation. The initial deadline for submitting comments was February 18, 2025. However, a 15-day extension was later granted, extending the deadline to March 5, 2025.
3 Following the conclusion of the public consultation period on March 5, 2025, the government is expected to release the finalized rules within the next eight weeks. These draft rules provide detailed guidelines on various aspects of data processing, including the obligations of data fiduciaries (entities processing personal data), the rights of data principals, and the establishment of the Data Protection Board of India. Key provisions encompass requirements for clear notices to individuals regarding data collection and usage, the appointment of Data Protection Officers by significant data fiduciaries, and the implementation of robust security measures such as encryption and access controls. Additionally, the rules outline procedures for reporting data breaches, stipulate penalties for non-compliance, and address the processing of children’s data and cross-border data transfers.
This article is based on two main hypotheses: “The DPDP Act effectively balances the protection of individual privacy rights with the facilitation of data-driven innovation in India”. 1 Justice K. S. Puttaswamy (Retd. ) & Anr. V. Union of India & Ors. , (2017) 10 SCC 1; AIR 2017 SC 4161; Writ Petition (Civil) No. 494 of 2012. Government of India. (1950). The Constitution of India. Article 21. Retrieved from https://indiankanoon. org/doc/1199182/ 3 Suraksha, P. (2025, February 15). IT ministry issues official notice on extension of time for draft DPDP Rules feedback. The Economic Times. https://m. economictimes. com/tech/technology/it-ministry-issues-official-noticeon-extension-of-time-for-draft-dpdp-rules-feedback/articleshow/118245701. cms “The DPDP Act aligns with international data protection standards, thereby influencing the operations of multinational corporations within India”.
Having discussed the detailed provisions and implications of the Digital Personal Data Protection Act, 2023: The Digital Personal Data Protection Act, 2023, is a landmark legislation in India that governs the processing of digital personal data. It applies to data collected digitally or later digitized, and even to processing activities conducted outside India if linked to offering goods or services within India.
1. The Act emphasizes lawful and purpose-specific data collection, requiring affirmative
and informed consent from the data principal, (According to Section 6 of the DPDP Act), who retains the right to withdraw consent at any time, (Section 8). It abolishes sub-categories such as sensitive personal data and treats all personal data equally. The Act introduces legitimate uses for processing data without consent in specific cases, such as employment or emergencies.
2. Data fiduciaries are obligated to ensure data accuracy, allow for data erasure, report
data breaches, and may transfer data abroad unless restricted by a government blacklist, (Section 16).
3. Significant data fiduciaries must meet additional obligations, including appointing a
Data Protection Officer and conducting periodic audits, (Section 10).
4. The Act also provides special protections for the personal data of children and persons
with disabilities,(Section 9(5)).
5. The Data Protection Board of India is established to enforce compliance, impose
penalties of up to INR 250 crores, and manage grievance redressal, (Section 27).
6. Notably, while the Act does not provide compensation to data principals for breaches,
it does impose penalties for misuse. It also allows for voluntary undertakings and provides broad exemptions for state functions, start-ups, and legal proceedings, (Section 14). 4 Literature Review The evolution of data protection laws in India has been marked by significant legislative and judicial developments aimed at safeguarding individual privacy in the digital age. This literature review examines previous studies, key legal cases, and identifies gaps in the existing framework to provide a comprehensive understanding of the current landscape. India’s journey toward comprehensive data protection legislation has been a subject of extensive scholarly analysis. The enactment of the Digital Personal Data Protection Act (DPDP Act) in 2023 marked a pivotal moment in this trajectory.
According to KPMG, the DPDP Act establishes “a robust framework for processing personal data, emphasizing transparency, accountability, and the rights of data principals. ”5 Further, the Ministry of Electronics and Information Technology (MeitY) released the Draft Digital Personal Data Protection Rules in January 2025 to operationalize the Act. These draft rules detail obligations for data fiduciaries, including the implementation of security safeguards and the management of consent through consent managers. Public consultations were invited to refine these regulations, highlighting the government’s commitment to stakeholder engagement. Comparative analyses have also been conducted to position India’s data protection framework within a global context. Singh and Singh’s (2019) study provides a comparative analysis of cybersecurity and data protection laws in India and the United Kingdom.
6 The authors identified several gaps and challenges in the legal frameworks of both countries, including ambiguity in legal definitions, enforcement challenges, and penalties that do not serve as strong deterrents. They also emphasized the need for better alignment with global data protection standards to facilitate cross-border data flows and enhance international cooperation. 4 AZB & Partners. (2023, September 11). Digital Personal Data Protection Act, 2023 – Key Highlights. AZB & Partners. https://www. azbpartners. com/bank/digital-personal-data-protection-act-2023-key-highlights/
5 KPMG. (2023, August). Digital Personal Data Protection Act, 2023 – An Overview. KPMG India.
https://kpmg.com/in/en/insights/2023/08/digital-personal-data-protection-act-2023-overview.html 6 Yadav, M., & Sharma, J. (2022). Assessing cyber security and data protection laws: A comparative study of India and global perspectives. International Journal of Innovations & Research Analysis, 2(4), 120–124. https://inspirajournals.com/uploads/Issues/1205983810.pdf Institutional Responses to Data Protection Practices In November 2024, the Competition Commission of India (CCI) fined Meta Platforms $25.4 million, approximately ₹213.14 crores, for abusing its dominant position through WhatsApp’s
2021 privacy policy update. The CCI also prohibited WhatsApp from sharing user data with
other Meta entities for advertising purposes for five years. Meta disagreed with the ruling, stating, “We disagree with the CCI’s decision and plan to appeal. As a reminder, the 2021 update did not change the privacy of people’s personal messages and was offered as a choice for users at the time. ”7 This case highlights the increasing regulatory scrutiny of data privacy practices in India. Key Legal Cases Judicial interpretations have significantly influenced India’s data protection landscape. The landmark case of Justice K. S. Puttaswamy (Retd. ) v. Union of India (2017) recognized the right to privacy under Article 21 as a fundamental right under the Indian Constitution, laying the groundwork for subsequent data protection legislation.
8 Pegasus Spyware Scandal (2021): In 2021, reports emerged alleging that the Pegasus spyware was used to surveil journalists, activists, and politicians in India, raising significant privacy concerns. The Supreme Court, acknowledging the seriousness of these allegations, formed an independent committee to investigate. The committee examined 29 mobile phones, finding malware in five, but no conclusive evidence of Pegasus spyware. In its judgment, the Court emphasized that “indiscriminate spying on individuals does not suit a democracy. ”9 7 Shinde, S. (2024, November 19). Meta to appeal against CCI’s Rs 213 crore penalty, diktat on data share. Business Standard. https://www. business-standard. com/companies/news/whatsapp-parent-firm-meta-disagreeswith-cci-decision-plans-to-appeal-124111900123_1. html 8 Justice K. S. Puttaswamy (Retd. ) & Anr. V. Union of India & Ors.
, (2017) 10 SCC 1; AIR 2017 SC 4161; Writ Petition (Civil) No. 494 of 2012. 9 The Hindu. (2021, October 27). Indiscriminate spying on individuals does not suit a democracy, says Supreme Court. https://www. thehindu. com/news/national/indiscriminate-spying-on-individuals-does-not-suit-ademocracy-supreme-court/article37191169. ece Identification of Research Gaps Despite these advancements, several gaps persist in India’s data protection framework. Numerous critiques have been raised regarding the Draft Digital Personal Data Protection Rules, 2025. The Internet Freedom Foundation (IFF), for instance, described the rules as “too little, too vague, and too late,” pointing out the use of undefined terms such as “reasonable safeguards,” “appropriate measures,” and “necessary purposes,” which may lead to ambiguity in compliance and enforcement.
10 Research Methodology This study employs a doctrinal research methodology, focusing on the critical analysis of legal texts and statutes. Specifically, it examines the provisions of the Digital Personal Data Protection (DPDP) Act, 2023, to assess its effectiveness in balancing individual privacy rights with the facilitation of data-driven innovation in India. Additionally, the study evaluates the Act’s alignment with international data protection standards and its implications for multinational corporations operating within India. To assess the aforementioned hypotheses, this study centers on a critical analysis of legal texts and statutes. It specifically evaluates the provisions of the DPDP Act, 2023, to determine its effectiveness in protecting individual privacy while enabling data-driven innovation in India.
Furthermore, the study analyzes the Act’s compliance with international data protection standards and its potential impact on multinational corporations operating in the country. Analysis of the Draft Digital Personal Data Protection Rules, 2025: Notice for Consent: Data fiduciaries are required to provide Data Principals with clear and standalone notices that include: 10 Internet Freedom Foundation. (2025, April 14). Statement on the draft Digital Personal Data Protection Rules,
2025. https://internetfreedom.in/statement-on-the-draft-dpdp-rules-2025/
(i) A description of the personal data being processed.
(ii) The specific purpose for data processing. (iii) Information on how consent can be withdrawn. These notices must be written in simple and easily understandable language to ensure informed consent. Consent Managers: Entities known as Consent Managers must register with the Data Protection Board of India (DPBI) and serve as a single point of contact for Data Principals to give, manage, review, and withdraw consent through a transparent and secure platform. Data Security Safeguards: Data fiduciaries are obligated to implement robust security measures to protect personal data, including: (i) Encryption, obfuscation, and masking techniques. (ii) Strict access controls to prevent unauthorized access. (iii) Regular monitoring and maintenance of access logs. (iv) Data backup and disaster recovery plans.
Data Breach Notification: In the event of a personal data breach, data fiduciaries must: (i) Promptly notify each affected Data Principal, detailing the nature, extent, and timing of the breach, as well as measures taken to mitigate risks. (ii) Notify the DPBI within 72 hours of becoming aware of the breach. This ensures transparency and allows Data Principals to take necessary precautions.
Data Retention and Erasure: Certain entities, such as e-commerce platforms with over two crore registered users, must delete personal data within three years from the date of the user’s last interaction, unless the user actively maintains their account. Data fiduciaries must inform the Data Principal at least
48 hours before such data erasure.
Processing of Children’s Personal Data: Data fiduciaries processing the personal data of children (individuals under 18 years) must: (i) Obtain verifiable parental consent through appropriate technical and organizational measures. (ii) Ensure due diligence to verify that the individual providing consent is an identifiable adult. Cross-Border Data Transfer: The draft rules impose restrictions on transferring sensitive personal data outside India, with provisions for exceptions based on government approvals. Penalties for Non-Compliance: Hefty fines are proposed for breaches, non-compliance, or violations of the provisions, ranging up to ₹100 crores. Rules related to the Data Protection Board are expected to come into effect immediately upon publication in the Official Gazette. For other provisions, an extended compliance period will be provided through specific timelines.
11 Compliance Requirements and Implementation Strategies In evaluating the hypotheses introduced earlier, the Digital Personal Data Protection Act, 2023 11 Ministry of Electronics and Information Technology. (2025, January 3). Draft Digital Personal Data Protection Rules, 2025. Government of India. https://www. meity. gov. in/static/uploads/2025/02/f8a8e97a91091543fe19139cac7514a1. pdf (DPDP Act) indeed strives to balance individual privacy rights with the imperatives of datadriven innovation in India. The Act establishes a consent-based framework, mandating that “the consent of the data principal is free, specific, informed, unconditional, and unambiguous with a clear affirmative action. ”12 Simultaneously, the DPDP Act acknowledges the dynamic nature of the digital economy by incorporating provisions that facilitate legitimate data processing activities essential for innovation.
For instance, it allows certain exemptions for data fiduciaries when processing data for purposes such as “the interest of sovereignty and integrity of India or security of the State. ”13 Regarding the second hypothesis, the DPDP Act aligns with several international data protection standards, notably the European Union’s General Data Protection Regulation (GDPR). Both legislations emphasize individual consent, data subject rights, and the accountability of data processors. However, there are notable distinctions. The DPDP Act focuses exclusively on digital personal data, whereas the GDPR encompasses both digital and non-digital personal data. Additionally, the DPDP Act does not differentiate between personal and sensitive personal data, a distinction central to the GDPR.
14 These differences imply that multinational corporations operating in India must tailor their data protection strategies to comply with the specific requirements of the DPDP Act, even if they are already compliant with the GDPR. Conclusion and Recommendations As of April 2025, the Government of India is preparing to release the final version of the Digital Personal Data Protection Rules. Union Minister Ashwini Vaishnaw indicated that the rules would be fully rolled out in the coming months, with the UIDAI enhancing its backup server capacity to support this implementation. Additionally, a beta version of the face authentication Digital Personal Data Protection Act, (Section 6). Government of India. https://www. indiacode. nic. in/handle/123456789/59692 13 Ministry of Law and Justice. (2023, August 11). Digital Personal Data Protection Act, 2023 (Section 17). Government of India.
https://www. indiacode. nic. in/handle/123456789/59692 14 Latham & Watkins LLP. (2023, December). India’s Digital Personal Data Protection Act 2023 vs. The GDPR: A Comparison. https://www. lw. com/en/insights/2023/12/Indias-Digital-Personal-Data-Protection-Act-2023-vsthe-GDPR-A-Comparison app was launched, signalling a move towards more robust and secure digital identity verification mechanisms. The Digital Personal Data Protection Act, 2023 (DPDP Act) marks a significant advancement in India’s data protection framework, emphasizing individual consent, data subject rights, and the accountability of data processors. However, challenges remain—particularly the broad exemptions granted to government entities, which may impact the safeguarding of privacy rights.
To enhance India’s data protection framework, the following recommendations are proposed: (i) Clarify Definitions – Terms such as “sensitive personal data” should be clearly defined to prevent ambiguity and potential misuse. (ii) Strengthen Provisions Related to Individual Rights – This includes setting clearer limitations on data use and imposing stricter conditions for exemptions to ensure a more privacy-centric approach. (iii) Develop Sector-Specific Legislation – Comprehensive laws tailored to specific sectors, particularly healthcare, should be introduced to address unique data protection needs.
References
https://www.mondaq.com/india/privacy/1360992/digital-personal-data-protection-act-2023key-highlights?utm_ https://www.ey.com/en_in/insights/cybersecurity/transforming-data-privacy-digital-personaldata-protection-rules-2025 https://www.barandbench.com/law-firms/view-point/india-digital-personal-data-protectionrules-2025-key-highlights https://www.azbpartners.com/bank/digital-personal-data-protection-act-2023-key-highlights/ https://www.livemint.com/industry/data-privacy-digital-personal-data-protection-digitalprivacy-laws-data-protection-board-data-breaches-personal-data-11736312970967.html https://www.thehindu.com/news/national/indiscriminate-spying-on-individuals-does-not-suita-democracy-supreme-court/article37191169.ece?utm_source=chatgpt.com