The Arrival Of Privacy Era In India - Digital Personal Data Protection Act And Rules 2025
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
THE ARRIVAL OF PRIVACY ERA IN INDIA: DIGITAL
PERSONAL DATA PROTECTION ACT AND RULES 2025
Pooja Soni & Sangeeta, National Law University, Delhi
ABSTRACT
In today’s digital world, protecting data and ensuring privacy have become very important for individuals, companies, and governments. As more data is created and shared online, the chances of it being accessed without permission or misused are growing rapidly. Data protection refers to the ways we keep personal and sensitive information safe from being lost, leaked, or damaged. On the other hand, digital privacy is about a person’s right to control who can collect, use, and share their personal information. Privacy isn't just a technical issue—it’s a basic human right that needs constant attention, new ideas, and cooperation from countries around the world. Both people and organizations must act responsibly and ethically to keep information private in the digital era.
This paper looks at how the Digital Personal Data Protection (DPDP) Act and its recent enforcement rules may affect data privacy, especially for children and women, helping protect them from online privacy threats. Even with these laws, it remains difficult to balance the benefits of using data for innovation with the need to respect people’s privacy. To stay ahead, organizations must use strong security measures like encryption, system checks, regular reviews, and staff training. At the same time, the public must be educated about their digital rights and the risks of their online behaviour. In the end, achieving strong data protection and privacy requires everyone to work together to build trust and ensure technology supports human rights and social progress.
INTRODUCTION:
India, with over a billion citizens and a growing digital economy, is at the forefront of tech innovation. The easy availability and rapid growth of data have improved public services, transformed government operations, and fueled new ideas like never before. As more people go online and with major projects like Digital India underway, the country faces a crucial moment in managing data privacy. It’s now more important than ever to find a balance between the constitutional right to privacy, recognized by the Supreme Court in 2017, and the need for digital progress and efficiency. As technology continues to shape our world, understanding data privacy and our ethical responsibilities is key. What is Data Privacy? The practice of preventing unauthorised access, use, or disclosure of personal information also called as “Personally identifiable information” (PII) is known as data privacy.
People exchange a lot of personal information online in today's digital age through social networking, online banking, online shopping, and other channels. Because of this, it is crucial to make sure that such information is handled appropriately. People may manage who can access their information and how it is used thanks to data privacy. It aids in preventing fraud, identity theft, and improper use of private information.
ASPECTS OF A DATA PRIVACY
There are 5 main aspects of a data privacy which needs to be looked at while we study data privacy. These aspects define the intention of any statute which aimed at preventing data privacy violations. • PERSONAL DATA- Any information which is used to identify you. It can include your name, address, phone number, email address etc. • COLLECTION- Whether the data is being collected with your consent or not? Is it transparent and clear as to what data is being collected and for what purpose is it being collected? • USE-How is your data used? Is it being shared with the third party with or without your consent?
DISCLOSURE-Who can access your data? Are there any security measures? • CONTROL- Do you have control on your data. Can you opt out or withdraw your data or use practices?
WHY DATA PRIVACY?
Protection against fraud and identity theft: Giving out personal information makes you susceptible to financial fraud and identity theft. Identity theft occurs when cybercriminals unlawfully obtain private and sensitive data about a person and compromise it for their own purposes, such as stealing funds from bank accounts or setting up phone social media profiles and taking over accounts for personal gain. • Protection against Discrimination: Data can be purposefully utilized for private benefit to discriminate against people on the basis of political views, religion, or race, which can upset a nation's social and political structure. • Accountability and transparency: Well-known websites and mobile applications gather a lot of user data in order to provide tailored experiences, optimised services, and targeted advertising, but never completely reveal its purposes to its users.
In a similar vein, location-based services improve navigation and offer suggestions, but they also track users' movements, jeopardising their privacy. • Protection against Government Surveillance: By compromising the values of proportionality, transparency, and permission, government surveillance occasionally jeopardises individual privacy. People may fear consequences for voicing divergent views or participating in actions that are entirely legal but viewed as dangerous by authorities, which can have a chilling effect on free expression and association. • Economic growth and data-driven innovation: Encouraging data-driven innovation while safeguarding individual privacy can result in the creation of new services and technology that benefit society at large.
DIGITAL PERSONAL DATA PROTECTION ACT, 2023
Scope and Applicability: The DPDP Act regulates the processing of digital
personal data in India in two situations: (i) when the data is obtained digitally from data principals, or (ii) when the data is first obtained in a non-digital format and then converted to digital. Therefore, processing of non-digitized personal data is exempt from the DPDP Act. Compared to the 2022 Bill, which excluded "nonautomated" processing and "offline" data, it is more precise and limited. Additionally, the law's reach has been expanded. It can now be used extraterritorially to include processing digital personal data outside of India if it is related to the delivery of goods or services to data principals who are based in India. Notably, the DPDP Act does not explicitly address whether its provisions are applicable to the processing of personal data belonging to data principals situated outside India.
• Personal data: The DPDP Act now uses a new phrase, "digital personal data," to refer to personal data that is shown digitally. This makes it clearer what the upcoming Act would cover and sets it apart from other types of personal data. The processing of personal data—defined as any data belonging to an identifiable individual—is the only activity covered under the DPDP Act. Notably, the DPDP Act does away with the difference between sensitive and critical personal data that was included in all previous draft bill iterations up until the 2022 version. This change represents a break from the prior approach and should be carefully considered for its effects on privacy and data security issues.
• Personal data processing: By defining processing as an entirely or partially automated action or a sequence of activities carried out on digital personal data, the DPDP Act carefully defines the extent of processing. This broad definition includes a number of activities, such as gathering, documenting, organising, organising, storing, adapting, retrieving, using, aligning, combining, indexing, sharing, and disclosing by transmission or another method. Furthermore, the concept extends to encompass operations such as restriction, erasure, or destruction of data. Despite the fact that the DPDP Act does not define "verifiable" parental consent, it does require it when processing a child's personal data. The Central Government has the authority to exempt certain data fiduciaries from this requirement by lowering the
age limit for parental consent, provided that the processing is considered safe. Additionally, data fiduciaries must avoid processing personal data likely to have a detrimental impact on a child\'s well-being. • Data principal: The idea of "data principal" has been greatly expanded. Parents or legal guardians of minors to whom the personal data relates are also included, in addition to persons. Furthermore, legal guardians of "persons with disabilities" are now included in the term • Data fiduciary: According to the DPDP Act, a data fiduciary is any individual who, acting alone or in concert with others, chooses the method and goal of processing personal data. The DPDP Act specifies several "legitimate uses" that allow data custodians to handle personal information without express authorisation.
When a data principle voluntarily gives personal information when requesting or using a service and hasn't expressed non-consent, that is one example. Processing data in accordance with Indian or international legislation in situations involving contracts or civil claims is also considered legitimate usage. When it is reasonable to believe that the purpose for which the data was gathered is no longer being served, data fiduciaries are also compelled to stop keeping personal data. • Data Protection Board: The most important modification to the DPDP Act concerns the creation and makeup of the Board. The establishment of the Board was subject to future rules set by the Central Government, according to the 2022 Bill. This latest version, however, clearly lays out the foundation for the Board's constitution.
Significant changes have also been made to the Central Government's power to create regulations and the precise circumstances in which organisations might be excused from adhering to the bill's requirements. • Changing conflict adjudication: The DPDP Act facilitates a paradigm change in the field of dispute resolution by illustrating the intricate relationship between the existing legal procedures and the legislative environment. One significant change is the Board's authority to impose monetary fines as outlined in the Schedule. A previous reference to a maximum penalty cap of Rs. 500 crores, which was included in the 2022 Bill and represented a purposeful recalibration in the implementation of
penalties, is omitted. This recalibration demonstrates a methodical process that aligns fines with the seriousness of violations, exemplifying the proportionality principle. As it turns to the Telecom Disputes Settlement and appeal Tribunal for relief, the appeal procedure also undergoes a radical change. • Penalties: Failure to prevent a breach of personal data is one of the offences for which penalties of up to INR 250 crore may be levied. The INR 500 crore cap on penalties for a single offence was eliminated by the DPDP Act. The DPDP Act does not allow impacted data principals to pursue damages for data fiduciary breaches, in contrast to earlier iterations. Rather, the Board can now punish data principals who fail to perform their duties with fines of up to INR 10,000.
CRITICAL ANALYSIS OF THE ACT
B.N. Srikrishna committee in India has laid the foundation of data privacy in India underlining the strengths and weaknesses with respect to safeguarding personal data in cyberspace.
STRENGHTS
Comprehensive Framework: The paper provides a comprehensive framework for data protection that includes essential components such data processing, consent mechanisms, reporting data breaches, and sanctions for violations. • Data Localization: By claiming data sovereignty, its focus on data localization guarantees improved regulatory control, which enhances data security. • Data Protection Authority: The proposal for an independent Data Protection Authority adds a level of responsibility by guaranteeing targeted oversight and enforcement of laws. • Protection of Child Data: Taking special measures to safeguard children's data online is a critical first step in ensuring the security of vulnerable groups.
WEAKNESSES
Lack of Clear Definitions: Some terms, like "significant data fiduciaries," are not well
explained. This can lead to confusion and different ways of applying the law. • Government Exceptions: The rules allow many exemptions for government actions, which might unintentionally put people's privacy at risk and weaken the overall goal of data protection. • Data Localization Issues: Keeping data stored only within India can improve security but may create problems for global tech companies. It might also slow down the growth of India’s digital economy. • Implementation Hurdles: Enforcing these rules across India’s vast and diverse digital environment could be difficult and uneven.
SOCIAL ASPECTS
Giving People More Control: The rules help people take charge of their own data and increase understanding of how digital systems work. • Worries About Surveillance: Broad powers for the government may lead to excessive monitoring, reducing public confidence. • Digital Divide: People without internet access or digital skills might struggle with the consent process, leaving them at a disadvantage. • Changes in Online Behaviour: Knowing their data is being watched might make users more cautious or hesitant to engage with digital platforms.
POLITICAL ASPECTS
Too Much Central Control: A lot of power lies with the central government, which raises concerns about state-level involvement and federal balance. • Potential for Political Abuse: Without strong safeguards, there’s a risk that data could be misused during elections or for profiling citizens. • Weak Oversight: The same branch of government that writes the rules also controls the Data Protection Board, which can reduce fairness and independence.
Limited Accountability: There’s not enough supervision from courts or lawmakers over how exceptions are used.
ECONOMIC ASPECTS
Business Environment: Loosening some data localization rules may attract foreign investors and help tech startups grow. • Cost of Compliance: Small and medium businesses might struggle with the cost and complexity of following these rules and meeting legal standards. • Support for Innovation: Responsible use of data can support the growth of fields like AI, finance technology, and data analytics. • Market Inequality: Large companies may have the resources to comply quickly, while smaller firms may fall behind due to the high compliance burden.
LEGAL ASPECTS
Privacy Rights at Risk: Broad government exceptions may conflict with the 2017 Supreme Court decision that made privacy a basic right. • Barriers to Legal Action: People must first approach the Data Protection Board before going to court, which can slow down the justice process. • Limited User Powers: The law doesn’t clearly define rights like deleting your data or moving it to another service. • Unclear Consent Rules: The idea of “deemed consent” is vague and could be misused, especially in jobs or public services.
OVERVIEW OF THE DPDP RULES, 2025
India took a big step in data privacy with the Digital Personal Data Protection Act in 2023, and the rules came into force in 2025. These rules clearly lay out what organizations (called data fiduciaries) must do, what rights individuals (data principals) have, and how consent is to be handled through authorized managers. Because India’s digital economy is large and
sensitive, it's important to see how well these rules work. The framework involves three main players: data handlers (who collect and use personal data), consent managers (who help users manage permissions), and the government (which uses data for public services). This setup helps make sure everyone plays a part in keeping personal data safe.
KEY IMPACTS OF THE DPDP RULES, 2025
Empowerment of Data Principals One of the major benefits of the DPDP Rules is that they give more control to users over their personal information. The rules allow people to view, fix, delete their data, or assign someone else to handle it for them. These rights must be easy to use through company websites or apps, helping users take part in digital systems with clear understanding and choice. Consent and Notification The rules require companies to clearly explain what data they collect, why they need it, and how they will use it. People must give permission knowingly and freely, and they must be able to take back their permission at any time. Consent managers are expected to keep proof of all actions taken on behalf of users for at least seven years.
Protecting Children and Vulnerable Groups When the data belongs to children (under 18) or people with disabilities, companies must get clear approval from a parent or legal guardian. Although this improves safety for these groups, there are still problems because there’s no consistent method to verify someone’s age or identity. Data Breach and Security If a data breach happens, companies have to inform both the affected users and the Data Protection Board within 72 hours. They must explain what happened, what the impact is, and what steps they are taking to fix it. To protect data, companies should use strong tools like encryption, access limits, regular backups, and keep audit records for at least one year.
Data Storage and Deletion If a user hasn't interacted with a company in three years, the company must delete their data— unless it’s needed for legal reasons. Before doing this, the user must be notified 48 hours in advance and given the option to stay connected. This rule prevents storing unnecessary data but may affect how companies run marketing campaigns. Large Data-Handling Organizations (SDFs) Some platforms, like online stores with over 20 million users or gaming and social media services with large followings, are considered Significant Data Fiduciaries (SDFs). These must do yearly audits, assess how data use affects privacy, be open about their algorithms, and follow data storage rules within the country. But since there's no clear definition of what qualifies an organization as an SDF, companies may face confusion.
Transferring Data Abroad Sending personal data to other countries is allowed only under conditions set by the central government. While this protects national control over data, it may cause problems for global companies that use cloud services based in other countries. More details are needed on which countries and systems are approved. Exemptions and Unclear Areas Some exceptions exist, such as for research, historical records, or national security. However, these terms are not clearly explained, which could lead to misuse. Also, the rules don’t explain how consent should work in offline or mixed (paper-digital) settings, creating gaps in enforcement. Handling Complaints and Responsibility Although companies must offer a way for users to file complaints, the rules don’t say how quickly those complaints must be handled. This can slow down the process and reduce trust.
Having a set timeline—like 15 to 30 days—would make the system more reliable and userfriendly.
LOOPHOLES AND GAPS IN THE DRAFT RULES
Ambiguity in Key Definitions • Terms such as "research," "archiving," and "statistical purposes" lack clarity, leading to broad interpretation and possible misuse. • “Algorithmic software” not clearly defined, yet subject to risk assessments under SDF obligations. Undefined Grievance Redressal Timelines • No maximum response time for Data Fiduciaries or Consent Managers is defined, weakening enforcement of user rights. Vague Classification Criteria for SDFs • Lack of clear thresholds or metrics for SDF designation could result in inconsistent application of enhanced obligations. Limited Guidance on Parental Consent Verification • No standard process defined for verifying age or identity of guardians/parents. • Over-reliance on external systems like Digi Locker may introduce accessibility issues.
Incomplete Coverage of Offline Notices • The rules focus heavily on digital notices; no detailed guidance for consent notices delivered in offline or paper format.
SUGGESTIONS FOR STRENGTHENING THE FRAMEWORK
Define Key Terms and Conditions • Incorporate explicit definitions for ambiguous terms to prevent interpretative loopholes. • Clearly classify SDFs using quantifiable criteria such as revenue, user base, or
sensitivity of data processed. Standardize Grievance Redress Mechanisms • Mandate response timelines (e. g. , 15 working days) for Data Fiduciaries and Consent Managers to resolve grievances. Expand and Standardize Consent Verification Techniques • Develop a national framework for parental/guardian verification, possibly integrating biometric or digital ID checks. Provide Support for MSMEs • Introduce a tiered compliance model where small businesses can adopt simplified obligations while ensuring accountability. Strengthen Oversight and Audit Provisions • Require all categories of data fiduciaries (not just SDFs) to submit periodic compliance reports to the Data Protection Board. Incorporate Guidelines for Offline and Hybrid Consent Mechanisms • Specify components required in non-digital consent notices and ensure inclusion of optout methods and complaint mechanisms.
The DPDP Rules, 2025 signify a critical advancement in India’s digital governance landscape. While the regulatory intent is commendable, successful implementation will depend on addressing existing loopholes and ensuring clarity and scalability across industries. A flexible yet enforceable framework can help balance innovation with privacy protection, ultimately enhancing public trust in the digital ecosystem.
CONCLUSION
Dealing with the changing digital privacy landscape in Indian government departments requires a well-rounded and thoughtful approach. As India moves forward with its digital growth, it’s important to balance technological progress with the need to protect personal data. Government bodies must not only follow updated privacy laws but also encourage the ethical and responsible use of data. This balancing act between innovation and data security is ongoing and needs continuous cooperation among government agencies, regulators, and the general public. India has a unique opportunity to lead the way in using technology responsibly while still respecting citizens’ right to privacy. By following clear rules and staying updated on legal requirements, we can all help build a secure and trustworthy digital space—especially when it comes to protecting personal data.
Good data protection helps keep the internet safe and reliable. If people stay alert, learn about online risks, and follow smart cybersecurity habits, they can reduce the chances of data theft or privacy breaches and enjoy a safer digital life. In this context, India’s Digital Personal Data Protection (DPDP) Act of 2023 is a positive step. The law is designed to be adaptable, allowing for updates over time as society and technology evolve. It aims to protect the digital rights of users and sets higher standards for organizations, especially those playing a major role in digital services. However, questions still remain about whether the main focus of the Act is to truly enforce privacy laws or to protect national security and boost the digital economy while managing the data of over a billion internet users.
The proposed law needs to be in line withConsidering worldwide patterns and India's inclusiv e technology strategy to guarantee fair access for everyonediversified populace as it moves cl oser to 2047's Viksit Bharat, the country'shope to see a progressive, selfsufficient India by 2047.