India Advances Digital Privacy: DPDP Act, 2023 and Draft Rules, 2025
Why in News?
- The Indian government has introduced the Digital Personal Data Protection Act (DPDP), 2023, accompanied by the Draft DPDP Rules, 2025, aiming to establish a robust framework for personal data protection in the digital realm.
Important Key Points:
-
Consent Mechanism:
-
Data Fiduciaries are required to obtain clear, specific, and informed consent from individuals (Data Principals) before processing their personal data.
-
Consent must be as easily withdrawable as it is given.
-
-
Parental Consent for Minors:
-
For processing data of children, verifiable parental or guardian consent is mandatory.
-
Challenges persist in implementing effective age verification and consent mechanisms.
-
-
Data Localization and Transfer:
-
Certain personal data may be transferred outside India, subject to government approval.
-
Concerns have been raised about potential data localization requirements conflicting with the Act’s provisions.
-
-
Data Protection Board of India (DPBI):
-
An independent body established to oversee compliance, handle grievances, and enforce penalties for data breaches.
-
-
Penalties for Non-Compliance:
-
Organizations failing to adhere to the Act and Rules may face significant fines and sanctions.
-
