Unveiling the Digital Personal Data Protection Rules 2025

The government has announced the Digital Personal Data Protection Rules 2025, designed to protect citizens' data rights. Set to be rolled out over 18 months, the rules empower citizens to monitor data misuse, facilitate consent management, and enforce penalties for data breaches. Some aspects become effective immediately, while others take longer.

On Friday, the government unveiled the highly anticipated Digital Personal Data Protection Rules 2025, aiming to enhance the control citizens have over their data. These rules, expected to fully launch over 12-18 months, promise greater privacy in the online realm.

Significantly, the rules empower citizens to revoke their consent via designated managers, while also introducing measures against spam calls and unauthorized data access. The framework for a digital Data Protection Board has been established, permitting virtual proceedings and the imposition of graded penalties for breaches, thereby safeguarding small businesses.

The legislation follows a Supreme Court decision from 2017 affirming privacy as a fundamental right. Although the rules advocate data protection, citizens must disclose accurate, verifiable information for government IDs. Notably, the DPDP Rules offer law enforcement exceptions and specific exemptions for start-ups engaged in governmental, research, or innovative efforts.

(With inputs from agencies.)