Centre to roll out Digital Data Protection Rules by mid-2025: Ashwini Vaishnaw

Vaishnaw noted that the consultation process for the rules has been extensive, and feedback has generally been positive.

The Centre intends to notify and begin implementing the Digital Personal Data Protection Rules (DPDP Rules), 2025, by mid-2025, Minister of Electronics and Information Technology Ashwini Vaishnaw has stated. The rules, which are currently in draft form, aim to operationalise the Digital Personal Data Protection (DPDP) Act, 2023.

Vaishnaw, in an interview with The Hindu, noted that the consultation process for the rules has been extensive, and feedback has generally been positive. "The consultations so far have been very extensive, and people are by and large okay with the provisions," he has been cited by the newspaper, further adding, "I don’t see too many amendments coming in the final notification — some tweaks here and there might happen, but not more than that."

While large firms are ready to comply with most of the rules, a transition period of up to two years will be allowed for certain data fiduciaries, said Vaishnaw. This period will provide businesses more time to adjust to the full implementation of the DPDP Act, as per the Union Minister. The government is currently accepting stakeholder feedback on the draft rules until February 18.

"The law has been drafted in a way to ensure the functioning and autonomy of the Personal Data Protection Board of India," Vaishnaw explained, further noting that the DPDP Act rollout would be entirely digital, highlighting the approach used for other initiatives like the Grievance Appellate Committee under the IT Rules, 2021.

Furthermore, regarding the two-year transition period, Vaishnaw clarified, "There will be different transition periods for different types of data fiduciaries. Different parts of the industry are at different levels of preparedness. Most of the large organisations are already prepared, but some people want some time for getting the consent manager framework in place. Some people want to understand the age verification process in greater detail, so those are the items on which people are seeking some more time." He added that the government would take a "nuanced approach" once it receives final recommendations from the industry, with 24 months being the outer limit for compliance.

In addition, throwing light on the broader overhaul of the country's digital framework, the Union Minister confirmed that work is underway to replace the Information Technology Act with the Digital India Act (DIA). He said the Centre has already implemented key reforms, such as the Telecommunication Act, 2023, and the DPDP Act, 2023, which have a broad impact across sectors. "There will be certain verticals which are specific to sectors, and we are working on this whole comprehensive framework," he concluded.