Certain matters raised by the industry could not be addressed in the subordinate legislation: Nasscom on DPDP Rules

Representative image

The National Association of Software and Service Companies (Nasscom) said while the Digital Personal Data Protection Rules 2025 marks a significant milestone in strengthening India’s personal data protection architecture, there were some industry concerns during consultation that could not be addressed through subordinate legislation.

Some of these concerns include “overarching structure of parental consent, the statutory age threshold for children and the requirement that all personal data breaches be notified.”

“Our focus now moves to supporting implementation in a manner that is practical, proportionate and aligned with the objectives of the law,” the technology industry body said following the government’s notification of the DPDP Rules on November 14.

Nasscom commended the Ministry of Electronics and Information Technology for adopting a constructive, consultative approach throughout the drafting process. According to the industry body, the rules largely preserve the structure and policy choices of the draft framework, while “introducing a transparent and predictable phased commencement schedule.”

Some of the key enhancements highlighted by the tech industry body include greater clarity on verifiable consent, alongside well-structured, distinct provisions for children and persons with disabilities. The sections addressing data processing by the State too had remained broadly in lin with the draft previously released for consultation.

Nasscom said in a statement, “On international data transfers, Nasscom-DSCI recognises the importance of developing mechanisms that support interoperability and facilitate co-operation with India’s key trading partners.”

“A stable and predictable transfer environment is central to operationalising personal data protection and to the continued growth of India’s digital economy, particularly for IT-ITES, global capability centres, platform businesses and our expanding ecosystem of start-ups and technology SMEs,” it added.