DPDP rules encourage innovation, reduce compliance burden for startups, companies: IT secretary S Krishnan

Ministry of Electronics and Information Technology secretary S Krishnan

As the country's leading bureaucrat in charge of shaping India's technology policy, IT ministry secretary S Krishnan has been at the forefront of drafting the Digital Personal Data Protection (DPDP) Act rules.

The rules, released for consultation on January 3, bring forth a slew of provisions with huge ramifications for the industry and the government alike in handling a user's data, its transfer outside the country, processing of children's data and so on.

The ministry and Krishnan, who took charge as the secretary a month after the Act was passed by Parliament in 2023, worked with various stakeholders to draft the rules.

In an interview with Moneycontrol, Krishnan said companies would be given "full autonomy" to comply with the verification requirement when processing children's data. The rules will encourage innovation by minimising regulatory burden and the government is in the process of setting up the Data Protection Board, he said. Edited excerpts of the interview:

Also read: DPDP rules: Big Tech must verify algorithms and keep specific personal data within India

The rules have been released nearly two years after Parliament passed the data protection act. What was the kind of work that went into the drafting the rules?

The Draft Digital Personal Data Protection Rules, 2025, have been prepared following extensive consultations with industry, think tanks, various other stakeholders and government ministries. This inclusive approach ensures the draft rules address the diverse needs of the ecosystem while safeguarding individual rights.

⁠How do the rules balance the need for data privacy while enabling India’s growing digital economy, particularly for startups and global businesses looking to expand their operations in the country?

The draft rules align with the principles of the Digital Personal Data Protection Act, 2023. They are simple and non-prescriptive to provide an adaptable and flexible framework for implementation.

By granting companies, including startups, the freedom to innovate responsibly, the draft rules encourage innovation while minimising regulatory burden. This approach promotes both ease of living for citizens and ease of doing business for companies.

Also read: E-commerce, gaming, social media platforms to delete personal user data after 3 years: Draft DPDP rules

⁠What kind of transition period does the government envision for businesses to comply with the rules?

⁠Recognising the need for a smooth transition, the government will provide companies with an adequate timeframe to adapt and comply with the provisions of the DPDP Act.

⁠How does the government plan to monitor compliance when it comes to verifying children’s age and other details?

The draft rules are designed to empower companies to innovate freely while offering clarity on key aspects of the Act. Entities are granted functional autonomy to determine how they fulfil their obligations, fostering lawful and responsible data processing.

Also read: Transfer of certain personal data outside the country can be restricted: FAQ on draft DPDP Rules

⁠When can we expect the Data Protection Board to be operational?

⁠The government is in the process of setting up a fully digital Data Protection Board. This “born-digital” platform will include an app that enables citizens to lodge complaints and have them adjudicated without requiring physical presence.