MeitY releases draft rules of DPDP Act for public consultation

The DPDP Act provides safeguards against processing of personal data

The Ministry of Electronics and Information Technology on January 3 released the draft rules for the Digital Personal Data Protection Act.

The rules have been much awaited since the Act was passed in Parliament in August 2023. The government is seeking feedback on the draft rules through the MyGov portal till February 18, 2025.

The rules are expected to provide clarity on various provisions of the law including notice by data fiduciary to individuals, registration and obligations of consent manager, processing of personal data of children and so on.

The rules are also expected to provide clarity regarding the setting up of the Data Protection Board, appointment and service conditions of the chairperson and other members of the board.

MeitY has said that the submissions made during the consultation will not be disclosed, and that only a summary of the feedback received will be published after the finalisation of the rules.

What the rules say in glance

Processing of children's data: The draft rules say that data fiduciaries must deploy measures to verify consent of a parent before processing of children's data, through government issued IDs or digital tokens linked to identity services like Digital lockers.

The government will also extend exemptions from these specific provisions pertaining to processing of children's data to educational institutions, and child welfare organisations, the draft rules proposed.

Consent manager framework: The draft rules say that consent managers must register with Data Protection Board and must have minimum net worth of Rs 12 crore.

Setting up of Data Protection Board: The rules also proposed as the establishment of Data Protection Board as a regulatory body. It will operate as a digital office, with remote hearings and will have powers to investigate breaches, enforce penalties and so on, the draft rules said.