Published Date : 7/29/2025Â
The Indian government has announced that it received 6,915 comments from members of the public and stakeholders as it works to finalize the country’s Digital Personal Data Protection Rules 2025. These rules, once approved, will make the Digital Personal Data Protection Act (DPDPA) operational. India put this legislation in place through presidential assent in 2023, but it has not been fully operationalized. A webinar in 2021 had proposed how the legislation should be operationalized.
In total, the government says it received the inputs after the proposed rules were published for consultation early this year. Efforts to put in place rules that will activate the country’s data protection legislation, according to the government, are aimed at “ensuring a safe, trusted, and accountable cyberspace for all users.”
The government also outlines activities and actions it has carried out in line with its IT strategy. These include trainings on digital security, with 3,637 workshops, public awareness campaigns, and the dissemination of relevant educational resources. Other measures, as explained by the government, include the putting in place of various structures and institutional coordination personnel to effectively handle issues related to national cybersecurity.
The government states that the data protection Act is a “comprehensive data privacy law to regulate the processing of digital personal data,” and it “balances the rights of individuals to protect their personal data with the need for lawful data processing.” As explained in January, the government said the draft data protection rules, which were drafted following an inclusive and consultative process, “are designed to empower citizens in a rapidly growing digital economy” and they “seek to protect citizens’ rights in accordance with the DPDP Act, while achieving the right balance between regulation and innovation, so that the benefits of India’s growing innovation ecosystem are available to all citizens and India’s digital economy.”
The rules’ key provisions address issues around informed consent, user rights, and parental controls. The government has promised to carry out a series of awareness campaigns to educate citizens on their rights and responsibilities under the new legal framework. Some experts have found flaws in the Act on issues related to parental control and age verification.
Despite these challenges, the government remains committed to ensuring the Digital Personal Data Protection Act is robust and effective. The feedback received will play a crucial role in refining the rules to better protect the digital rights of Indian citizens.Â
Q: What is the Digital Personal Data Protection Act (DPDPA)?
A: The Digital Personal Data Protection Act (DPDPA) is a comprehensive data privacy law in India designed to regulate the processing of digital personal data, balancing the rights of individuals to protect their personal data with the need for lawful data processing.
Q: When was the DPDPA enacted?
A: The DPDPA was enacted through presidential assent in 2023, but it has not been fully operationalized yet.
Q: How many comments did the Indian government receive for the draft rules?
A: The Indian government received 6,915 comments from the public and stakeholders for the draft Digital Personal Data Protection Rules 2025.
Q: What are some key provisions of the draft rules?
A: The key provisions of the draft rules address issues around informed consent, user rights, and parental controls.
Q: What steps is the government taking to ensure awareness of the new legal framework?
A: The government has promised to carry out a series of awareness campaigns to educate citizens on their rights and responsibilities under the new legal framework.Â