India's New Digital Personal Data Protection (DPDP) Rules to Be Published Soon, Says IT Minister

New Delhi: Union IT Minister Ashwini Vaishnaw announced that the draft of the Digital Personal Data Protection (DPDP) Rules will be released for public consultation within the next 30 days. These rules are crucial for the enforcement of the Digital Personal Data Protection Act, 2023, which received Presidential assent in August. The draft will detail the operational procedures for the Data Protection Board, a pivotal institution under the DPDP Act, tasked with addressing personal data breaches in a fully digital format.

Vaishnaw emphasized that the government has completed the digital infrastructure required for the Board’s operations, including case management, appeals, and decision-making processes. The consultation period for the draft will be extended to at least 60 days, surpassing the standard 45-day minimum, to ensure thorough public input.

A core element of the DPDP Act is the creation of a “digital office” for both the Data Protection Board and an appellate tribunal. The appellate tribunal will serve as a venue for individuals to challenge decisions made by the Board. The Ministry of Electronics and Information Technology (MeitY), in collaboration with the National Information Centre and the Digital India Corporation, is currently developing the digital platform for the Board. This platform is undergoing rigorous testing and will be launched following the finalization of the rules.

In July, the government allocated ₹2 crore to MeitY for the establishment and operational costs of the Data Protection Board for the fiscal year 2025. This funding is expected to increase as the DPDP Act is fully implemented.

Vaishnaw also addressed the challenges related to processing children’s data, a key issue in the DPDP Rules. He confirmed that the government has resolved these concerns, with details to be revealed in the upcoming draft. Notably, the government does not intend to mandate a specific method for verifying parental consent for minors, acknowledging the technical difficulties associated with such verification. The forthcoming draft rules are expected to provide comprehensive guidance on this and other critical aspects of data protection under the DPDP Act.