The Digital Personal Data Protection Act, 2023, enacted over two years ago, cannot come into effect until the DPDP Rules are notified.
The draft Digital Personal Data Protection (DPDP) Rules, 2025, which aim to operationalise the act, were published for public consultation and have received 6,915 inputs and comments from stakeholders, citizens and firms, the Ministry of Electronics and Information Technology (MeitY) has informed.
The Ministry was responding to a query by Bharat Rashtra Samithi (BRS) MP Vaddiraju Ravichandra in Parliament on Friday (July 25).
The DPDP Act provides a comprehensive framework for the protection of digital personal data of individuals while making data fiduciaries accountable for personal data breaches. Data fiduciaries are required to implement appropriate technical and organisational measures to prevent personal data breaches by taking reasonable security safeguards, Jitin Prasada, Minister of Electronics and IT, said in the response.
The amount of comments received reflects the back-to-back consultation sessions the government has held since the draft was published in January this year, with a lengthy written comment period, as well as sessions with state governments, private industry and other groups of invited stakeholders.
The comments are being held in confidence, the Ministry said, indicating it would not release them publicly in order to allow stakeholders to offer candid submissions.
The Digital Personal Data Protection Act, 2023, enacted over two years ago, cannot come into effect until the DPDP Rules are notified. The government has long exceeded the weeks-long timeline that was indicated for the notification. The draft is not likely to be modified significantly, a top official had said earlier this year.
The DPDP Rules (and the Act) provide for penalties against firms that fail to take effective measures to safeguard personal information. They also put in place systems like consent managers, whereby individuals can keep watch on which firms have their data, and provide or withdraw consent for some of them.
The Act draws out exclusions from penalties and key provisions for government agencies, giving more power to the Centre.
More Like This
Published on July 27, 2025
