Photo used for representation purpose only.
The draft Digital Personal Data Protection Rules, 2025, have received 6,915 inputs and comments from the public, firms, and other stakeholders, the Ministry of Electronics and Information Technology told Parliament on Friday (July 25, 2025). The Ministry was responding to a query by Bharat Rashtra Samithi (BRS) MP Vaddiraju Ravichandra.
The volume of comments reflects the back-to-back consultation sessions the government has held since the draft was published in January, with a lengthy written comment period, as well as sessions with State governments, private industry, and other groups of invited stakeholders. The comments are being held in confidence, the Ministry said, indicating it would not release them publicly in order to allow stakeholders to offer candid submissions.
Long delay
The Digital Personal Data Protection Act, 2023, enacted over two years ago, cannot come into effect until the DPDP Rules are notified. Almost seven months on, the government has long exceeded the weeks-long timeline that was indicated for the notification. The draft is not likely to be modified significantly, a key official had said in February.
However, as India and the U.S. negotiate a bilateral trade agreement, with a major focus on the ease of doing business in India for technology firms, the government has held off on publishing the final Rules. In an informal interaction with reporters this month, a senior IT Ministry official declined to provide any reasons for the delay, or to provide an estimate of when the Rules can be expected to be enforced.
Consent managers
The DPDP Rules (and the parent Act) provide for penalties against firms that fail to take effective measures to safeguard personal information. They also put in place systems like consent managers, whereby individuals can keep watch on which firms have their data, and provide or withdraw consent for some of them. The Act draws out exclusions from penalties and key provisions for government agencies.
The law’s implementation has been awaited among privacy advocates, who hope that frequent data breaches will finally be met with accountability. The law has also drawn criticism from journalism bodies and transparency activists as it contains no provisions for protecting journalistic work, and amends the Right to Information Act, 2005 to prevent the disclosure of any personal information that is not already published proactively under the law.
Published – July 25, 2025 11:39 pm IST