DPDP Rules Notified: Implementation in Phases

New Delhi, Nov 14 (PTI) The government has released the long-awaited Digital Personal Data Protection Rules 2025 on Friday, which will be implemented in phases spread over 12-18 months.

The rules aim to give citizens control over their data, allow them to check for misuse, and protect their privacy in the online space.

Some parts of the rules will be implemented immediately, while provisions like registration and obligations of consent managers, notice from data fiduciaries to individuals for processing their data and some other major norms related to processing of personal data etc, will be implemented over a period of 12-18 months.

The rules are expected to help citizens avoid spam calls and unauthorised access to their personal data, video, and voice via any digital means.

"Now, therefore, in exercise of powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), the Central Government hereby makes the following rules, ... These rules may be called the Digital Personal Data Protection Rules, 2025," the notification said.

The rules set out a mechanism for establishing a Data Protection Board, which will levy penalties based on the nature of the breach as listed in the DPDP Act 2023.

The DPDP Act 2023 has provisions to impose penalties of up to Rs 250 per breach on data fiduciaries. However, it has kept a graded penalty system to protect small businesses.

The rules came into force eight years after the Supreme Court, on August 24, 2017, held that the Right to Privacy is a Fundamental Right with restrictions specified and relatable to fundamental rights as embedded in the Constitution.

While the rules published under the Digital Personal Data Protection Act 2023 grant the right to citizens to protect their data, it also expects them not to suppress any information about themselves for any government-issued IDs or documents, refrain from filing false or frivolous complaints, and provide only verifiable information when requesting data correction or deletion.

With the DPDP Rules in place, citizens can take recourse if their phone numbers are leaked for unauthorised calls. The rules will help investigate and identify the entity that leaked the phone number of an individual without consent, and penal actions can be taken against those found guilty.

The provisions of DPDP Rules exempts rights of citizen in case of enforcing legal rights, court orders, prevention, detection, investigation or prosecution of any offence, an individual is overseas and signed any contract or given consent to a foreign entity, ascertaining the financial information and assets and liabilities of any person who has defaulted in payment due on account of a loan and in cases where the centre decides to exempt certain data fiduciaries including start-ups mainly for implementing government schemes, research and innovation purposes.