DPDP Rules: What are the DPDP Rules 2025? How will they protect the personal data of Indian users? Learn everything here...
The Ministry of Electronics and Information Technology has officially implemented the Digital Personal Data Protection (DPDP) Rules 2025. With this, the DPDP 2023 Act has now fully come into effect. These new rules will provide users with complete information about the personal data being collected and processed by companies. Furthermore, these rules will also provide users with information about how companies will use their data. The DPDP Act was passed in Parliament on August 11, 2023. It outlines how to ensure the safe and proper use of digital data in India. The government will roll out the new DPDP 2025 rules in a phased manner. A framework has been developed for this purpose. These rules aim to give citizens greater control over their data and protect their privacy in the digital space. Let's learn more about these rules.
What is the role of a data principal and data fiduciary?
The DPDP Rules 2025 define the roles of the data principal and data fiduciary. A data principal is the person whose data is collected. A data fiduciary is any company, organization, or individual that collects and processes personal data and decides the means for its use.
The new rules will give users more control over their data.
The DPDP Rules 2025 outline how governments and private entities should collect, process, protect, and handle personal data. Under the new rules, social media platforms, online platforms, and all companies that store users' personal data will be required to disclose what data they are storing and how they will use it. The new rules will give Indian users greater control over their data and protect their privacy.
Measures to be taken for data breaches.
According to the rules, companies that collect and process data must implement appropriate security measures to prevent data breaches. This includes encryption, masking, obfuscation, or tokenization of personal data.
Users must be immediately alerted.
In the event of a breach, data fiduciaries must immediately inform affected users about what happened, the potential risks, the steps taken, and who to contact. They must also notify the Data Protection Board within 72 hours.
Parental Permission Required for Children's Data
Parental consent is required to process data from children under 18 years of age. According to the new DPDP 2025 regulations, data fiduciaries must ensure parental permission before collecting or processing any child's data.
Parental Verification Required
The institution must verify that the person giving consent is indeed the parent or guardian. This will require the use of a verified virtual token. The new rule prohibits companies from processing a child's data without verifying the parents' identity and age.
Not all provisions will be implemented immediately.
It should be noted that while the government has issued the DPDP 2025 rules, not all provisions will be effective immediately. According to the official notification, subsections (2) of Section 1, Section 2, sections 18 to 26, sections 35, 38, 39, 40, 41, 42, 43, and subsections (1) and (3) of Section 44 of the Act have come into effect immediately. However, subsection (9) of Section 6 and clause (d) of subsection (1) of Section 27 will come into effect after one year. Sections 3 to 5, subsections (1) to (8) and (10) of Section 6, Sections 7 to 10, Sections 11 to 17, Section 27 (except clause (d) of subsection (1) of Section 27), Sections 28 to 34, 36, 37, and subsection (2) of Section 44 will come into effect after 18 months.
DPDP Rule 2025 (1)
This new rule gives Indian citizens greater control over their digital footprint. You will now be fully informed about how companies will use your data. Special attention has been given to the safety of children. Parental consent will be required for the data of children under 18 years of age.
Disclaimer: This content has been sourced and edited from NDTV India. While we have made modifications for clarity and presentation, the original content belongs to its respective authors and website. We do not claim ownership of the content.
