India’s data protection laws need tweaking.

India’s Draft Digital Personal Data Protection Rules

• The Ministry of Electronics and Information Technology (MeitY) released the Draft Digital Personal Data Protection (DPDP) Rules on January 3, 2025, marking a significant step in India’s digital data regulation.

• The draft rules are a departure from the controversial Personal Data Protection Bill, which was deemed overly restrictive and hostile to industry interests.

• The positive response to the DPDP Act and its rules is attributed to the less prescriptive, principles-based approach of the draft rules.

• India’s approach offers a refreshing alternative to Europe’s interventionist policies, avoiding the burdens of prescriptive regulation.

• The rules focus on outcomes rather than processes, empowering users without drowning businesses and consumers in unnecessary complexities.

• The rules allow exemptions for specific industries, such as educational institutions, clinical and mental health establishments, allied health-care providers, and child-care centres, demonstrating a nuanced understanding of industry-specific needs.

• The draft rules introduce unnecessary complexity and ambiguity, with provisions for restricting crossborder data flows introducing unnecessary complexity.

• The draft rules do not address scenarios where businesses face incessant information requests or provide scope for businesses to charge a reasonable fee for requests which are excessive or unfounded.

• The need for procedural integrity is highlighted in areas such as verifying whether users requesting information about data processing are legitimate and whether the government can demand access to sensitive business data.

• Compliance with data protection laws should not be seen as a regulatory obligation, but as critical to protecting business reputation and ensuring continuity.

• With the convergence of the Internet of Things, 5G, and artificial intelligence enabling unprecedented data collection, India must envision privacy frameworks that do not exclusively rely on the fallible principle of consent.