Lok Sabha Question No. 3072 (UNSTARRED), answered on 2025-03-19
Subject: DPDP Rules, 2025
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Shri Amrinder Singh Raja Warring

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION. NO. 3072

TO BE ANSWERED ON: 19.03.2025

## DPDP RULES, 2025

## 3072. SHRI AMRINDER SINGH RAJA WARRING:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a)  the  specific  measures  included  in  the  Digital  Personal  Data  Protection  (DPDP)  Rules, 2025 to safeguard citizens' data privacy and rights;
- (b) the specific mechanisms established to ensure compliance by data fiduciaries;
- (c) the details of the stakeholder consultations held including feedback from data protection experts, technology firms and civil society and the manner in which these inputs have shaped the draft rules; and
- (d)  the  timeline  for  finalising  and  rolling  out  these  rules,  along  with  the  Government's strategy to monitor and evaluate their effectiveness once implemented?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI JITIN PRASADA)

(a) to (d):The Digital Personal Data Protection Act, 2023 (Act) provides for the processing of digital personal data in a manner that recognises both the rights of the individual to protect their personal data and the need to process such personal data for lawful purposes. The Act obligates organizations, including State agencies, involved in digital personal data processing, to implement robust technical and organisational measures. The accountability of the  Data  Fiduciaries  is  monitored  through  the  adjudication  of  personal  data  breaches  and breaches of the provisions of the Act and imposition of penalties for such breaches. The draft Digital  Personal  Data  Protection  Rules,  2025  (Rules)  seek  to  operationalize  the  Act.  The Rules aim to safeguard citizens data privacy and rights by having obligations like providing notice  by  Data  Fiduciary  to  Data  Principal,  application  of  reasonable  security  safeguards, intimation  of  personal  data  breach  and  providing  mechanism  for  exercising  rights  of  Data Principals. The Rules have been drafted with the objective to be principle-based rather than prescriptive and to carry out the purposes of the DPDP Act. These Rules provide procedural clarity for grievance redressal mechanisms and reporting for data breaches.

The  Ministry  of  Electronics  and  Information  Technology  has  done  number  of  public consultations  on  Draft  DPDP  Rules,  2025  across  the  country.  The  consultations  attracted experts, technology firms and civil society and representatives from various sectors such as technology, consulting, MSMEs, banking, and finance. The Ministry has invited feedback/comments  from  the  public  and  stakeholders  in  line  with  the  Government's commitment to adopt an inclusive approach to law-making. Such contributions play a vital role in refining the Rules, ensuring they meet the evolving needs of India's digital economy while  safeguarding  the  rights  of  data  principals.  These  consultation  sessions  reaffirm  the government's commitment for the effective implementation of the DPDP Act and ensuring a practical, innovation-friendly regulatory environment.

*******