DPDP Act: MeitY releases draft data protection rules for public consultation

The Ministry of Electronics and Information Technology (MeitY) released draft regulations to implement the government's landmark digital privacy law, setting the stage for sweeping changes in how companies and government agencies handle personal data.

Read more: Data protection rules under translation; expected to be out in January'25

The Ministry of Electronics and Information Technology released the proposed rules, which flesh out key provisions of the Digital Personal Data Protection Act passed by Parliament last August. The draft opens a public consultation period through February 18, during which stakeholders can submit feedback through the government's MyGov portal.

The regulations aim to address crucial aspects of data protection. These include how organizations must notify individuals about data collection, the framework for consent management, and safeguards for processing children's personal information.

As per the draft rules, companies will need government permission to transfer personal data outside India and children below 18 years will require parental consent for creating accounts on social media.

Of particular significance are provisions detailing the establishment of first Data Protection Board, including the selection process and terms of service for its chairperson and members. This regulatory body will serve as the primary enforcer of the country's new data protection regime.

The move represents India's latest step toward joining a growing number of nations with comprehensive privacy frameworks, as governments worldwide grapple with protecting citizen data in an increasingly digital economy.