Stakeholders raise red flags over DPDP rules 2025, cite threats to privacy, press freedom

The Internet Freedom Foundation (IFF) and the Editors Guild of India, have expressed serious concerns over the Union Government’s notification of the Digital Personal Data Protection Rules, 2025, issued on 13 November alongside staggered commencement of the DPDP Act, 2023 and formal establishment of the Data Protection Board of India.

IFF said the Rules continue the trajectory of the DPDP Act by failing to address structural concerns raised since the 2022 and 2023 iterations of the law. According to the organisation, the rule making process lacked transparency and meaningful consultation, despite detailed submissions from civil society. Core data protection obligations and rights under sections 3 to 17 of the Act will only become effective eighteen months from notification, leaving individuals without meaningful remedies for an extended period. While the institutional machinery and Board related provisions come into force immediately, key operative rules for notices, rights, cross border transfers and safeguards will only apply after eighteen months.

IFF noted that while Rules 3 and 14 mandate plain language notices and set grievance redressal timelines, the Rules do not require disclosure of recipient categories, retention periods, or transfer safeguards, perpetuating information asymmetry and undermining meaningful consent. The organisation flagged that Rule 8(3) and related provisions invert the data minimisation principle by requiring retention of personal data and extensive processing logs for one to three years, potentially normalising long term behavioural logging by both state and private actors. It also warned that Rule 5 and references to techno legal measures risk expanding centralised identifiers within digital public infrastructure without sufficient necessity, proportionality or independent oversight.

A key point of concern for IFF is Rule 23, which grants the State wide power to demand personal data from any data fiduciary without consent on vague grounds such as national security or performance of any function under law. IFF said the absence of clear safeguards, challenge mechanisms or post facto oversight invites misuse and secrecy, further compounded by gag obligations that prevent disclosure of such government demands to users. The organisation said this deepens executive control, fails to meet constitutional standards laid down in the Puttaswamy judgment and entrenches unchecked state access to personal data.

IFF reiterated its demand for amendments to restore transparency protections, introduce journalistic and public interest exemptions, ensure an independent Data Protection Board with regulatory autonomy, and narrow state exemptions tied to strict necessity and proportionality.

The Editors Guild of India echoed parallel concerns on the implications of the Act and the newly notified Rules for the media. The Guild said that despite assurances given by MeitY in July 2023 that journalistic work would not fall under the purview of the DPDP Act, the final Rules fail to provide any explicit protection or clarification for journalism. It noted that a detailed list of thirty five case based questions had been submitted to MeitY seeking clarity on consent, exemptions, data retention and reporting in public interest, but no official response has been issued.

The Guild warned that ambiguous consent requirements risk subjecting journalists and newsrooms to compliance burdens that could impede routine reportage. Without explicit exemptions, journalistic activities could be interpreted as data processing requiring consent, chilling newsgathering and weakening accountability journalism. The Editors Guild urged MeitY to urgently issue a clear and categorical clarification exempting bona fide journalistic activity from consent and processing obligations under the Act.

Both IFF and the Editors Guild stressed that while data protection and privacy are vital, they must be balanced with individual rights, press freedom and constitutional safeguards. Both organisations said they remain committed to working with policymakers to strengthen the data protection framework in line with India’s constitutional and international obligations.