Abstract

The Draft Digital Personal Data Protection Rules,2025 and The Digital Personal Data Protection Act, 2023, marks a significant advancement in India's data privacy landscape, emphasizing transparency and accountability in personal data management. They introduce comprehensive measures designed to safeguard individual data while ensuring clear communication from organizations about their data practices. The draft rules were introduced to provide more subsistence to the Act. Under the Act, entities collecting personal data must provide detailed disclosures regarding the data’s collection, usage, and storage. This requirement enhances transparency by allowing individuals to make informed decisions and exercise greater control over their personal information. Accountability is reinforced through several key provisions of the Act. Organizations are mandated to implement stringent data protection protocols, including the designation of Data Protection Officers and adherence to prescribed data security standards. The Act also establishes the Data Protection Board of India, which is empowered to address grievances and enforce compliance, thereby holding organizations accountable for breaches and non-compliance. The imposition of substantial penalties for violations further underscores the Act’s commitment to enforcing data protection norms. The Act’s implementation is expected to lead to a more transparent environment, where individuals are better informed about their data and organizations are more accountable for their data practices. However, it may also present challenges, particularly for smaller businesses that could face increased compliance costs and operational adjustments. Overall, the Digital Personal Data Protection Act, 2023, aims to align India’s data protection framework with global standards, fostering a more trustworthy and accountable digital ecosystem while balancing the interests of both consumers and businesses.

Keywords