Draft Digital Personal Data Protection Rules, 2025

The Ministry of Electronics and Information Technology on January 3rd, 2025, released the “Draft Digital Personal Data Protection Rules,2025” for public consultation. The main purpose behind this is to execute the Digital Personal Data Protection Act, 2023[1]. The basic framework of the Draft Rules consists of rights of Data Principals such as right to access, right to correction, right to erasure, right to grievance redressal etc. It also includes the obligations of the Data Fiduciaries, provisions for children’s data, cross border data transfer etc. The Ministry has notified the public and any feedback/comments on the draft rules may be submitted by 18th February of 2025.

Digital Personal Data Protection Act,2023

India saw an unimaginable boom in the digital world in the last decade with the rapid use and growth of online platforms, social media, e-commerce and recently with online payment options. Along with the ease of usage and numerous variables available online to make life easier, the concerns attached to it also grew. People started facing data breach, security issues, privacy infringement etc. The fact that there was no specific law in place to regulate the use of data in the digital space was the biggest concern. Once the Supreme Court of India recognized privacy as a fundamental right, the growing need for a legal framework to safeguard digital data also grew.

Finally, in 2023, the Digital Personal Data Protection Act[2] or the DPDP Act was enacted in India to safeguard an individual’s personal data and also to regulate its processing. Its primary goal was not just to safeguard the personal data of a person but also to keep an eye on and guarantee that it is handled properly and legitimately. The Act seeks to achieve a balance between safeguarding personal data while making it easier for businesses, particularly startups and small enterprises, to adhere to it. The enactment of this Act was India’s first step towards data protection. It provides a legal framework for data protection and regulation and aligns with global standards for data protection such as European Union’s GDPR.

Few important definitions given in the Act are as follows:

  • Data– a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means.
  • Data Principal- an individual to whom the personal data relates and where such individual is—
  • a child, includes the parents or lawful guardian of such a child;
  • a person with disability, includes her lawful guardian, acting on her behalf.
  • Data Fiduciary– any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
  • Personal data breach– any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.
  • Processing– a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.

Some of the key features of the DPDP Act are as follows:

  • Consent- This is one of the key points of the Act as a data can be regulated or processed only after obtaining consent from the individual to whom the data belongs to. The individual also has the right to retract the consent at any point in time.
  • Right to information- An individual has the right to know how their data is being processed.
  • Transparency- The data fiduciary is responsible to ensure that proper information is given to the person from whom the data is collected. They must also provide information regarding about the purpose of data and collection and method of processing the collected data.
  • Data minimisation- Only data that is required ought to be collected and processed.
  • Correction and erasure[3]– Data principals can also request for update, correct, erase or remove their data.

Crossover with Intellectual Property Rights

The rapid expansion of digital age significantly increased the role of Intellectual Property in the society. Intellectual Property plays a crucial role in the creation of digital contents, software, new inventions etc. The DPDP Act comes into play when such creations involve the use of personal data. Few instances where one must with comply with the DPDP Act while creating an IP are as follows:

  • If any personal data is included in creating any intellectual work such creation of an algorithm software for example, it must comply with the DPDP Act’s provisions.
  • If any licensing of personal data is required for research, innovation or business purposes, DPDP Act’s privacy safeguards must be followed.
  • If any personal data is captured in a copyrighted work, the creation shall be protected by copyright law while the DPDP Act protects the data embedded in it such as a person’s name, address, biometric details etc.
  • Trade secrets is one main playing field for both IP and DPDP Act. While trade secrets in general are protected under IP laws, any sensitive personal data such as confidential algorithms, databases, lists containing name and other information of people etc within a trade secret is lawfully protected under the DPDP Act.
  • Global IP collaboration normally includes sharing of personal data. For e.g., if two people from different countries comes together for any kind of IP creation such as an innovation, research etc, the data shared must comply with the Act. The DPDP Act regulates cross-borders transfers and ensures that any personal data shared internationally adheres to Indian privacy standards.

The interplay between IP and DPDP Act presents a unique set of challenges. The DPDP Act mandates informed consent for any kind data usage. This may slow down innovations or research that rely on datasets. The emergence and growth of Artificial Intelligence which involves both personal data and creative works introduce unique challenges especially concerning ownership dilemma. The legal framework to an extent, help to align data protection with IP considerations, thereby minimalizing conflict.

The DPDP Act provides a structured approach to data protection in India. It was enacted to enable India to thrive in the global digital economy without comprising on data breach and other privacy and security concerns. It is crucial to strike a balance between the DPDP Act and IP laws in order to protect privacy while fostering new creations and innovations. People who set out to create   intellectual property must ensure the compliance of both legal frameworks. Creators, authors, inventors etc may protect the proprietary rights of their creations without comprising data protection.

By Shwetha

[1] https://natlawreview.com/article/key-highlights-indias-draft-digital-personal-data-protection-rules-2025

[2]chromeextension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf

[3] https://carnegieendowment.org/research/2023/10/understanding-indias-new-data-protection-law?lang=en