Rules of protection: Draft regulations should enhance data security

The Ministry of Electronics and Information Technology last week released the draft “Digital Personal Data Protection Rules, 2025” for public feedback. This follows up on the Digital Personal Data Protection Act, 2023 (DPDP), which passed into law in August 2023. The Rules are critical in that these provide the details for the implementation framework of the Act. The Act and the Rules refer to individual digital users as “data principals”, and the Act is expected to offer individuals greater control over their personal information, with provisions like requirements for explicit consent and the right to access, correct, and erase data.