Home / Data Protection Framework for India
Data Protection Framework for India
The document is a case brief on the current challenge before the Supreme Court regarding the constitutional validity of certain provisions of the Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025.
Thematic FAQs on the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025
This document provides a concise overview of the notified Digital Personal Data Protection Rules, 2025, issued by the Ministry of Electronics and Information Technology. Framed under the Digital Personal Data Protection Act, 2023, these rules are now operationalizing India’s first data governance legislation in a phased manner. The document also offers a detailed rule-by-rule comparative analysis of the draft rules against the notified rules.
The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 on November 13th, 2025. The rules were framed under the Digital Personal Data Protection Act, 2023 and are now operationalising India’s first data governance legislation in a phased manner.
The Data Security Council of India (DSCI) has provided feedback on India's draft Digital Personal Data Protection Rules, 2025, appreciating the principle-based approach while offering targeted recommendations to improve clarity and implementation feasibility.
On 3rd January 2025, the Ministry of Electronics and Information Technology published the Draft Digital Personal Data Protection Rules 2025 for public consultation. This document is intended to provide a high-level summary of the noteworthy details that have been introduced through the draft Rules to the data protection framework in India. It is important to note that these provisions are undergoing public consultation and will only be considered binding law after final notification in the Gazette. For detailed information on the provisions of the rules, see the official full text of the rules here
The DPDP Act proposes to grant individuals certain rights, including the right to have their personal data processed only with their consent, and it also includes provisions for measures to safeguard their data. This comprehensive act seeks to find a balance between protecting the rights of individuals and meeting the data processing needs of businesses. To concisely convey its essence, detailed infographics have been created, outlining the core principles and provisions of the Act.
On 3rd August 2023, the Digital Personal Data Protection (DPDP) Bill, 2023 was introduced in the Lok Sabha and passed on 9th August 2023, and subsequently introduced and passed on 9th August 2023 in the Rajya Sabha. On 11th August 2023, the President of India gave assent to the bill and henceforth known as the Digital Personal Data Protection (DPDP) Act, 2023.
The Act shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint and different dates may be appointed for different provisions of this Act.
Below is the copy of the Act as published by ‘The Gazette of India’ and a brief chapter-wise summary of the provisions of the DPDP Act 2023 along with a comparison with the 2022 Draft Bill of the same.
The Digital Personal Data Protection Bill 2023 has been formally introduced in the Indian Parliament’s Lok Shabha. It is a concrete step forward in India’s journey towards establishing a comprehensive data protection regime.
The Bill brings forth some key changes when contrasted against the 2022 draft. The clause on deemed consent has been removed and in its place certain legitimate uses have been prescribed for processing of personal data. Additionally, cross-border data transfers have been eased with the Government having the power to notify countries to which transfers will be restricted. Some clarity has also been provided on the operational functioning of the Data Protection Board.
The complete contents of the bill can be found here.
Watch out for DSCI's comprehensive summary of the bill to be out soon!
The Ministry of Electronics and IT (MeitY) has notified the draft Digital Personal Data Protection Bill 2022 (DPDPB, 2022) on 18th November 2022. The scope of the bill applies to automated processing of personal data which is either collected from Data Principals online or personal data which is collected offline but is digitised. Non-personal data and anonymised data have been omitted from the scope of the law.
The complete script of the draft bill can be accessed here.
Below is a brief chapter-wise summary of the proposed legislation along with a comparison with the JPC Report and Personal Data Protection Bill 2021.
The Joint Parliamentary Committee chaired by Member of Parliament Shri P.P. Chaudhary tabled the report (access here) on the Data Protection Bill before both houses of parliament on the 16th of December 2021. The document comprises two parts, the first of which is the report with general observations and the second is the amended Bill with clause-by-clause recommendations of the committee.
Some key recommendations are as follows:
- The new legislation will deal with personal and non-personal data both
- Government asked to follow a timeline for phased implementation of Data Protection Act
- Government asked to bring mirror copy of the sensitive and critical data from abroad and do localization.
- Policy to be prepared and pronounced for Gradual data localization recommended.
- Government asked to establish a mechanism for certification of all digital and IOT devices.
- Social media platforms to be treated as publishers and be regulated for the content they host.
- Reporting of Breach of personal data within specific time.
Data Security Council of India (DSCI) shared it’s submission to the Non-Personal Data Committee, on the draft recommendations put forth in the report by the Committee of Experts on Non-Personal Data Governance Framework.
DSCI conducted industry consultations to assess the likely impact on the Industry of the proposed recommendations and these have informed our assessment of the report. DSCI Submission highlighted the key principles to be taken into consideration, while envisioning a data sharing mechanism for Non-personal data in India, keeping in mind India’s Digital economy growth charter and also to reinforce India’s global position as a growing digital hub and innovation. It also raised, certain issues that subsist within the framework proposed by the committee, and has urged the committee to revaluate the assertions and recommendations put forth in the report with respect to its interplay with the upcoming Personal Data Protection Law in India and other established regulations with respect to intellectual property rights and competition..
The following key concerns were addressed in our submission coupled with recommendations to address them:
- Objective and narrative of the report, w.r.t data utilisation
- Requiring Individual’s consent for Anonymisation and usage of Anonymised data
- Definition of Non-Personal Data- Public, Private and Community
- Sensitivity of Non-Personal Data and restrictions on data flows
- Role of stakeholders- Data Custodians and Non-Personal Data Authority
The Committee on Non-Personal Data has sought comments on its draft recommendation laid down in its report titled 'Report by the Committee of Experts on Non-Personal Data Governance Framework' ( available here) by August 13, 2020. (Notice for feedback available here.) The committee under the chairmanship of Kris Gopalakrishnan (Co-Founder, Infosys) with the mandate of studying various issues relating to Non-Personal Data and to make specific suggestions for consideration of the Central Government on regulation of Non-Personal Data, has put forth these recommendations in said report for public consultation. The recommendations of the report have been summarised in the document. You may please download the file below.
Data Security Council of India, would be submitting its comments to the committee. To enable us to formulate a robust and representative submission we request you to share your inputs on these draft recommendations with us at membership[at]dsci[dot]in or anand[dot]krishnan[at]dsci[dot]in by 3rd August (Monday), 2020.
The Personal Data Protection (PDP) Bill 2019, which was cleared by the Union Cabinet last week, was introduced in the Lok Sabha on Wednesday, December 11, 2019, by Shri Ravi Shankar Prasad, the Minister of Electronics and Information Technology, Government of India. The bill seeks to provide for the protection of personal data of individuals and establishes a Data Protection Authority for the same. The bill is referred to a Joint Select Committee comprising of members from Lok Sabha and Rajya Sabha.
We would wish to get your views and suggestions on the bill. We request you to kindly share the inputs with DSCI at membership[at]dsci[dot]in latest by Saturday, December 21, 2019, to enable us to provide an industry submission to the Joint Parliamentary Committee and MeitY.
Ministry of electronics and information technology has opened the Protection of Personal Data Bill, 2018 for public consultation.The deadline for submission of responses is 10th September 2018. The Bill can be accessed here: Personal Data Bill, 2018
NASSCOM-DSCI will be submitting a comprehensive response. Please share your inputs on anand.krishnan@dsci.in by 1st September 2018.
Questionnaire to share your position on critical impact areas for industry and provision wise comments is enclosed. A presentation summarising the provisions and the issues has also been enclosed for your reference.
Government of India has constituted a Committee of Experts (nine member) under the chairmanship of Justice B N Srikrishna to study various issues related to data protection and develop a Data Protection Framework for India. A White Paper on Data Protection Framework was released by Ministry of Electronics and Information Technology (MeitY) earlier for public comments. Subsequently, the committee conducted several consultation meetings with stakeholders and solicited inputs on the whitepaper. The final draft of Personal Data Protection Bill, 2018 alongside the Expert committee report was submitted to the government on 27 July 2018.
DSCI CEO one of the members in the nine-member committee has been participating and providing inputs to the committee deliberations. Earlier in January DSCI-NASSCOM made a combined submission on the whitepaper to MeitY. DSCI has prepared an overview document capturing the key aspects of the proposed Bill for easy reference.
Operational Office – 4th Floor, NASSCOM Campus, Plot No. 7-10, Sector 126, Noida, UP -201303
In Association
