The Government’s notification of the Digital Personal Data Protection Rules 2025 marks a significant milestone in India’s ongoing journey to strengthen its personal data protection architecture. With the Rules now in force, the industry has a clearer and more actionable roadmap.
We commend the Ministry of Electronics and Information Technology for adopting a constructive, consultative approach throughout the drafting process. The final Rules largely preserve the structure and policy choices of the draft framework, while introducing a transparent and predictable phased commencement schedule. Key enhancements include greater clarity on verifiable consent with a definition embedded in the Rules, alongside well-structured, distinct provisions for children and persons with disabilities. The sections addressing processing by the State remain broadly consistent with the draft, with refined drafting that improves readability without altering the underlying intent.
At the same time, it is important to recognise that certain matters raised by industry during consultation arise from the architecture of the Act itself and could not realistically be addressed through subordinate legislation. These include the overarching structure of parental consent, the statutory age threshold for children and the requirement that all personal data breaches be notified. Our focus now moves to supporting implementation in a manner that is practical, proportionate and aligned with the objectives of the law.
On international data transfers, Nasscom-DSCI recognises the importance of developing mechanisms that support interoperability and facilitate co-operation with India’s key trading partners. A stable and predictable transfer environment is central to operationalising personal data protection and to the continued growth of India’s digital economy, particularly for IT-ITES, global capability centres, platform businesses and our expanding ecosystem of start-ups and technology SMEs.
Nasscom-DSCI remains committed to working closely with both industry and government to support effective implementation, address operational challenges, and promote a culture of responsible and innovation-friendly data protection. As India advances its digital objectives, we will continue to champion best practices, build capacity, and foster a trusted, rights-respecting ecosystem grounded in accountability and technological innovation.
