The Ministry of Electronics and Information Technology (MeitY) has shared draft rules under the Digital Personal Data Protection Act (DPDP Act), 2025. These rules aim to make the digital world safer and more transparent. People can give feedback on the draft until February 18, 2025, through the MyGov platform. The rules focus on better handling personal data, especially for children and vulnerable groups, while holding companies more accountable.
Parental Consent Needed For Social Media Account
One of the very important regulations is that children under eighteen should seek and get verifiable consent from their parents or guardians before establishing a social media account. This process ensures the security of a child’s details. In certain procedures, the age of the child and his or her relationship to the parent or guardian should be verified and documented. It reduces dangers and ensures that children use the internet safely.
Consumer Control Over Data
Draft rules have empowered the individual over their data. Users have the right to demand that the platform delete the information if the user no longer wishes it to be stored. The user may question why it is being collected and get transparent answers on what the data is used for. Changes have been brought into place, giving users more control over their digital lives.
Strict Penalties For Breaches Of The DPDP Act Rules
To make companies responsible, the rules propose fines of up to Rs. 250 crore for data breaches. If a breach happens, companies must quickly inform users about what was affected and what is being done to fix it. They also need to notify the Data Protection Board within 72 hours. These steps aim to build trust and ensure companies act quickly during data breaches.
Annual Data Protection Checks
Large companies handling sensitive or vast amounts of personal data must carry out yearly checks, called data protection impact assessments and audits. These checks will help ensure companies manage data responsibly and stay accountable. Reports from these checks must be shared with the Data Protection Board under the new rules of the DPDP Act 2025.
Deletion Of Inactive User Data
The draft rules of the proposed DPDP Act further mandate that the platforms erase the data of the inactivated users for three years. This move minimizes storing redundant data and reduces the risks of maintaining such information for too long. Instead, it encourages the platforms to prioritize only the data of active users.
Impact On Different Sectors
The new rules of the DPDP Act are applied differently from one sector to another, for example, e-commerce, gaming, and social media. For instance, an e-commerce platform must handle user data transparently and securely. Social media firms must seek parental permission to open children’s accounts, while gaming sites must establish systems to confirm user data and prevent misuse. This is the sector-specific approach, ensuring that rules address unique industries’ needs.
Challenges And Concerns
Although the draft rules of the DPDP Act 2025 seem to provide a good foundation, there are concerns. Data localization might again come back as storing specific data only in India, which would pose difficulties for international companies. Small-scale businesses will also face problems due to regular audits and assessments. The issues must be resolved during the consultation to make the rules practical and fair.
Experts praise the flexible way the verification of parental consent is done, allowing companies to find practical ways to put them into practice. However, some stakeholders are wary of how these rules will translate to real-world conditions and how they will affect operations.
Next Steps For The DPDP Act, 2025
A consultation process allows stakeholders to propose improvements and clear out any uncertainties. The eventual version of these rules would balance the protection of users and business feasibility. Once implemented, these rules will be an important step towards a safer digital space with more inclusion in India.
The DPDP Act rules strengthen personal data protection while building trust in the digital economy. It underlines shared responsibility among users, platforms, and regulators for creating a safe and transparent online world.
Follow Us: Facebook | Instagram | X |
Youtube | Pinterest | Google News |
Entertales is on YouTube; click here to subscribe for the latest videos and updates.
