NEW DELHI — The Government of India has formally notified the operational rules under the landmark Digital Personal Data Protection (DPDP) Act, marking the transition from legislative enactment to strict regulatory enforcement. The detailed rules delineate the institutional powers of the Data Protection Board of India (DPBI), provide technical blueprints for registered Consent Managers, and establish precise compliance benchmarks for commercial enterprises and digital platforms operating within India.
The regulatory framework strikes a vital balance between protecting citizens’ fundamental right to privacy—as affirmed by the Supreme Court in the 2017 Puttaswamy verdict—and fostering an agile, innovation-friendly digital economy capable of supporting India’s trillion-dollar digital ambitions.
Institutional Architecture: The Data Protection Board of India
The operational rules formally empower the Data Protection Board of India as a digital-first, paperless adjudicatory body. Functioning with the powers of a civil court, the DPBI is mandated to receive citizen complaints, initiate inquiries into suspected data breaches, summon enterprise records, and impose statutory financial penalties ranging up to ₹250 crore for significant security lapses.
- Mandatory Breach Notification: Data Fiduciaries must notify both the DPBI and affected individual data principals within six hours of detecting a confirmed personal data security incident.
- Digital Adjudication Process: All proceedings, submissions, hearings, and orders are conducted via a secure digital portal, ensuring rapid resolution within statutory timeframes.
- Appellate Route: Appeals against DPBI orders lie exclusively before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), providing judicial oversight.
Stay informed with legal analysis and technology policy reporting in our Current Affairs Section and Today’s News Feed.
The Consent Manager Paradigm: Empowering the Citizen
A central structural innovation within the DPDP rules is the institutionalization of Consent Managers. Acting as trusted technological intermediaries, Consent Managers enable citizens to monitor, modify, and revoke their personal data consents across banking, e-commerce, healthcare, and social media platforms through a single dashboard.
By enforcing machine-readable, granular consent notices presented in all 22 scheduled Indian languages, the rules eliminate opaque, multi-page terms of service agreements, ensuring citizens possess genuine agency over how their personal data is collected, processed, and retained.
Significant Data Fiduciaries and Corporate Compliance Mandates
Enterprises handling high volumes of sensitive personal data—designated as Significant Data Fiduciaries (SDFs)—face rigorous compliance standards. These include appointing an independent Data Protection Officer (DPO) based in India, commissioning periodic independent data audits, and conducting Data Protection Impact Assessments (DPIAs) prior to deploying high-risk artificial intelligence algorithms or consumer-profiling systems.
