Centre on Friday has released the draft rules for the Digital Personal Data Protection (DPDP) Act, that specify that personal data of Indians should not go out of the country and that data fiduciaries must employ measures to verify parental consent before processing data of children below 18 years. The rules have been released for public consultations.

The Digital Personal Data Protection Rules, 2025, will be finalised after consultation. This significant step has been long awaited since the Act was passed in August, 2023.

“A significant data fiduciary shall undertake measures to ensure that personal data specified by the Central government on the basis of the recommendations of a committee constituted by it is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India,” the draft rules said.

For consent for processing of personal data of child or of person with disability who has lawful guardian, the draft rules said a Data Fiduciary must employ measures to verify consent of a parent.

“A Data Fiduciary, while obtaining verifiable consent from an individual identifying herself as the lawful guardian of a person with disability, shall observe due diligence to verify that such guardian is appointed by a court of law, a designated authority or a local level committee, under the law applicable to guardianship,” it said.

The rules also specify details about setting of a Data Protection Board. On the appointment of Chairperson and other Members of the Board, the Rules specify that the Centre will constitute a ‘Search-cum-Selection Committee’, with the Cabinet Secretary as the chairperson and the Secretaries to the government of India in charge of the Department of Legal Affairs and the MeitY along with two experts of repute having special knowledge, as members.

Published on January 3, 2025