IT Ministry Notifies Draft Rules for Digital Personal Data Protection (DPDP): Check Details

The Ministry of Electronics and Information Technology released a Digital Personal Data Protection (DPDP) Rules 2025 under the DPDP Protection Act 2023. The rules will protect citizen rights and will be significant for both users and tech giants in India. However, the Act was passed over a year ago, but the rules to put it into action are still being created and are now open for public feedback. The draft rules are open for public feedback until February 18.

The draft of Digital Personal Data Protection rules will also safeguard children’s data which means now that children under the age of 18 years will need parental consent to create social media accounts. The draft states, “A data fiduciary shall adopt appropriate technical and organization measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence.”

Another essential rule that the DPDP rules state is that all e-commerce platforms, online gaming platforms, or social media platforms will soon be required to erase the personal data of users. The data will be erased after three years when it is no longer needed. These draft rules are mandated for:

• E-commerce entities that are equipped with at least 2 crore registered users in India
• Social media platforms with at least 2 crore users
• Online gaming platforms with not less than 50 lakh registered users.

The Ministry of Electronics and Information Technology said on the MyGov portal that data fiduciaries have to provide the nature of the data that they are collecting including why they are collecting and what data they are collecting. In addition, they are also required to submit a fair account of specifics about the informed consent from the user if their data is collected.