Govt releases draft Digital Personal Data Protection Rules without any penal clause

The government has released the long-awaited draft of Digital Personal Data Protection Rules that do not mention any penal action for violations. The draft rules, which have been published for public consultations, will be taken into consideration for making the final rule after February 18.

"Draft of rules proposed to be made by the central government in exercise of the powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), on or after the date of coming into force of the Act, are hereby published for the information of all persons likely to be affected thereby," the draft notification said.

The draft rules have laid out provisions related to consent processing of individuals, data processing bodies and the functioning of authorities under the Digital Data Protection Act, 2023.


"...notice is hereby given that the said draft rules shall be taken into consideration after 18th February, 2025," the notification said.

The draft rules have not mentioned penalties that were approved under the DPDP Act, 2023.

The Act has the provision to impose a penalty of up to Rs 250 crore on data fiduciaries -- entities responsible for determining the purpose and means of processing of personal data.