Header Banner Header Banner
Topics In Demand
Notification
New

No notification found.

Draft DPDP Rules Check-In: Do These Four Clauses Continue to Define the Key Day-One Friction Points?
Draft DPDP Rules Check-In: Do These Four Clauses Continue to Define the Key Day-One Friction Points?

July 30, 2025

64

0

On DayOne, the real operational friction is likely to turn on breachalert volume, parentconsent workflows, clarity on SDF triggers, and penalty calibration—unless the final rules address the same.

1. Breach workflow: user alerts, Board filing, and parallel regulators

Rule7(1): “On becoming aware of any personal data breach, the Data Fiduciary shall, to the best of its knowledge, intimate to each affected Data Principal, in a concise, clear and plain manner and without delay …

Rule7(2): “On becoming aware of any personal data breach, the Data Fiduciary shall intimate to the Board,—

(a) without delay, a description of the breach …; and

(b) within seventytwo hours of becoming aware of the same, or within such longer period as the Board may allow, furnish a detailed intimation of the breach.

Operational question: Without a harm threshold, are the firms geared up to meet the requirement of notifying users and filing with the Board every minor, fullycontained incident?

2  Consent mechanics for all users under 18

Rule10: “A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable by reference to—

(a) reliable details of identity and age available with the Data Fiduciary; or

(b) voluntarily provided details of identity and age or a virtual token mapped to the same.

Operational question: How will Data Fiduciaries implement a privacypreserving yet regulatorproof method for “verifiable parental consent” at scale, without defaulting to blanket ID collection for millions of teen users?

3  Cross Border processing restrictions for SignificantDataFiduciaries (SDFs)

Rule12(4): “A Significant Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government on the basis of the recommendations of a committee constituted by it is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India.

Publicweb information lies outside the Act, and routine international transfers are permitted unless an SDF receives a Rule12(4) directive.

Operational question: What concrete thresholds—user counts, turnover, specific “sensitive” data classes—will signal in advance which firms may be tagged as SignificantDataFiduciaries, and what exactly does traffic data pertaining to its flow include if an incountry storage directive is issued?

4  Penalty bands upper limits for different breaches

Schedule (see section33(1), DPDPAAct) illustrative entries

May extend to two hundred and fifty crore rupees.

May extend to two hundred crore rupees.

May extend to one hundred and fifty crore rupees.

May extend to fifty crore rupees.

Operational question: Will the Board publish—prior to the first enforcement cycle—clear criteria for choosing penalties within the Schedule’s wide bands, so fiduciaries can gauge the difference between a procedural lapse and a breach causing real harm?

Closing note

The draft Rules set no fixed timetable for future rulemaking. Past MEITY practice may suggests some pattern, but without a formal clause business must still budget for possible shorter runups.

Some structural critiques touch the Act itself. That checkin is for another day; this list stays focused on what could bite from DayOne if the Rules are finalised as drafted. Did I miss anything or overstate something? 


That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.


ashish.aggarwal

© Copyright nasscom. All Rights Reserved.