On January 3, 2025, the ministry of electronics and information technology released the Draft Digital Personal Data Protection Rules, 2025, for public consultation. These rules are proposed to be enacted under the authority of the Digital Personal Data Protection Act, 2023, and in order to implement the provisions of that Act.

The publication of the draft rules marks a significant milestone, as they are necessary before the Data Protection Act can actually be implemented in a way that effectively protects the rights of Indian citizens. With that said, however, in their present form, the rules suffer from various potential flaws, which might hamper the ability of the law to perform that function.

First, there is the procedure for the selection of the chairperson and members of the Data Protection Board (DPB) itself. The Data Protection Board is crucial to the functioning of the Act, as it constitutes, in essence, the infrastructure through which the law will be implemented. Potentially, and in many cases, the Board will be handling complaints against State organs for wrongful processing of data. In such a context, it is essential that the Board be adequately independent of the government. However, the Rules take forward the logic of the Act in setting up a procedure of appointment (through a search-and-selection committee) that is entirely under........

© hindustantimes