Introducing the Digital Personal Data Protection (DPDP) Rules, 2025, represents a significant milestone in India’s journey toward establishing a privacy-compliant society. As technologies advance rapidly, new data breaches and privacy concerns emerge, making it increasingly essential for the state to prioritize the protection of citizens’ personal data.
The Digital Personal Data Protection (DPDP) Act, 2023, primarily focuses on safeguarding the digital personal data of individuals in India. It provides clear guidelines for how organizations should collect, process, store, and transfer personal data, all while ensuring the protection of privacy rights.
Understanding “Digital Personal Data”
The DPDP Act specifically covers “Digital Personal Data,” which refers to any data that is related to an individual (referred to as the “Data Principal”) and can directly or indirectly identify them. This includes personal information that is processed digitally, regardless of whether the data was originally collected offline but later digitized.
Examples of Personal Data covered under the Act include:
• Identification details such as names, contact information (phone numbers, emails), dates of birth, and government-issued identification numbers (e.g., Aadhaar, PAN, Passport).
• Financial data such as bank account details, UPI IDs, and credit/debit card information.
• Biometric data such as fingerprints, iris scans, facial recognition, and other biometric identifiers.
• Location data, IP addresses, cookies, and device identifiers, especially when linked to an individual.
Categories of Data Under the DPDP Act
The DPDP Act defines two main categories of digital personal data:
1. Personal Data: This refers to any data that can directly or indirectly identify an individual. Personal data includes sensitive information such as financial records, biometric data, identification details, and location data.
2. Digitally Processed Data: This category includes data that has been collected, stored, or processed in digital form. It also includes data that was originally collected offline but later digitized, such as paper records that are scanned into a digital format.
The DPDP Act recognizes that certain types of data, particularly those linked to an individual’s private health, finances, or personal characteristics, require higher levels of protection.
This includes Sensitive Personal Data such as:
• Health data (medical records, prescriptions)
• Genetic data
• Financial data (bank account details, credit card information)
• Personal characteristics such as sexual orientation, caste, and religion (when used for identification)
Additionally, special protections are afforded to Children’s Personal Data and Data of Individuals with Disabilities.
The Value of Personal Data: Why Protection Matters
The phrase, “Personal data is the new currency,” highlights the increasing value of personal information in the digital economy. As data becomes more central to decision-making and economic activity, safeguarding privacy rights has never been more critical. The DPDP Act aims to address these concerns by ensuring that personal data is handled responsibly and that individuals have control over their information.
Government’s Approach to Data Localization and Transfers
Initially, there was a push for data localization—the requirement for personal data to be stored within India’s borders. However, due to significant societal and business pushback, the provision for mandatory data localization was ultimately excluded from the DPDP Act, 2023.
Instead, Section 16 of the DPDP Act, when read in conjunction with Rule 14 of the Draft Rules, 2025, establishes that the Central Government will publish a list of restricted countries to which data transfers will be prohibited. This list is still to be finalized, but it underscores the government’s focus on protecting the privacy of Indian citizens by limiting data transfers to countries that do not meet adequate data protection standards.
Additionally, the Central Government has the authority to specify, by general or special order, the requirements that data fiduciaries (those responsible for handling data) must follow when transferring data to foreign countries. These rules apply to data transfers related to certain goods and services, ensuring that data handling complies with privacy requirements even outside India.
Conclusion: Safeguarding Digital Personal Data
The Digital Personal Data Protection (DPDP) Act, 2023, is an essential step toward protecting digital personal data in India. The Act distinguishes between Personal Data and Digitally Processed Data, with the latter receiving more stringent safeguards. Although the initial push for data localization was dropped, the Act provides for careful restrictions on data transfers to foreign countries, ensuring that such transfers occur under strict conditions.
Advocate Ankit Prasad
(Writer is a practicing lawyer at Hon’ble High Court of Delhi)
ankitprasad965@gmail.com
