NEW DELHI, October 14 — The Ministry of Electronics and Information Technology (MeitY) on Wednesday officially notified the finalized Digital Personal Data Protection Rules under the statutory framework of the Digital Personal Data Protection Act, 2023 (DPDP Act), establishing the administrative and operational procedures for the newly constituted Data Protection Board of India (DPBI).
According to the official gazette notification, the rules outline mandatory compliance directives for Data Fiduciaries, mandating plain-language consent notices accessible in English and all 22 languages listed in the Eighth Schedule of the Constitution. Stringent safeguards govern the processing of children's data and individuals with disabilities, strictly prohibiting behavioral tracking, profiling, and targeted advertising directed at minors. Data Fiduciaries must implement automated mechanisms enabling Data Principals to withdraw consent, correct data, and seek grievance redressal within set statutory turnaround windows.
The framework empowers the Data Protection Board of India to function as an independent, digital-by-design quasi-judicial authority. The Board is vested with statutory authority to adjudicate non-compliance, summon corporate disclosures, and levy financial penalties ranging up to ₹250 crore for significant personal data breaches and security failures.
The legal architecture of the DPDP Act 2023, the landmark Supreme Court ruling in Justice K.S. Puttaswamy v. Union of India (2017 declaring privacy a fundamental right under Article 21), Justice B.N. Srikrishna Committee recommendations, cross-border data transfer regulations, and comparative differences between the DPDP Act and the European Union's GDPR are core topics across UPSC Civil Services (GS-II: Polity, Governance & Fundamental Rights).