The government on Friday unveiled the draft Digital Personal Data Protection Rules, 2025, reigniting the debate over data localisation while leaving penalties for violations unaddressed.
The proposed rules, released for public consultation, come 14 months after Parliament approved the Digital Personal Data Protection (DPDP) Act, 2023.
The draft reintroduces localisation requirements, mandating that certain personal and traffic data remain within India’s borders. This provision, removed in the 2023 Act following pressure from global tech giants, has resurfaced under the new rules.
The government will determine data categories subject to localisation based on recommendations from a yet-to-be-formed committee.
Significant data fiduciaries, defined by the volume and sensitivity of the data they process, will be required to comply. Companies such as Meta, Google, Apple and Amazon are expected to fall under this category.
“A significant data fiduciary shall undertake measures to ensure that personal data specified by the Central Government... is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India,” the draft states.
The omission of penalties, however, raises concerns. The DPDP Act allowed fines of up to ₹250 crore for data breaches, but the draft rules make no mention of enforcement measures.
Critics say this could hinder accountability and weaken the regulatory framework. They described the localisation mandate as a pivotal development and also pointed out to other gaps in the draft.
Shreya Suri, partner at IndusLaw, said “the absence of thresholds for reporting minor data breaches imposes uniform compliance burdens, regardless of scale. Further guidance is essential to ensure clarity and consistency.”
The rules also lack detailed instructions on security practices and delivery mechanisms for notices, relying instead on market practices and stakeholder discretion, she added.
The rules, critical for operationalising the DPDP Act, are open for public feedback until February 18, 2025.
