DPDP Rules 2025: MeitY Seeks Industry Inputs To Fine-Tune Draft

Various topics, such as unclear data breach reporting timelines, clarity on cross-border data transfers and a surge in the compliance burden on all types of companies, were discussed, according to sources who attended the meeting.

The discussion revolved around relaxation of the compliance burden on companies under the DPDP Act. Attendees also requested more such consultation sessions before the deadline closes. Also, instead of all data breaches being reported, a risk-based threshold provision was also proposed, they said.

"The objective that we had set for ourselves is to keep it simple, be principle-based rather than prescriptive, and let the law and rules evolve rather than casting everything in stone, a trust-based approach rather than a cynical one," Vaishnaw said at the event.

He added that the full framework for safeguarding personal data could be understood well only if the Digital Personal Data Protection Act and the draft rules were read in conjunction.

"We are here to listen and fine-tune any aspects that require further attention," MeitY Secy S Krishnan said. "More such sessions would be held soon."

The MyGov portal is also open for participants willing to share their views anonymously. He also mentioned that the digital infrastructure required for implementing the framework was being finalised.

The feedback taken from the industry will now be incorporated into the final rules.