How the draft Digital Personal Data Protection Rules miss the mark

The government’s release of the draft Digital Personal Data Protection Rules, 2025, (Draft Rules) on January 3, 2025, has set the stage for rolling out the Digital Personal Data Protection Act, 2023. These rules aim to address everything from how organisations should notify users about data practices to measures for preventing and responding to breaches. While the Draft Rules promise to establish a stronger framework for safeguarding personal data, its fragmented and complex approach risks placing an undue burden on smaller businesses, often overlooking the practical challenges of compliance. This article unpacks some of the key issues with the Draft Rules and explores its implications for businesses in India.