Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{205890,
        author = {Muktha T.V},
        title = {Critical study of Digital Personal Data Protection Rules 2025},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {13},
        number = {1},
        pages = {8500-8511},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=205890},
        abstract = {The Digital Personal Data Protection Act, 2023 (DPDP Act) marks the first comprehensive legislation of India governing the processing of digital personal data and represents a major constitutional and regulatory response to the recognition of privacy as a fundamental right in Justice K.S. Puttaswamy (Retd.) v. Union of India.  The notification of the Digital Personal Data Protection Rules, 2025 (DPDP Rules) operationalises the statutory framework by prescribing detailed obligations relating to notice and consent architecture, breach reporting, children’s data protection, cross-border transfers, grievance redressal, and institutional governance. The Rules introduce a phased compliance structure, establish obligations for Significant Data Fiduciaries, and create a framework for Consent Managers, thereby reshaping India’s digital governance landscape. This article critically evaluates the DPDP Rules, 2025 through constitutional, comparative, and regulatory lenses. It examines the extent to which the Rules strengthen informational privacy while simultaneously analysing concerns relating to executive overreach, institutional independence, state surveillance, cross-border data governance, and the dilution of transparency protections under the Right to Information Act, 2005. The article further compares the Indian framework with the European Union’s General Data Protection Regulation (GDPR), particularly in relation to security safeguards, proportionality, and regulatory accountability. The article argues that while the DPDP Rules, 2025 constitute a transformative step toward establishing a consent-centric and accountability-driven privacy regime, the framework remains constrained by broad governmental exemptions, limited data principal rights, and excessive executive control over enforcement structures. The long-term legitimacy of India’s data protection regime will therefore depend upon judicial interpretation, institutional independence, and the development of a balanced framework capable of reconciling privacy, innovation, transparency, and national security within a constitutional democracy.},
        keywords = {DPDP Rules 2025, Data Protection Board, Consent Manager, Data Fiduciary, Informational Privacy, GDPR, Digital Constitutionalism},
        month = {June},
        }