The Digital Personal Data Protection Act, 2023 (“Act”) and the Digital Personal Data Protection Rules, 2025 (“Rules”) were notified on 13th November, 2025.

The Act provides for the processing of digital personal data in a manner that recognises both the rights of the individual, including the student, to protect their personal data and the need to process such personal data for lawful purposes. 

The data fiduciaries, including digital education platforms, processing the personal data of students should adopt appropriate technical and organizational measures to ensure compliance with the act. 

Data fiduciaries shall also ensure that verifiable consent of the parent is obtained before processing any personal data of the student as child.

The Act provides certain exemptions to educational institutions, allowing them to process personal data of student as child:

● For tracking and behavioural monitoring for the educational activities and the safety of children enrolled with it; and
● For tracking the location of children during transport of children for their safety

All the Data Fiduciaries are obligated to protect personal data by taking reasonable security safeguards to prevent personal data breach. 
The Rules require Data Fiduciaries to implement appropriate security safeguards, such as encryption or masking, to protect data and prevent breaches.
In the event of any personal data breach:
● Data Fiduciaries have to intimate about such breach to the Data Protection Board and each affected individual, including students
● On receipt of such intimation the Data Protection Board after an inquiry, may impose monetary penalty as per the provisions of the Act
● Penalties are determined based on factors like nature of breach, harm caused, safeguards in place, severity and recurrence

The Act requires every Significant Data Fiduciary to appoint an independent data auditor to assess compliance with its provisions.
The rules mandate an eighteen-month period to allow data fiduciaries to implement appropriate technical and organizational measures to achieve compliance with the provisions of the Act.
During this period, data protection continues to be governed by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 under the Information Technology Act, 2000 (IT Act).
Data fiduciaries are required to follow the SPDI framework, including consent requirements, purpose limitation, security safeguards, and grievance redressal mechanisms. 

                                                                                               ****

(This statement was given by Minister of State for Electronics and Information Technology Shri Jitin Prasada in Rajya Sabha today.)

(Release ID: 2202901) Visitor Counter : 73