NEW DELHI — Business Software Alliance (BSA) Country Manager for India, Venkatesh Krishnamoorthy, issued the following statement regarding the release of the 2025 Draft Digital Personal Data Protection Rules: 

"The Business Software Alliance shares the goals of ensuring protection for consumers’ personal data and supporting India’s growing innovation ecosystem. The release of the Draft Digital Personal Data Protection Rules for public consultation is a welcome step toward achieving those goals.

However, as currently written, the Draft Rules create new ways to restrict international data transfers for companies of all sizes and across industry sectors. The ability to responsibly transfer data around the globe is a linchpin of the modern digital economy. These newly proposed restrictions will be a significant concern as they increase uncertainty for businesses and will impede the ability of companies to innovate without enhancing data protection goals.

The Draft Rules miss an opportunity to address concerns in the 2023 Digital Personal Data Protection (DPDP) Act regarding overbroad data breach notification requirements, the lack of a process for designating a Significant Data Fiduciary, and an over-reliance on consent for processing personal data. 

The Rules should establish a clear, risk-based threshold for determining notifiable data breaches, create a transparent process for identifying whether a business is a Significant Data Fiduciary, and recognize “legitimate uses” more broadly as an important legal basis for processing personal data, including in connection with AI systems.

BSA looks forward to engaging with the government of India to improve the Draft Rules and how they will work in practice to ensure they promote effective data protection practices without inadvertently harming India’s innovative digital economy."