Data protection revolution in India: Key provisions of the 2025 Draft Rules

India's rapidly expanding digital gaming and sports sector faces significant compliance challenges following the publication of the Draft Digital Data Protection Rules, 2025

Background: India's digital gaming boom and data privacy concern

Over the past decade, India has seen a rapid proliferation of digital platforms, especially in the gaming and sports sector^[1], which has led to an exponential surge in the collection, storage and processing of personal data across various industries. Online gaming platforms, esports tournaments and professional sports organizations are increasingly dependent on personal data analytics to refine user experiences, conduct targeted marketing campaigns and enhance overall operational efficiency^[2]. This reliance on personal data, while fostering innovation and business growth, has simultaneously raised significant concerns regarding data security, unauthorized data exploitation and potential privacy breaches^[3]. Consequently, the necessity for a structured legal intervention has become imperative to safeguard individuals’ rights while ensuring that stakeholders with commercial interests adhere to ethical and secure data processing practices.

The Draft Digital Data Protection Rules, 2025

On 3 January 2025, the Ministry of Electronics and Information Technology (MEITY) published the long-awaited Draft Digital Data Protection Rules, 2025^[4] (Rule/Draft Rules) to the Digital Personal Data Protection Act^[5] (DPDP Act) for feedback/ comments from the public^[6]. These Draft Rules are expected to provide further clarifications with respect to the compliance mandated under the DPDP Act.  This article examines the potential impact and compliance challenges the Draft Rules may create for India's sports and gaming sector, as well as international sports brands operating within the Indian sports market. The article analyses key provisions and their practical implications for sports industry stakeholders.:

• The existing framework: why change was necessary
  • The rise of age verification requirements
• The new framework: key sections of the DPDP Act
  • Scope and applicability
  • Required security measures
  • Breach notification process: timelines and challenges
  • Consent mechanisms and user rights
  • Minors' personal data and parental consent
• Extraterritorial jurisdiction

Please note that in a related article, available here, the authors move on to explore ‘How India's new data protection laws will impact the sports and gaming industry’.