The correct answer is Digital Personal Data Protection Act, 2023. Explanation & Key Takeaways: • The Digital Personal Data Protection Rules, 2025, serve as the subordinate legislation required to operationalize the Digital Personal Data Protection (DPDP) Act, 2023, which was enacted by the Parliament of India in August 2023. • The primary objective of these rules is to provide a comprehensive procedural framework for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process such data for lawful purposes. • The rules facilitate the establishment and functioning of the Data Protection Board of India (DPBI), which acts as the regulatory and adjudicatory body responsible for monitoring compliance and redressing grievances. Hence, the statement regarding the facilitation of the 2023 Act is correct. • These rules specify the detailed obligations for Data Fiduciaries, including the mechanisms for obtaining consent, providing notice to Data Principals, and the mandatory reporting of personal data breaches to the Board. • The implementation of these rules is overseen by the Ministry of Electronics and Information Technology (MeitY), ensuring that the digital economy operates within a secure and legally defined boundary. Related Concepts: • Scope and Applicability: • The DPDP Act, 2023 applies to the processing of digital personal data within India. • It also extends to processing outside India if it is in connection with any activity related to offering goods or services to Data Principals within the territory of India. • Key Definitions: • Data Principal: The individual to whom the personal data relates. In the case of children (under 18 years) or persons with disabilities, it includes their parents or lawful guardians. • Data Fiduciary: Any person or entity that determines the purpose and means of processing personal data. • Significant Data Fiduciary (SDF): Certain fiduciaries categorized by the Central Government based on factors like the volume of data processed and risk to electoral democracy or national security. • Rights of Individuals: • Individuals have the right to access information about their personal data, the right to correction and erasure, and the right to withdraw consent at any time. • The Act also provides for the right of grievance redressal and the right to nominate another individual to exercise these rights in the event of death or incapacity. • Financial Penalties: • The Act prescribes stringent penalties for non-compliance. For instance, failure to take reasonable security safeguards to prevent data breaches can result in a fine of up to Rs. 250 crore. • Failure to notify the Board or the affected Data Principal about a breach can attract penalties up to Rs. 200 crore. Important Notes: • Consent Architecture: Personal data can only be processed for a lawful purpose for which the Data Principal has given free, specific, informed, unconditional, and unambiguous consent. • Legitimate Uses: The Act allows for "Certain Legitimate Uses" where consent is not required, such as for sovereign functions, fulfilling legal obligations, responding to medical emergencies, or maintaining public order. • Cross-Border Data Flows: The Central Government may restrict the transfer of personal data by a Data Fiduciary to certain countries or territories outside India through notification. • Duties of Data Principals: Uniquely, the Act also stipulates duties for individuals, such as not providing false information or filing frivolous complaints, with potential penalties for violations.