How is this different from the earlier IT Act rules?

The old framework, chiefly the SPDI Rules made under Section 43A of the Information Technology Act, 2000, was narrower. It applied mainly to bodies corporate, focused on a defined list of sensitive personal data such as passwords, financial and health information, and had limited enforcement in practice. The DPDP Act covers all digital personal data rather than a sensitive subset, applies to a wider range of entities including the State in many respects, grants individuals enforceable rights, and creates a dedicated regulator with substantial penalty powers.