India DPDP Act Awareness Training

Asks whose personal data you saw at work today. Walks through the May 2021 Air India breach at SITA, which affected about four and a half million passengers, and the September 2024 Star Health case, where claim documents were offered through Telegram chatbots and the Madras High Court ordered access disabled. Draws three lessons: processors matter, speed matters, and health, financial and identity data hurt more when leaked. Introduces HIJ Fintech, a worked example of a Bengaluru payments and lending company with about four million users, and the four core ideas of the India DPDP Act: personal data, data fiduciaries, data principals and the Data Protection Board of India, which can impose penalties of up to 250 crore rupees. Shows a support agent sharing a screenshot on a personal chat app, sets out the course structure and exam, and clears away three common myths.

What you will be able to do

• Explain what the Air India and Star Health cases teach about processors, speed and sensitive data
• Define personal data, data fiduciary, data principal and the Data Protection Board
• Replace risky habits, such as screenshots on personal chat apps, with safe ones

Why it matters

Shows every employee why everyday handling of personal data matters under the DPDP Act, and how small habits decide whether a breach happens.

Practice: Practice: Why the DPDP Act matters to you · 3 questions

Opens with a manager at HIJ Fintech who says nothing needs to change because the law is not yet in force. Covers the Act's assent and publication on 11 August 2023 and then the Rules: draft Rules from the Ministry of Electronics and Information Technology on 3 January 2025 and the final DPDP Rules notified on 13 November 2025. Introduces the rules learners meet most often: rule 3 on notices, rule 6 on security safeguards, rule 7 on the 72-hour breach report, rule 8 on erasure, rule 10 on parental consent and rule 14 on rights. Explains the three phases from November 2025, November 2026 and May 2027, what already applies, the omission of section 43A of the IT Act, and the roles of the Board, the appellate tribunal and Consent Managers. A London online shop and a Singapore company show why planning backwards from the date matters.

What you will be able to do

• State the three phase dates of the DPDP Act and what applies in each one
• Describe what the DPDP Rules add, including rules 3, 6, 7 and 14
• Plan data mapping, notices, contracts, security and training backwards from May 2027

Why it matters

Gives teams in India and abroad a clear DPDP timeline, so preparation is steady rather than rushed and nobody waits for a law already on the way.

Practice: Practice: The Act, the Rules and the dates · 3 questions

Begins with scanned loan application forms from a Bengaluru loan fair left in a shared folder, showing that paper data becomes covered once digitised. Defines personal data, digital personal data and the wide meaning of processing, from collection to erasure. Sets out the three situations in section 3 where the Act applies, including processing abroad connected with offering goods or services in India, and the two exclusions for personal or domestic use and data made public by the person. Explains the data fiduciary, data processor, data principal and Consent Manager roles, the duties of a Significant Data Fiduciary, and the age of eighteen for a child. Contrasts the single definition with GDPR and Philippine sensitive categories. Covers the section 17 exemptions, with a Mumbai BPO serving a London bank, then applies the definitions to four quick cases at HIJ Fintech.

What you will be able to do

• Identify personal data and processing in everyday work, whatever the format
• Distinguish a data fiduciary, data processor, data principal and Consent Manager
• Explain the section 17 exemption for Indian outsourcing work and the duties that remain

Why it matters

Lets staff, including BPO teams handling overseas client data, tell quickly whether the Act covers a task and which role their company plays.

Practice: Practice: Who and what the Act covers · 3 questions

Starts with an old HIJ Fintech sign-up screen that used one pre-ticked box for loan processing and access to every phone contact. Explains section 4: processing only for a lawful purpose, on consent or a listed legitimate use. Sets out what a notice under section 5 and rule 3 contains, the choice of English or an Eighth Schedule language, and notices to people who consented before the Act. Lists the section 6 qualities of valid consent: free, specific, informed, unconditional, unambiguous and limited to necessary data, with the Act's telemedicine app and insurance waiver illustrations. Covers withdrawal, including the telecom billing and shopping app examples, Consent Managers registered from November 2026 with a net worth of at least two crore rupees, and the duty to prove notice and consent through logs. Ends with HIJ's redesigned screens and a Toronto company's bundled consent.

What you will be able to do

• List what a DPDP notice must contain and the language choices it must offer
• Assess whether a consent is free, specific, informed, unambiguous and limited to needs
• Design consent screens with separate choices, no pre-ticked boxes and proper logs

Why it matters

Helps product, marketing and support staff build consent flows that hold up before the Board, not bundled or pre-ticked consent that may not count.

Practice: Practice: Notice and consent · 3 questions

Starts with two messages HIJ Fintech wants to send one user: a text receipt she asked for, which is a legitimate use, and marketing offers, which need consent. Explains that section 7 is a closed list of nine uses with no general legitimate interests ground, and walks through each, from data provided voluntarily for a purpose to employment. Uses the Act's pharmacy receipt and real estate broker examples, maps HIJ's receipts, marketing, tax reporting and payroll to their grounds, and shows a Hong Kong employer going beyond employment purposes. Covers children under eighteen: verifiable parental consent under rule 10, no harm to well-being, and no tracking or targeted advertising, illustrated by a Tokyo game company. Explains guardians of persons with disability under rule 11, the rule 10 due diligence steps, the narrow exemptions for clinics, schools and safety, and HIJ's age checks at sign-up.

What you will be able to do

• Identify which of the nine section 7 legitimate uses fits a processing activity
• Describe verifiable parental consent and the bans on tracking and targeting children
• Recognise purpose creep and record the ground for every use of personal data

Why it matters

Helps teams record the right ground before using personal data and protect children's data, which matters most for apps, games and consumer services.

Practice: Practice: Legitimate uses and children's data · 3 questions

Opens with an HIJ Fintech analyst exporting every loan customer to a spreadsheet on his laptop, and the fix of masking, role-based access and working inside the secure system. Explains that the data fiduciary stays responsible for processing by its processors, which it may use only under a valid contract. Lists the rule 6 minimum safeguards: encryption, masking or tokens, access control, logging and monitoring, backups and security clauses in processor contracts, and the one-year log retention. Shows HIJ's role-by-role access and notes the 250 crore rupee maximum penalty for failing to take reasonable security safeguards. Covers accuracy, erasure when consent is withdrawn or the purpose ends, the three-year rule for large e-commerce, gaming and social media platforms with a 48-hour warning, the one-year minimum retention, and published contact details. Ends with everyday safeguards, a Frankfurt analytics processor without contract terms and three signs that safeguards work.

What you will be able to do

• List the minimum security safeguards that rule 6 of the DPDP Rules requires
• Explain why the data fiduciary stays responsible for what its processors do
• Apply the erasure and minimum retention rules to different kinds of personal data

Why it matters

Links daily habits to the DPDP duty with the largest penalty, so the organisation can show working safeguards and holds less data that could leak.

Practice: Practice: Keeping personal data safe · 3 questions

Begins on a Friday afternoon at HIJ Fintech, when a support agent e-mails one customer another customer's loan statement, and contrasts hiding the mistake with reporting it at once. Defines a breach widely, including accidental disclosure and loss of access through ransomware, and lists five common examples, from misdirected files to public storage links. Explains the duty to inform the Board and each affected data principal, the penalty of up to 200 crore rupees for failing to do so, what the intimation to individuals contains, and the two-stage report to the Board with the six items of the 72-hour report. Covers the processor's duty to tell the fiduciary fast, revisits the Air India and SITA delay, and sets out five steps when you notice a breach. Discusses a no-blame reporting culture, HIJ's breach timeline, a Sydney company's exposed staff spreadsheet and three signs of breach readiness.

What you will be able to do

• Recognise a personal data breach, including misdirected e-mails, lost devices and ransomware
• Explain what rule 7 requires in the intimation and the 72-hour report to the Board
• Follow the five steps to take when you notice a possible breach

Why it matters

Prepares fiduciary and processor staff to report a suspected breach within minutes, so the company can meet the 72-hour deadline to the Board.

Practice: Practice: Personal data breaches · 3 questions

Opens with an HIJ Fintech support agent who refuses a customer's question about what data is held and who it was shared with, then shows the better response of recognising and logging the rights request. Sets out the rights of access, correction and updating, erasure, grievance redressal and nomination, plus withdrawal of consent, and who may ask, including parents and lawful guardians. Explains each right, the exception for sharing with authorities, partial erasure where law requires records to be kept, the rule 14 duty to publish how to make requests and a grievance period of no more than 90 days, and nomination on death or incapacity. Walks through four typical HIJ requests, the duties of data principals with a penalty of up to 10,000 rupees, a fraud attempt that shows why identity checks matter, and a New York service that only accepts requests by post.

What you will be able to do

• Recognise access, correction, erasure, grievance and nomination requests in any words
• Handle an erasure request where the law requires some records to be kept
• Verify identity before sharing personal data in answer to a rights request

Why it matters

Equips customer-facing and HR staff to route rights requests correctly, answer on time and keep grievances from reaching the Data Protection Board.

Practice: Practice: Rights and duties of data principals · 3 questions

Compares one breach at two companies to show how conduct shapes the outcome. Describes the Board's constitution from 13 November 2025, member selection under rule 17, its digital way of working, six-month inquiries under rule 19, mediation and its section 27 functions and civil court powers. Follows an inquiry in five steps and a complaint's path from the company's grievance process to the Board, then the records that tell the story. Sets out the penalty Schedule: 250 crore rupees for security failures, 200 crore for breach notification and children's duties, 150 crore for significant data fiduciary duties and 50 crore for other breaches, with the section 33 factors, voluntary undertakings, appeals to the tribunal within 60 days and possible blocking. Covers significant data fiduciary duties under rule 13, a Singapore app company, six key points and the final exam.

What you will be able to do

• Describe how the Data Protection Board receives complaints and runs inquiries
• State the maximum penalties in the Schedule and the factors the Board weighs
• Apply safe habits when collecting, using, sharing and reporting problems with data

Why it matters

Shows how the Board decides penalties and what evidence it expects, so the organisation keeps the records that reduce its exposure.

Practice: Practice: The Board, penalties and your role · 3 questions