India DPDP Act Implementation Training

Starts with a readiness self-check, then two cases from before the Act applied: the 2021 Air India incident at its processor SITA, affecting about four and a half million passengers, and the September 2024 Star Health data offered through Telegram chatbots, with an interim injunction from the Madras High Court. Turns them into three design questions on processor breach reporting, a trusted data inventory and access logs kept for a year under rule 6. Introduces HIJ Fintech Private Limited, a worked example of a payments and lending app in Bengaluru with about four million users and five main processors, its starting gaps and how its programme team splits the work. Summarises what the Act asks of a data fiduciary in eight areas, why to start before May 2027, the course structure, six practice exercises, the exam, and three myths about privacy policies, IT ownership and consent.

What you will be able to do

• Explain what the DPDP Act and Rules ask of a data fiduciary across its main duty areas
• Identify three programme design questions drawn from the Air India and Star Health cases
• Distinguish common myths about DPDP compliance from what the Act and Rules require

Why it matters

Gives DPOs and compliance leads a clear picture of the work ahead and why to start now, so the programme is built in order before May 2027.

Practice: Practice: Why implement, and how this course works · 3 questions

Opens with an HIJ board meeting where a vague answer on dates loses a budget and a precise one wins it. Covers the Act, number twenty-two of 2023 with assent on 11 August 2023, its nine chapters and Schedule of penalties, and the Rules notified on 13 November 2025 with twenty-three rules and seven Schedules. Sets out the three phases: the Board and definitions from 13 November 2025, Consent Manager registration from 13 November 2026, and duties, rights and penalties from 13 May 2027. Explains phase one changes to the TRAI Act and RTI Act, the omission of section 43A of the IT Act, section 38 on other laws, and government powers under sections 17, 36 and 40. Covers appeals to TDSAT, the 2026 consultation on shortening the period, and HIJ's backward plan by workstream, contrasted with a company in London running one late sprint.

What you will be able to do

• Explain which DPDP provisions and rules apply from November 2025, November 2026 and May 2027
• Describe how the Act sits alongside other laws, including section 43A of the IT Act
• Plan a DPDP programme backwards from May 2027 in dated workstreams with named owners

Why it matters

Gives the precise dates and order of work that win board budgets, so the programme is staged sensibly and no duty under older or newer rules is missed.

Practice: Practice: The legal framework and the phased dates · 3 questions

Begins with three HIJ teams asking scope questions about paper loan forms, users abroad and public profile data, answered once in a scope register. Explains personal data, digital personal data and processing, and why paper records fall outside until digitised. Covers the three ways section 3 brings processing into the Act, tests the outside-India rule against four situations, and explains the exclusions for personal or domestic use and data made public, with care on the public data exclusion. Sets out the section 17(1) exemptions and the two duties that remain, responsibility and security safeguards, and further exemptions for notified State bodies, research under rule 16 and the Second Schedule, and notified classes such as startups. Shows HIJ's scope register, a software company in Singapore reached through its contracts, four steps to build the register, commonly forgotten processing and the mistake of reading exemptions as complete.

What you will be able to do

• Apply the section 3 tests to decide whether processing in or outside India is in scope
• Identify which duties a section 17 exemption removes and which, including security, remain
• Build a scope register that records each answer with its section, owner and review date

Why it matters

Settles scope once, in writing, so teams give consistent answers and no duty, especially security on exempt work, is dropped by accident.

Practice: Practice: Scope, reach and exemptions · 3 questions

Opens with an SMS complaint at HIJ that one manager tried to pass to the gateway, and shows why HIJ, which decided the message, is the data fiduciary. Defines data fiduciary, the wide meaning of person, data processor under a valid contract, and data principal, including parents of children and guardians of persons with disability. Introduces Consent Managers, Significant Data Fiduciaries under section 10 and the DPO, and the published contact person other fiduciaries need. Gives four questions for assigning roles, explains section 8(1) responsibility irrespective of any agreement, and the extra duties of a Significant Data Fiduciary. Covers internal accountability from board to activity owners, HIJ's roles map for payments, loan sourcing with a partner lender, support and collections, and how to split work between two fiduciaries. Uses an insurer in London and a broker that is also a fiduciary, four steps for a roles map.

What you will be able to do

• Distinguish a data fiduciary from a data processor using four questions about each activity
• Explain why section 8(1) keeps the fiduciary responsible whatever a contract says
• Build a roles map that matches every processing activity and contract to the right role

Why it matters

Gives every DPDP duty a clear home, so complaints, notices and rights requests are not lost between the organisation, its suppliers and partners.

Practice: Practice: Roles and accountability · 3 questions

Contrasts a team that starts with tasks and no plan with one where the board names owners and measures gaps first. Explains section 8(4) technical and organisational measures as the legal basis for a managed programme, and a governance structure from board and programme owner to steering group, activity owners and the contact person. Covers rule 9 published business contact information, and grievance redress under section 8(10) with rule 14(3), where the published response period is not more than ninety days. Describes the policy, procedures and risk method, then a five-step gap assessment drawing on documents, records, interviews and tests. Shows HIJ's gap register for notices, contact details, breach intimation and erasure, with dates before 13 May 2027, an online retailer in Toronto reusing its Canadian programme, a high, medium and low rating method, a three-question board report and a gap assessment practice exercise.

What you will be able to do

• Set up a DPDP governance structure with a board, programme owner and published rule 9 contact
• Run a five-step gap assessment that checks evidence, not just whether documents exist
• Write a rated, dated action plan and board report that works back from 13 May 2027

Why it matters

Gives the board a true picture of how far the organisation is from DPDP compliance, with a backed plan, owners and dates instead of scattered effort.

Practice: Practice: Governance and the gap assessment · 3 questions

Begins with an access request at HIJ answered incompletely without an inventory and fully with one. Shows how rule 3 notices, section 4 grounds, section 8(5) security, section 8(7) and rule 8 erasure and section 11 access all depend on knowing what data is held. Lists HIJ's groups of data principals, then the seven fields of an entry using the loan application: activity and owner, data items, purpose and ground, systems and recipients, data principals including children, retention and erasure trigger, and security and location. Sets out five steps to build the inventory, data often missed such as exported spreadsheets, e-mail attachments and test databases, and four short HIJ entries. Introduces consent and section 7 legitimate uses, a software firm in Sydney that listed databases without purposes, three tests for enough detail, spreadsheet or tool, three update triggers and a practice exercise writing five entries.

What you will be able to do

• Build a personal data inventory entry with the seven fields needed for notices, erasure and rights
• Find personal data held outside main systems, such as exports, attachments and test copies
• Keep the inventory current through release checks, supplier onboarding and a yearly review

Why it matters

Lets the organisation find every copy of personal data, so rights requests are answered fully and notices, security and erasure rest on facts.

Practice: Practice: The personal data inventory · 3 questions

Opens with HIJ's old sign-up screen, one checkbox for everything, and the new approach of one ground per purpose. Explains section 4, lawful purpose and why there is no third ground, then the section 6 consent test with the Act's telemedicine app illustration. Walks through every clause of section 7, with care on clause a, data voluntarily provided for a specified purpose, using the pharmacy receipt and flat broker illustrations, and clause i for employment. Gives four steps to choose a ground and HIJ's grounds register for account opening, SMS receipts, payroll and marketing. Uses a travel platform in Dubai that stretched clause a to marketing, and explains that section 7 is a closed list. Covers section 6(2) and the insurance app illustration, withdrawal and objection, when to retest grounds, and the mistake of asking staff to consent to payroll.

What you will be able to do

• Distinguish consent under section 6 from the closed list of legitimate uses in section 7
• Test a purpose against each section 7 clause, including all of its conditions
• Record one ground, the clause and the reason for each purpose in a grounds register

Why it matters

Ensures every purpose has a ground that holds when tested, so consent is asked for only where there is a real choice and legitimate uses are not stretched.

Practice: Practice: Lawful grounds: consent or legitimate uses · 3 questions

Starts with HIJ replacing a twenty-page sign-up policy with a one-screen notice users can understand. Explains when a notice is needed under section 5(1), with the Act's video identity check illustration, and what section 5 requires. Covers rule 3: a notice understandable independently of other information, an itemised description of data, specified purposes with goods or services, and links to withdraw consent with comparable ease, exercise rights and complain to the Board. Explains English or Eighth Schedule language options and HIJ's six languages, notices for people who consented before the Act under section 5(2), and where notices must appear, from app screens to call scripts and paper forms. Distinguishes the notice from the privacy policy, shows HIJ's loan application notice, five writing steps, a streaming service in New York adding an Indian layer, version control, the category mistake, records under section 6(10) and a notice-writing exercise.

What you will be able to do

• Write a notice that stands alone, itemises each data item and states specific purposes
• Include the rule 3 routes to withdraw consent, exercise rights and complain to the Board
• Plan notices for existing users who consented before the Act came into force

Why it matters

Produces notices customers actually understand, so consent is informed and specific, and the organisation can show which version each person saw.

Practice: Practice: Notices that meet section 5 and rule 3 · 3 questions

Opens with a customer who denies agreeing to share data with a partner lender, and why section 6(10) puts the onus of showing notice and consent on the fiduciary. Sets out the six qualities of valid consent and how pushy screen designs undermine them, then four design choices: unticked boxes per purpose, optional uses kept separate, only necessary data, and plain language. Covers withdrawal with ease comparable to giving consent, its forward-looking effect under section 6(5), ceasing processing under section 6(6) with the telecom billing illustration, and erasure under section 8(7). Gives a five-step withdrawal flow, the fields of a consent record, HIJ's consent design purpose by purpose, consent through a Consent Manager, and when to ask again. Uses an e-commerce platform in Hong Kong that required a written letter to withdraw, the mistake of withdrawal not reaching marketing tools and processors.

What you will be able to do

• Design consent screens that meet the six qualities of valid consent under section 6(1)
• Build a withdrawal flow that stops processing in every system and at every processor
• Keep consent records showing who agreed, when, after which notice version and for which purpose

Why it matters

Lets the fiduciary prove valid consent in minutes if challenged, and ensures that a withdrawal really stops processing everywhere, including at processors.

Practice: Practice: Valid consent, withdrawal and consent records · 3 questions

Begins with a withdrawal made through a Consent Manager platform that HIJ is not connected to, so processing wrongly continues. Defines a Consent Manager under section 2(g) and the three rules in section 6(7) to 6(9). Sets out Part A conditions in the First Schedule, including a company incorporated in India with net worth of at least two crore rupees and an independently assessed platform, and how the Board registers applicants and publishes them under rule 4. Covers Part B duties: not reading the data shared, keeping records for at least seven years, conflicts of interest, disclosure of shareholders above two per cent and audits. Walks through the First Schedule bank statement example, HIJ's preparation plan, direct and platform routes compared, three onboarding checks, and a payments group in Frankfurt whose separate records disagreed. Covers grievance, complaints and Board powers over Consent Managers and the mistake of waiting.

What you will be able to do

• Explain what a Consent Manager is and the main registration conditions and duties
• Check that a Consent Manager platform is registered before connecting to it
• Design one consent record that accepts consents and withdrawals from any route

Why it matters

Readies the organisation for consent and withdrawals arriving through registered platforms, so no withdrawal is missed and one record stays true.

Practice: Practice: Consent Managers · 3 questions

Opens with HIJ's family wallet, first designed so anyone could claim to be a parent, then redesigned to check an identifiable adult first. Explains that a child is anyone under eighteen, how parents and lawful guardians act as data principals, and the three section 9 duties: verifiable consent, no detrimental processing, and no tracking, behavioural monitoring or targeted advertising, with penalties of up to two hundred crore rupees. Walks through rule 10 verification using details already held, issued details or a virtual token and its four cases. Covers rule 11 checks of guardian appointments under the Rights of Persons with Disabilities Act, 2016 or the National Trust Act, 1999, and the Fourth Schedule classes and purposes exempt under rule 12. Shows harmful and protective designs, five product steps, HIJ's family wallet, a games studio in Tokyo switching off targeted advertising for under-eighteens, and the tick-box mistake.

What you will be able to do

• Apply the rule 10 methods to verify that a parent is an identifiable adult before processing
• Identify the Fourth Schedule exemptions and the strict conditions each one carries
• Switch off tracking, behavioural monitoring and targeted advertising for accounts of children

Why it matters

Builds child protection into products, avoiding unverifiable parental consent and targeted advertising, with penalties of up to two hundred crore rupees.

Practice: Practice: Children and persons with disability · 3 questions

Starts with the September 2024 Star Health case, where customer data was offered through Telegram chatbots, to show why rule 6 asks fiduciaries to know who accessed data. Explains the section 8(5) duty to take reasonable security safeguards, including at processors, with the highest penalty in the Schedule of up to two hundred and fifty crore rupees. Introduces the seven minimum safeguards of rule 6(1), four questions for deciding what is reasonable, and frameworks such as ISO/IEC 27001 as optional. Covers clause a with HIJ's tokenised bank account numbers, encrypted and masked identity documents and masked test data, clause b access control with five habits, and clause c visibility through logs, alerts and review. Explains the one-year retention of logs under clause e, checking safeguards at a support centre, an analytics firm in London ending shared logins, the mistake of unreviewed logs.

What you will be able to do

• Apply encryption, masking or virtual tokens to personal data in line with its risk
• Set role-based access with multi-factor authentication, quarterly reviews and same-day removal
• Configure logs, alerts and reviews that show who accessed which data, kept for one year

Why it matters

Reduces the chance and impact of a breach under the duty with the Act's highest penalty, and leaves evidence of the safeguards actually in place.

Practice: Practice: Security safeguards, part 1 · 3 questions

Opens with a ransomware attack on a Monday morning, comparing untested backups that fail with restores practised every quarter. Explains rule 6 clause d on continued processing after compromise, and why loss of access is a personal data breach under section 2(u) that may need intimation under rule 7. Gives five steps for continuity. Covers clause e one-year retention alongside erasure, clause f security terms in processor contracts with HIJ's standard terms and a short due diligence process, and clause g measures: policy, role-based training, outside testing and board reports. Shows security review of changes, an owner for every rule 6 clause, and HIJ's restore test record for its loan database, restored in three hours against a four-hour target. Uses a cloud provider in Singapore that agreed breach notice within hours, and the mistake of leaving security only to IT.

What you will be able to do

• Build tested backups and a recovery plan that support continued processing after a compromise
• Write security terms for processor contracts, backed by due diligence before signing
• Assign an owner to every clause of rule 6 and report safeguards to the board

Why it matters

Means services recover in hours, not days, after an incident, and processors are bound to safeguards that let the fiduciary meet rule 7 breach timings.

Practice: Practice: Security safeguards, part 2 · 3 questions

Contrasts the first hour of a breach in an unprepared organisation with one that has an on-call lead, a written plan and templates. Defines a personal data breach under section 2(u) and tests it on four events. Explains that section 8(6) applies to every breach with no threshold, with a penalty of up to two hundred crore rupees for failing to intimate, and previews the rule 7 timings. Sets out the breach team, the six-step plan of detect, assess, contain, intimate, fix and learn, and preserving evidence and logs. Covers deciding when the fiduciary is aware, other reporting duties, HIJ's templates, processor clauses and breach register, drills every six months, and a sample register entry. Uses a payroll provider in Sydney that learned to report on suspicion, and the mistake of planning only for large attacks.

What you will be able to do

• Identify a personal data breach using section 2(u), including misdirected e-mails and ransomware
• Set up a breach team with deputies, an on-call rota and a six-step breach plan
• Run timed breach drills and keep a register that records every event and decision

Why it matters

Ensures the right people act in the first hour of any breach, large or small, so evidence is kept and the rule 7 intimations can be met on time.

Practice: Practice: Breach readiness · 3 questions

Contrasts an organisation that waits a week to send one vague message with one that tells early and then fully. Sets out rule 7(1): what each affected data principal must be told, without delay and through her account or registered contact. Explains rule 7(2): the first intimation to the Board without delay, and detailed information within seventy-two hours of awareness or longer if the Board allows it in writing. Gives an hour-by-hour timeline, Board powers under section 27(1)(a), and why the fiduciary, not the processor, owns intimation under section 8(6). Covers the Board's digital office under section 28(1) and rule 20, then HIJ's handling of a misdirected loan statement. Uses a travel booking site in Hong Kong with a vague message, the mistake of waiting for certainty, and a practice exercise planning a rule 7 timeline.

What you will be able to do

• Write a breach message to affected people that covers every item rule 7(1) lists
• Prepare the first intimation and the detailed seventy-two-hour report to the Board
• Plan a rule 7 timeline from the recorded time of awareness to the post-breach review

Why it matters

Lets the organisation tell affected people and the Data Protection Board early and fully, keeping trust and avoiding the penalty for failing to intimate.

Practice: Practice: Breach intimation under rule 7 · 3 questions

Begins with HIJ finding loan applications kept since the company started, including incomplete ones, and moving to a period and erasure trigger for each record. Explains section 8(3) accuracy where data shapes decisions or goes to another fiduciary, with four habits such as checking income at source and passing corrections to lenders. Covers erasure under section 8(7) with the car sale and ten-year bank illustrations, the deemed end of purpose in sections 8(8) and 8(11), and the Third Schedule classes with a three-year inactivity period and a forty-eight-hour warning under rule 8. Explains the one-year minimum for data and logs under rule 8(3) with the e-book illustration, and how minimum and maximum work together. Shows HIJ's retention schedule, why it is not a Third Schedule class, how erasure runs, legal holds, a sample schedule entry, an online marketplace in New York, and the mistake of forgetting copies.

What you will be able to do

• Set retention periods between the rule 8 one-year minimum and erasure when the purpose ends
• Identify whether a platform falls in a Third Schedule class with a three-year inactivity rule
• Run erasure across every system, export and processor, with job logs as evidence

Why it matters

Cuts the data the organisation holds to what a purpose or law needs, reducing breach exposure while showing data was kept no longer than allowed.

Practice: Practice: Accuracy, retention and erasure · 3 questions

Opens with an access request lost in HIJ's general support queue, and the new single route with an identity check and an answer built from the inventory. Explains who holds the rights, those who gave consent or voluntarily provided data under section 7(a), and why staff data under clause i may be handled as good practice. Covers the section 11 access right to a summary, recipients and other prescribed information, the section 11(2) exception for sharing with authorised bodies, section 12 correction, completion and updating, and erasure under section 12(3) unless the purpose or a law needs the data. Sets out rule 14 publishing of request means and identifiers, rule 9 contacts in replies, a five-step procedure and a fifteen-day target. Shows HIJ's access reply and request file, a subscription service in Toronto sending raw tables, section 15 duties and the mistake of demanding identity documents.

What you will be able to do

• Explain the access, correction and erasure rights in sections 11 and 12 and who holds them
• Publish request routes and identifiers under rule 14, and verify identity without excess data
• Answer access requests with a plain summary of data, processing and every recipient

Why it matters

Turns scattered customer requests into one tracked process with complete answers on time, avoiding grievances and complaints to the Data Protection Board.

Practice: Practice: Rights: access, correction and erasure · 3 questions

Begins with a customer who kept receiving offers after withdrawing consent, passed from team to team until she went to the Board. Explains the section 13(1) right, the section 8(10) duty and the rule 14(3) published period, and why she must exhaust the fiduciary's process before approaching the Board. Separates grievances from rights requests, lists what a reply should contain, with a six-step procedure. Covers section 14 nomination on death or incapacity, HIJ's nomination screen, and the five data principal duties in section 15. Explains rule 9 contacts, internal escalation to the data protection lead and board, and a grievance log entry answered on day nine of a thirty-day period. Uses an airline in Dubai mixing data grievances with baggage claims, the mistake of treating ninety days as the target, and a practice exercise writing a rights and grievance procedure.

What you will be able to do

• Set up a grievance procedure that answers within a published period of no more than ninety days
• Distinguish a grievance under section 13 from a rights request under sections 11 and 12
• Build a nomination route under section 14 with verification on death or incapacity

Why it matters

Resolves complaints at source, within a period the organisation can meet, so fewer reach the Board and customers trust how their data is handled.

Practice: Practice: Grievances, nomination, duties and contacts · 3 questions

Opens with HIJ's review of five processor contracts that covered price and service levels but no security, breach reporting or erasure. Sets out the four rules in section 8 on responsibility, valid contracts, safeguards at processors and erasure, and how the role decides between a processor contract and a data-sharing agreement. Lists the core contract terms, from instructions and rule 6 safeguards to breach notice, erasure and one-year logs under rule 8(3). Covers sub-processor approval, five onboarding steps, oversight by risk and HIJ's processor list with risk ratings. Explains updating old contracts by addendum, signed at HIJ by March 2027, habits for organisations that are processors themselves, and HIJ's data schedule with its support centre. Uses a support provider in Singapore whose agents pasted chats into an outside tool, exit terms and the mistake of never checking signed terms.

What you will be able to do

• Write a processor contract with instructions, rule 6 security, breach notice, erasure and checks
• Bring older processor contracts up to date through an addendum, riskiest processors first
• Set oversight of processors by risk, using reports, questionnaires, reviews and erasure confirmations

Why it matters

Carries the Act's duties to every processor, so the fiduciary, which stays responsible, can show it chose, contracted and checked each one.

Practice: Practice: Data processors and contracts · 3 questions

Starts with HIJ unable to say where its data went, with analytics, e-mail and support tools all sending data abroad. Explains section 16(1), which allows transfers unless the government restricts them by notification, and section 16(2), which keeps stricter laws such as sector rules. Covers rule 15 requirements on making data available to a foreign State, rule 13(4) on specified data of Significant Data Fiduciaries staying in India, section 38 on other laws. Lists transfers often missed: remote access from abroad, software services, backups in other regions and support tools. Shows a transfer register entry and HIJ's decisions, and four steps to respond to a notification. Separates outbound and inbound processing, walks through a register entry, a software vendor in London adding an India region, and the mistake of checking only the Act.

What you will be able to do

• Build a transfer register listing each cross-border flow, its country, data, contract and owner
• Identify sector rules and government orders that restrict transfers beyond section 16
• Plan the four steps to respond if a transfer restriction is notified under section 16

Why it matters

Lets the organisation see every flow leaving India and adapt quickly if a restriction is notified, without breaching sector rules that keep data in India.

Practice: Practice: Transfers outside India and other laws · 3 questions

Contrasts a fast-growing fintech notified as significant with no DPO, auditor or impact assessment against one that prepared. Explains the section 10(1) notification factors, such as volume, sensitivity and risk to rights, with no notification recorded so far. Sets out the three extra duties and the penalty of up to one hundred and fifty crore rupees, and HIJ's self-assessment against the factors. Covers the four DPO conditions, the DPIA as a process about risk to people, and rule 13's yearly assessment and audit, reports to the Board, due diligence on algorithmic software and localisation of specified data. Distinguishes the rule 9 contact person from a DPO, gives a six-step DPIA method and walks through HIJ's voluntary DPIA on its credit scoring model. Uses a social platform in Tokyo relying on a global privacy head abroad, and the mistake of waiting to be named.

What you will be able to do

• Assess the organisation against the section 10 factors for notification as a Significant Data Fiduciary
• Run a six-step data protection impact assessment focused on risk to data principals
• Distinguish the rule 9 contact person from a DPO who meets the section 10 conditions

Why it matters

Prepares large fiduciaries in proportion to the chance of being named, so a notification does not trigger a scramble for a DPO, auditor and DPIA.

Practice: Practice: Significant Data Fiduciaries · 3 questions

Begins with a Board notice after a customer complaint about a breach, comparing scattered records with a prepared response led by a named owner. Covers the Board under sections 18 to 20, established on 13 November 2025, and appointments through the rule 17 selection committees. Lists what starts a case under section 27(1), from breach intimations and complaints to government references, court directions and Consent Manager matters, and the Board's power to give directions. Walks through a section 28 inquiry with natural justice, a hearing, civil court powers and limits, the six-month target in rule 19(9), and the digital office under rule 20. Shows HIJ's response pack and evidence index, and five habits when a notice arrives. Uses an online retailer in Frankfurt sending documents piecemeal and the mistake of treating the Board as an opponent.

What you will be able to do

• Identify the events that can start a case before the Board under section 27(1)
• Explain how a section 28 inquiry runs, including hearings, powers and the six-month target
• Build an evidence index and response pack ready for a notice from the Board

Why it matters

Means the organisation can answer a Board notice fully and on time with indexed evidence, building trust and shortening any inquiry.

Practice: Practice: The Data Protection Board and inquiries · 3 questions

Compares two organisations with the same breach, one with weak security that hid it and one that reported and fixed it fast, under the section 33 factors. Lists the Schedule's maximum penalties: up to two hundred and fifty crore rupees for security safeguards, two hundred crore for breach intimation and for children's duties, one hundred and fifty crore for significant fiduciary duties and fifty crore for other breaches. Explains section 33(1) and the factors in section 33(2), voluntary undertakings under section 32, and mediation under section 31. Covers appeals to TDSAT within sixty days, filed digitally under rule 22. Shows how HIJ ranked its gap plan using the Schedule and keeps a mitigation timeline for an unusual data export. Uses a lender in Hong Kong that offered an undertaking on notices, and the mistake of reading the Schedule as a price list.

What you will be able to do

• Explain the maximum penalties in the Schedule and which duties carry the largest amounts
• Identify the section 33 factors the Board weighs, including mitigation and repetition
• Keep a mitigation timeline for each breach, with times taken from the logs

Why it matters

Helps the organisation rank its gaps by risk and respond to a breach in ways the Board weighs in its favour, rather than budgeting for penalties.

Practice: Practice: Penalties, undertakings and appeals · 3 questions

Begins with HIJ halfway through its programme, with policies on shared drives and records in inboxes, and moves to a controlled set with an index. Explains why records are the evidence of the programme, with section 6(10) on showing notice and consent. Lists the documents in direction and design, from the board-approved policy, registers, inventory and notices, to procedures for consent, children, security, breaches, retention, rights, grievances, processors and transfers. Names the four public-facing items under rules 3, 9, 14(1) and 14(3), and the records that show what happened, from consent records and one-year logs to breach, request and grievance logs. Covers document control, the evidence index organised by section and rule, four HIJ index lines and five build steps. Walks through a policy control sheet and change log, a health app in Sydney with unused pages, and the mistake of keeping no records.

What you will be able to do

• List the documents and records a DPDP programme needs for each duty in the Act and Rules
• Apply document control with an owner, version, approval and review date for each document
• Build an evidence index that leads from any section or rule to its evidence in one step

Why it matters

Lets the organisation show its whole DPDP programme in minutes, with versions and records that answer what applied on any date and who approved it.

Practice: Practice: The documentation set · 3 questions

Contrasts an organisation that builds its programme for May 2027 and moves on with one that runs it with measures, training and reviews. Explains section 8(4) and rule 6 clause g, and the outcome measures HIJ tracks, such as rights requests answered within fifteen days and grievances within thirty. Sets out training by role at joining and every year, then a five-step internal review by someone independent of the work. Gives four sample tests from HIJ's review plan, board oversight through quarterly reports, monthly checks by the data protection lead, and reading complaints for patterns. Covers watching for changes in law, Board guidance, business and threats, handling gaps that cannot be fixed at once, and the improvement loop. Walks through a quarterly board report, a logistics firm in Dubai that trained staff only once, and the mistake of measuring effort instead of results.

What you will be able to do

• Choose outcome measures, such as requests answered on time, rather than counts of activity
• Plan training by role for the board, product, support and all staff, at joining and yearly
• Run an independent internal review using samples, with findings fixed and closed on evidence

Why it matters

Keeps the programme working after May 2027, so gaps are found and fixed before they harm anyone, with board decisions on record.

Practice: Practice: Monitoring, training and internal review · 3 questions

Opens with two plans at HIJ: twenty workstreams starting in one week, or phased work with the highest risks first. Restates the dates from rule 1: the Board rules from 13 November 2025, rule 4 from 13 November 2026 and most duties from 13 May 2027. Gives four sequencing rules, then a four-phase road map: mobilise, protect, inform and respond, and prove and run. Covers the people, budget, tools and legal advice behind it, quick wins such as publishing the rule 9 contact, naming a breach lead and removing pre-ticked boxes, and an extra track for possible significant fiduciaries. Shows HIJ's one-page road map and its readiness check planned for early May 2027. Uses a bank in London whose group calendar missed the Indian dates, warns against treating the date as an end, and closes with a road map practice exercise.

What you will be able to do

• Sequence DPDP work by harm, foundations and long lead items across four dated phases
• Identify quick wins that reduce risk now, such as removing pre-ticked consent boxes
• Plan a readiness check before 13 May 2027 that tests every published item and process

Why it matters

Gives a plan the board can back and track, so the organisation is ready on 13 May 2027 and keeps running the programme after the date.

Practice: Practice: Your road map to May 2027 · 3 questions