Test your team's expertise across 40 curated statutory questions covering foundational concepts, operational obligations, Significant Data Fiduciaries (SDF), and judicial precedents.
Score: 0 / 40
Answered: 0
basicDefinitions & Scope
Section 2(i)
Q1. Under DPDPA 2023, what is the official term for an entity that determines the purpose and means of processing personal data?
Statutory Explanation (Section 2(i)):
Section 2(i) of the DPDPA 2023 defines a "Data Fiduciary" as any person who alone or in conjunction with other persons determines the purpose and means of processing personal data.
basicNotice & Multilingual Mandate
Section 5(3)
Q2. In how many scheduled Indian languages must a Data Fiduciary provide the option to access the Privacy Notice and Consent request?
Statutory Explanation (Section 5(3)):
Section 5(3) mandates that the Data Principal shall have the option to access the notice and consent request in English or any language specified in the Eighth Schedule to the Constitution (22 scheduled languages).
basicPenalties & Liabilities
Schedule & Section 33
Q3. What is the maximum monetary penalty that can be imposed by the Data Protection Board of India (DPBI) for failure to take reasonable security safeguards to prevent a personal data breach?
Statutory Explanation (Schedule & Section 33):
Under the Schedule to DPDPA 2023 (read with Section 33), failure to maintain reasonable security safeguards to prevent personal data breaches carries a penalty of up to ₹250 Crore.
basicChildren Data Protection
Section 2(f) & Section 9
Q4. Under Section 9 of the DPDPA 2023, what age threshold defines a "child"?
Statutory Explanation (Section 2(f) & Section 9):
Section 2(f) defines a child as an individual who has not completed eighteen years of age. All processing of minor data requires verifiable parental consent.
basicConsent Architecture
Section 6(7) & Section 2(g)
Q5. What is a "Consent Manager" under Section 6(7) of the DPDPA 2023?
Statutory Explanation (Section 6(7) & Section 2(g)):
A Consent Manager is an interoperable entity registered with the DPBI that provides Data Principals a centralized dashboard to give, manage, review, and withdraw consent across multiple Data Fiduciaries.
basicApplicability & Exclusions
Section 3(c)(i)
Q6. Does DPDPA 2023 apply to personal data processed by an individual for personal or domestic purposes?
Statutory Explanation (Section 3(c)(i)):
Section 3(c)(i) explicitly states that DPDPA 2023 does not apply to personal data processed by an individual for any personal or domestic purpose.
basicPublicly Available Data
Section 3(c)(ii)
Q7. Does DPDPA 2023 apply to personal data made publicly available by the Data Principal themselves?
Statutory Explanation (Section 3(c)(ii)):
Section 3(c)(ii) provides that the Act does not apply to personal data made publicly available by the Data Principal to whom such personal data relates, or any other person under legal obligation.
basicTerritorial Scope
Section 3(b)
Q8. Does DPDPA 2023 apply to foreign companies located outside India?
Statutory Explanation (Section 3(b)):
Section 3(b) gives DPDPA extraterritorial jurisdiction over processing of digital personal data outside India if such processing is in connection with any activity related to offering goods or services to Data Principals within India.
basicDigital Formats
Section 3(a)
Q9. Which form of personal data does the DPDPA 2023 govern?
Statutory Explanation (Section 3(a)):
Section 3(a) applies to digital personal data collected in digital form or personal data collected in non-digital form and digitized subsequently.
basicConsent Withdrawal
Section 6(4)
Q10. Under Section 6(4), what is the statutory ease requirement for withdrawing consent?
Statutory Explanation (Section 6(4)):
Section 6(4) specifies that the Data Principal shall have the right to withdraw consent at any time, with the ease of doing so being comparable to the ease with which such consent was given.
intermediateBreach Reporting SLA
Section 8(6)
Q11. When a personal data breach occurs, whom must the Data Fiduciary notify under Section 8(6)?
Statutory Explanation (Section 8(6)):
Section 8(6) mandates that in the event of a personal data breach, the Data Fiduciary shall give the Data Protection Board of India and each affected Data Principal intimation of such breach in such form and manner as prescribed.
intermediateUnbundled Consent & Dark Patterns
Section 6(1)
Q12. Can a service provider bundle terms of service with marketing consent using a pre-ticked checkbox?
Statutory Explanation (Section 6(1)):
Section 6(1) and Section 6(2) prohibit bundled consent and pre-ticked checkboxes. Consent must be granular and unbundled from core service contracts.
intermediateNominee Rights
Section 14
Q13. Which statutory right allows Data Principals to designate another individual to exercise their privacy rights in the event of death or incapacity?
Statutory Explanation (Section 14):
Section 14 grants Data Principals the Right to Nominate any other individual who shall, in the event of death or incapacity of the Data Principal, exercise their statutory rights under DPDPA.
intermediateData Erasure Triggers
Section 8(7)
Q14. Under Section 8(7) and Section 12(3), when MUST a Data Fiduciary erase personal data?
Statutory Explanation (Section 8(7)):
Section 8(7) establishes the Purpose Fulfillment Erasure mandate: data must be erased once the purpose is served unless retention is mandated under another Indian statute.
intermediateProcessor Agreements
Section 8(2)
Q15. If a Data Fiduciary engages an external Data Processor (e.g. AWS, SendGrid, Zoho), what is required under Section 8(2)?
Statutory Explanation (Section 8(2)):
Section 8(2) specifies that a Data Fiduciary may engage, appoint, use or involve a Data Processor only under a valid contract to process personal data on its behalf.
intermediateGrievance Redressal SLA
Section 13(2)
Q16. Under Section 13, before a Data Principal can approach the DPBI with a complaint, what must they do first?
Statutory Explanation (Section 13(2)):
Section 13(2) mandates that the Data Principal must first exhaust the opportunity of redressal provided by the Data Fiduciary before filing a complaint before the Data Protection Board.
intermediateData Principal Duties
Section 15(a)
Q17. What statutory duty is imposed on Data Principals under Section 15(a) when exercising rights?
Statutory Explanation (Section 15(a)):
Section 15(a) provides that a Data Principal shall not impersonate another person while providing personal data for a specified purpose.
intermediateFrivolous Grievances Penalty
Schedule Item 5
Q18. What is the maximum monetary penalty on a Data Principal for registering a false or frivolous grievance under Section 15 and Schedule Item 5?
Statutory Explanation (Schedule Item 5):
Item 5 of the Schedule to DPDPA 2023 specifies a penalty of up to ₹10,000 for breach in observance of the duties of a Data Principal under Section 15.
intermediateChildren Behavioral Advertising Ban
Section 9(3)
Q19. Under Section 9(3), what specific advertising activity is strictly prohibited regarding children?
Statutory Explanation (Section 9(3)):
Section 9(3) explicitly prohibits Data Fiduciaries from undertaking tracking, behavioral monitoring, or targeted advertising directed at children.
intermediateNotice Details
Section 5(1)
Q20. Which of the following MUST be included in the Section 5(1) itemized Privacy Notice?
Statutory Explanation (Section 5(1)):
Section 5(1) mandates disclosing the personal data categories, specific purposes, the manner of exercising rights under Sections 11–14, and how to file complaints with the DPO and DPBI.
advancedSignificant Data Fiduciaries (SDF)
Section 10
Q21. Which extra statutory obligations apply to Significant Data Fiduciaries (SDFs) designated under Section 10 of DPDPA 2023?
Statutory Explanation (Section 10):
Section 10 requires an SDF to: (1) Appoint a DPO based in India, (2) Appoint an independent Data Auditor, (3) Undertake periodic DPIAs, and (4) Implement measures to ensure data integrity.
advancedLegitimate Uses (Section 7)
Section 7
Q22. Which of the following is NOT a recognized "Certain Legitimate Use" under Section 7 where consent is not required?
Statutory Explanation (Section 7):
Commercial marketing is NOT an exempt legitimate use under Section 7. Section 7 covers specified voluntary submissions, state subsidies/services, medical emergencies, epidemics, disasters, and employment.
advancedCross-Border Transfers
Section 16
Q23. What is India statutory framework for cross-border personal data transfers under Section 16 of DPDPA 2023?
Statutory Explanation (Section 16):
Section 16(1) adopts a negative list ("Blacklist") model where the Central Government may notify countries or territories to which a Data Fiduciary shall not transfer personal data.
advancedAppellate Tribunal (TDSAT)
Section 29
Q24. Which judicial appellate tribunal hears appeals against orders and penalty decisions of the Data Protection Board of India (DPBI)?
Statutory Explanation (Section 29):
Section 29 specifies that any person aggrieved by an order or direction made by the Board may prefer an appeal to the Appellate Tribunal, which is designated as the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
advancedVoluntary Undertakings
Section 32
Q25. Can the Data Protection Board of India accept a Voluntary Undertaking from a Data Fiduciary facing proceedings under Section 32?
Statutory Explanation (Section 32):
Section 32 empowers the DPBI to accept a voluntary undertaking from an entity regarding compliance, which halts ongoing proceedings provided the terms of the undertaking are observed.
advancedGovernment Exemption Powers
Section 17(2)
Q26. Under Section 17(2), on what grounds may the Central Government exempt state instrumentalities from core provisions of DPDPA?
Statutory Explanation (Section 17(2)):
Section 17(2) allows exemption of state agencies on constitutional grounds including national sovereignty, integrity, security of the State, friendly relations, and public order.
advancedChildren Penalty Bracket
Schedule Item 2
Q27. What is the maximum penalty ceiling under the Schedule for breach of obligations in relation to children under Section 9?
Statutory Explanation (Schedule Item 2):
Item 2 of the Schedule sets a maximum penalty of up to ₹200 Crore for breach in observing obligations in relation to children under Section 9.
advancedSDF Penalty Bracket
Schedule Item 3
Q28. What is the maximum penalty ceiling under the Schedule for breach of additional obligations by a Significant Data Fiduciary under Section 10?
Statutory Explanation (Schedule Item 3):
Item 3 of the Schedule sets a maximum penalty of up to ₹150 Crore for breach in observing additional obligations of a Significant Data Fiduciary under Section 10.
advancedDPO Independence
Section 10(2)(a)
Q29. To whom must the Data Protection Officer (DPO) of a Significant Data Fiduciary report within the corporate hierarchy under Section 10(2)(a)?
Statutory Explanation (Section 10(2)(a)):
Section 10(2)(a) mandates that the DPO shall represent the Significant Data Fiduciary and be directly answerable to the Board of Directors or similar governing body.
advancedDigital by Design
Section 28
Q30. How is the Data Protection Board of India (DPBI) architected to function under Section 28?
Statutory Explanation (Section 28):
Section 28 explicitly establishes that the Board shall function as a "digital office" and conduct proceedings, hearings, and orders digitally to the extent possible.
advancedConstitutional Jurisprudence
Puttaswamy (2017) 10 SCC 1
Q31. In the landmark Justice K.S. Puttaswamy v. Union of India (2017) ruling, how many Supreme Court judges unanimously upheld Privacy as a Fundamental Right?
Statutory Explanation (Puttaswamy (2017) 10 SCC 1):
A historic 9-judge Constitution Bench of the Supreme Court of India unanimously declared the Right to Privacy as an intrinsic fundamental right under Article 21 and Part III.
advancedProportionality Test
Puttaswamy Proportionality Test
Q32. What are the three mandatory prongs of the "Proportionality Test" established in the Puttaswamy judgment for any lawful restriction on privacy?
Statutory Explanation (Puttaswamy Proportionality Test):
The Puttaswamy standard requires: (1) Legality (statutory law), (2) Legitimate Goal, and (3) Proportionality (least restrictive means with safeguards).
advancedHistorical Cases Overruled
Puttaswamy (2017)
Q33. Which two historical Supreme Court judgments were explicitly overruled by the 9-judge Puttaswamy bench regarding privacy?
Statutory Explanation (Puttaswamy (2017)):
The 9-judge bench explicitly overruled M.P. Sharma (1954) and Kharak Singh (1962) to the extent they held that the Constitution does not guarantee a fundamental right to privacy.
advancedSurveillance & Wiretapping
PUCL (1997) 1 SCC 301
Q34. In PUCL v. Union of India (1996), what procedural safeguard did the Supreme Court mandate for telephone surveillance?
Statutory Explanation (PUCL (1997) 1 SCC 301):
PUCL v. UOI held that telephone tapping infringes Article 21 and instituted mandatory procedural safeguards, including authorization by the Home Secretary and periodic review.
advancedRight to be Forgotten
Delhi HC W.P.(C) 3918/2021
Q35. In Jorawer Singh Mundy v. Union of India (2021), what did the Delhi High Court direct Google and IndianKanoon to do?
Statutory Explanation (Delhi HC W.P.(C) 3918/2021):
The Delhi High Court ordered search engines to de-index an acquittal judgment to prevent permanent employment stigma, reinforcing the Right to be Forgotten.
advancedReputational Privacy
Delhi HC CS (OS) 492/2019
Q36. In Zulfiqar Ahman Khan v. Quintillion Business Media (2019), on what grounds did the High Court order restraint on republication of articles?
Statutory Explanation (Delhi HC CS (OS) 492/2019):
The Court recognized that the Right to Privacy includes the Right to be Forgotten and Right to be Left Alone, preventing continuous unverified digital publication.
advancedBodily & Domiciliary Privacy
Kharak Singh (1964) 1 SCR 332
Q37. In Kharak Singh (1962), what police practice was struck down as unconstitutional by the Supreme Court?
Statutory Explanation (Kharak Singh (1964) 1 SCR 332):
The Supreme Court struck down Regulation 236(b) authorizing domiciliary night visits by police, holding that an individual home is their castle and unauthorized intrusion violates personal liberty.
advancedVoice Sample Collection
Ritesh Sinha (2019) 8 SCC 1
Q38. In Ritesh Sinha v. State of UP (2019), what did the Supreme Court hold regarding police collection of voice samples?
Statutory Explanation (Ritesh Sinha (2019) 8 SCC 1):
The Supreme Court held that compelling an accused to give a voice sample for investigation does not violate the right against self-incrimination, balancing privacy against public interest.
advancedBiometric Privacy (Aadhaar)
Aadhaar Judgment (2019) 1 SCC 1
Q39. In the Justice K.S. Puttaswamy (Aadhaar-5 Judge Bench, 2018) judgment, what private sector access was struck down?
Statutory Explanation (Aadhaar Judgment (2019) 1 SCC 1):
The 5-Judge Constitution Bench struck down the portion of Section 57 that permitted private corporations and telecom companies to mandate Aadhaar authentication.
advancedStatutory Interpretation
Section 38
Q40. Under Section 38 of DPDPA 2023, how does the Act interact with other laws containing conflicting data protection provisions?
Statutory Explanation (Section 38):
Section 38 specifies that DPDPA provisions are in addition to and not in derogation of any other law, but in the event of conflict, DPDPA 2023 provisions shall prevail to the extent of inconsistency.
DPDPA 2023 Team Readiness Certificate
CERTIFICATE OF STATUTORY AWARENESS
Digital Personal Data Protection Act, 2023 Compliance Training
This certifies that the compliance representative from Enterprise Candidate has completed the statutory DPDPA 2023 readiness evaluation with a verified score of:
0 / 40
Issued by Bithost Certification Authority · Verification SHA-256 Enabled · Mapped to Section 8 Training Mandates