DPDP Act, 2023: a working foundation
What the Act requires, in the order it requires it, for the people who have to implement it rather than litigate it.
- Sections of the Act
- 1 to 14Every module cites the sections it covers
- Per module
- 6 to 8 minThe gist first, then two applied questions
- Assessment
- 15 questions70% to pass. Unlimited retakes, a new paper each time
- Certificate
- PDF by emailA record of learning, not a qualification
Educational, not legal advice.
The nine modules
They follow the order of the Act itself, because the shape of the statute has to be in your head before control areas mean anything. Each ends with two applied questions.
- 1What the Act actually doesSections 1 to 47 minMost compliance work goes wrong before it starts, because nobody agreed which data, which company and which activity the Act is talking about. This module fixes that.
- 2NoticeSection 56 minNotice is the first duty in the Act and the one most often failed by organisations that believe they have a privacy policy and are therefore finished.
- 3Consent, and its whole lifecycleSection 68 minConsent under this Act is not a checkbox you collect once. It is a state you have to be able to prove, narrow, and dismantle on request.
- 4When you do not need consentSection 76 minSection 7 lists the certain legitimate uses that stand on their own. Read it precisely, because it is both narrower and broader than people assume.
- 5The duties that apply no matter whatSection 88 minSection 8 is where the Act stops being about permission and starts being about competence. These duties do not depend on which lawful ground you relied on.
- 6Breach notification, retention and erasureSection 8(6) and 8(7)7 minTwo duties that both fail for the same reason: they need a decision made in advance, and most organisations make it during the incident.
- 7What people can demand, and what they oweSections 11 to 147 minFour rights, one nomination mechanism, and a set of duties on the individual that most summaries of this Act leave out entirely.
- 8Children's dataSection 96 minA person under eighteen. Not thirteen, not sixteen. This single definition makes India's rule stricter in practice than most regimes an international team will have implemented before.
- 9Significant Data Fiduciaries, the Board and the moneySection 107 minThe Act's heaviest duties fall on organisations the Government names, and its penalties are assessed against what you can show rather than what you intended.
- Final assessment15 questions drawn from all 9 modules, one at a time, 70% to pass. Unlimited retakes, and every answer is explained.
What this certificate is, and what it is not
It records that you completed an educational course, and if you pass the assessment, that you passed it. It is not a statutory qualification, not a licence to practise, and not legal advice. We would rather say that here than have you find it out later.
Educational, not legal advice. The course describes what the Act requires of organisations generally; it does not advise on your own circumstances.