Lesson 1
Start with a data inventory
Most of the duties in Chapter II of the Act assume that a Data Fiduciary knows what personal data it holds, why it holds it, and where that data goes. In practice the sensible first step is to map this out in a data inventory, sometimes called a data map. It is a working tool, not a form the Act prescribes, but it is the record that most of the later steps in this module depend on.
A useful inventory is organised by processing activity rather than by system. For each activity, record the items of personal data involved, the specific purpose they are processed for, and the lawful ground relied on. Under Section 4 there are only two grounds: the Data Principal's consent, or one of the legitimate uses listed in Section 7. An activity that cannot be matched to one of them has no lawful basis until it can be. It also helps to note whether the data was collected digitally or on paper and digitised later, because Section 3 brings both into scope.
The inventory feeds the notice directly. Section 5 requires a notice that gives an itemised description of the personal data and the purpose it will be processed for, and Section 6 limits consent to the personal data that is actually necessary for that purpose. If the inventory shows a data item that serves no stated purpose, that item is hard to justify in the notice or the consent request.
The inventory should also record how long each item is needed and what ends the purpose. Section 8(7) requires a Data Fiduciary to erase personal data once the Data Principal withdraws consent or the purpose is no longer being served, whichever is earlier, unless another law requires it to be retained. It must also have its Data Processors erase their copies. Without a record of which processors hold which data, that second step cannot be carried out reliably.
Finally, record who the data is shared with. Under Section 11 a Data Principal who has given consent can ask for a summary of the personal data being processed and the identities of every other Data Fiduciary and Data Processor it has been shared with, along with a description of what was shared. It is worth flagging, too, any data that feeds a decision about the Data Principal or is disclosed to another Data Fiduciary, because Section 8(3) requires that data to be complete, accurate and consistent.
None of these obligations is in force yet. Sections 3 to 5, the substance of Section 6, and Sections 7, 8 and 11 commence on 13 May 2027, eighteen months after the DPDP Rules, 2025 were published. Building the inventory now gives an organisation the base it needs for everything that follows.
- Organise the inventory by processing activity: data items, purpose, lawful ground, retention trigger and recipients.
- Every activity must rest on consent or a specific Section 7 legitimate use; there is no third route.
- The inventory supplies the itemised description and purpose that a Section 5 notice must contain.
- Tracking which processors hold which data is what makes Section 8(7) erasure and Section 11 access requests workable.
- These obligations commence on 13 May 2027.
Lesson 2
Consent management in practice
A consent flow starts with the notice. Section 5 requires the notice to be given before, or together with, the request for consent. It must describe the personal data and the purpose, explain how the Data Principal can withdraw consent and exercise her rights, and tell her how to complain to the Board. She must be able to read it in English or in any language listed in the Eighth Schedule to the Constitution. Rule 3 adds that the notice must stand on its own, separate from other information, and must give the actual link where she can withdraw consent, exercise her rights or complain to the Board. A privacy policy buried elsewhere does not do this job.
The consent request itself must meet the standard in Section 6. Consent must be free, specific, informed, unconditional and unambiguous, and given through a clear affirmative action. In design terms, that means an active opt-in rather than a pre-ticked box, silence or continued use of a service. Each purpose needs its own choice rather than being bundled with another, and the request should ask only for the data necessary for the stated purpose. It must be in clear, plain language and give the contact details of a Data Protection Officer, where one applies, or another authorised contact person.
Withdrawal must be at least as easy as giving consent was: in practice, the same channel and no more steps. Once consent is withdrawn, the Data Fiduciary and any Data Processor acting for it must stop processing within a reasonable time, unless another lawful ground independently permits it to continue. Withdrawal does not make processing that already happened unlawful. It does, however, start the erasure duty in Section 8(7), so a withdrawal should trigger both the stop and the clean-up across systems and vendors.
Keep evidence. Under Section 6(10), if consent is disputed, it is the Data Fiduciary that must prove valid notice was given and consent was obtained. The practical answer is a record for each consent: which version of the notice was shown, when, what the Data Principal actively did to consent, and when and how she withdrew. Any term in a consent that tries to waive a right under the Act, such as her right to complain to the Board, is invalid to that extent, so it adds nothing to that evidence.
Consent can also be given, managed, reviewed and withdrawn through a Consent Manager, which is accountable to the Data Principal. A Consent Manager must be registered with the Board, and it must offer grievance redressal like a Data Fiduciary. The registration requirement in Section 6(9) commences on its own date, 13 November 2026. The rest of Section 6, together with Section 5, commences on 13 May 2027. For consent collected before then, the Data Fiduciary may continue processing until it is withdrawn, but must send an equivalent notice as soon as reasonably practicable.
Not every activity needs consent. Section 7 lists the legitimate uses that permit processing without it, such as compliance with a court order or processing for employment purposes. Each is narrow, and the list is complete; there is no general legitimate-interest ground beyond it.
- Give a standalone notice before or with the consent request, with working links for withdrawal, rights and complaints.
- Consent needs a clear affirmative action, one purpose at a time, limited to the data necessary.
- Withdrawal must be as easy as giving consent, and it obliges processors as well as the Data Fiduciary to stop.
- The Data Fiduciary carries the burden of proving valid notice and consent, so keep records for each consent.
- Consent Manager registration commences on 13 November 2026; the rest of Sections 5 and 6 on 13 May 2027.
Lesson 3
Security safeguards, processors and vendors
Section 8(4) requires a Data Fiduciary to implement appropriate technical and organisational measures so that it actually observes the Act. Section 8(5) adds a specific duty: take reasonable security safeguards to prevent a personal data breach. Failing to do so carries the Act's highest penalty, up to ₹250 crore under the Schedule to Section 33.
Rule 6 of the DPDP Rules, 2025 sets out what reasonable safeguards include once it takes effect: encryption, masking or similar measures; access control; monitoring and logging; backups; contracts with processors that bind them to the same safeguards; and keeping breach-related logs for one year. These are a floor for planning, and each one maps naturally to a control an organisation can test and evidence.
The security duty is unusually durable. Section 17(1) exempts several kinds of processing, such as enforcing a legal right or claim, from most of Chapters II and III. Even then, Section 8(1) on accountability and Section 8(5) on security safeguards continue to apply. An exemption can remove a notice duty; it never removes the duty to protect the data.
Many organisations rely on vendors for hosting, payroll, customer support or analytics. Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract; there is no exception for informal arrangements. Section 8(1) keeps the Data Fiduciary responsible for compliance whatever that contract says, so it stays accountable for what its processors do. A contract cannot move that responsibility under the Act onto the vendor.
In practice, keep a vendor register alongside the data inventory: which processor handles which data, for what purpose, under which contract, and with what safeguards. That register is what lets a Data Fiduciary make its processors stop after a withdrawal, erase data under Section 8(7), and answer a Section 11 request about who the data has been shared with. Failures in these other Section 8 duties fall under the Schedule's residual item, up to ₹50 crore.
Section 8 commences on 13 May 2027, as do Sections 17 and 33.
- Reasonable security safeguards under Section 8(5) carry the highest penalty in the Act, up to ₹250 crore.
- Rule 6 lists encryption or masking, access control, monitoring and logging, backups, processor contracts and one-year log retention.
- Section 17(1) exemptions never waive Section 8(1) accountability or Section 8(5) security safeguards.
- Processors may be engaged only under a valid contract, and the Data Fiduciary stays responsible regardless of its terms.
Lesson 4
Responding to a personal data breach
Section 8(6) requires a Data Fiduciary, in the event of a personal data breach, to give intimation of it to the Board and to each affected Data Principal. Both audiences are required: telling the Board does not replace telling the people affected, and telling them does not replace telling the Board. Failing to notify carries a penalty of up to ₹200 crore.
Rule 7 of the DPDP Rules, 2025 sets the timing. The Board and every affected Data Principal must be told without delay. The Data Fiduciary must then give the Board a full report covering the cause of the breach, its impact and the mitigation, within 72 hours of becoming aware of the breach. The Act leaves the format of breach notification to the Rules, so a response plan should be built against the text of Rule 7 itself rather than a summary.
A breach notification can set the Board's machinery in motion. Under Section 27, on receiving an intimation under Section 8(6), the Board can direct urgent remedial measures and inquire into the breach. If an inquiry finds a significant breach of the Act, it can impose a penalty under Section 33.
Preparation matters more than improvisation. A written response plan should name who decides that a breach has occurred, who drafts and sends each intimation, and how affected Data Principals will be identified and reached. The data inventory shows whose data was in the affected system, and the breach-related logs that Rule 6 requires to be kept for one year help establish what happened. Because the 72-hour clock runs from awareness, the plan should make sure a suspected breach reaches the decision-makers quickly.
Document the response. When the Board fixes a penalty within the Schedule's ceiling, Section 33(2) requires it to weigh, among other factors, whether and how effectively the person mitigated the breach. Note also that the failure to take security safeguards (up to ₹250 crore) and the failure to notify (up to ₹200 crore) are separate items in the Schedule, so the notification duty stands on its own, apart from whatever caused the breach.
Section 8, Section 27 (apart from clause (1)(d)) and Section 33 commence on 13 May 2027. Until then, the Act's breach-notification duty is not in force.
- Notify both the Board and each affected Data Principal; one does not replace the other.
- Under Rule 7: intimation without delay, then a full report to the Board on cause, impact and mitigation within 72 hours of becoming aware.
- Failing to notify carries up to ₹200 crore, separately from the up to ₹250 crore for failing to take security safeguards.
- The Board can direct urgent remedial measures and inquire, and it must weigh mitigation when fixing a penalty.
Lesson 5
AI and machine learning: lawful ground, purpose and public data
The Act contains no provisions written specifically for artificial intelligence or machine learning. That does not put AI systems outside it. Processing is defined broadly enough to cover collection, storage, use, combination and sharing of personal data, so collecting a training set, training or fine-tuning a model on it, and running the model on a person's data are all processing. The general rules in this course apply to them in the same way as to any other system.
The first of those rules is Section 4. Training a model on personal data needs a lawful ground: the Data Principal's consent, or one of the legitimate uses in Section 7. The Section 7 list is complete, and each use is narrow and purpose-bound; there is no general legitimate-interest ground that would cover model training simply because it is commercially useful. Where consent is the ground, Section 6 applies in full.
Purpose specificity is where AI projects most often run into difficulty. Consent must be specific to the stated purpose, and the Section 5 notice must state that purpose. Data collected to deliver an order, or to run an account, was consented to for that purpose and not for a different one. Using it to train an unrelated model is a new purpose that needs its own lawful ground. Consent must also be unconditional, so consent to model training should not be bundled with consent to an unrelated purpose, and it must be limited to the data necessary for the purpose. If a Data Principal withdraws consent, processing for that purpose must stop within a reasonable time.
Section 3 takes two kinds of data outside the Act: data an individual processes for a purely personal or domestic purpose, and personal data made publicly available by the Data Principal herself, or by someone who was under a legal obligation to publish it. This carve-out has limits that matter for anyone collecting data at scale from public sources. It covers what the Data Principal or a legally obliged person published. It does not cover data a Data Fiduciary chooses to publish, and it does not turn everything that can be found online into data outside the Act. The personal or domestic carve-out never covers work done in a business or organisational capacity.
Section 17(2) separately exempts processing for research, archiving or statistical purposes, but only where the personal data is not used to take a decision specific to a Data Principal and the processing follows the standards prescribed in Rule 16. It is conditioned on purpose, not a blanket exemption for any project described as research. Similarly, the exemption for notified classes of Data Fiduciaries such as startups under Section 17(3) applies only once the Central Government has actually notified that class.
Sections 3 to 5, Section 6 (apart from sub-section (9)), Section 7 and Section 17 commence on 13 May 2027.
- The Act has no AI-specific provisions; training and running models on personal data are processing under its general rules.
- Training on personal data needs consent or a Section 7 legitimate use, and there is no general legitimate-interest ground.
- Consent is purpose-specific, so reusing data for a new model purpose needs its own lawful ground.
- The Section 3 public-data carve-out covers only data the Data Principal, or a legally obliged person, made public.
- The research exemption in Section 17(2) applies only where no decision specific to a Data Principal is taken and Rule 16 standards are met.
Lesson 6
AI and machine learning: accuracy, erasure and children
Once a model is in use, several Section 8 duties apply to the personal data it relies on. Section 8(3) requires a Data Fiduciary to keep personal data complete, accurate and consistent wherever it will be used to make a decision that affects the Data Principal, or is disclosed to another Data Fiduciary. A decision made with the help of an automated system is still a decision, so the data feeding a scoring, eligibility or ranking model falls within this duty in the same way as data used by a human reviewer.
The Data Principal's own rights support this. Under Section 12, for processing she consented to, she can ask for inaccurate or misleading data to be corrected, incomplete data to be completed, and data to be updated. A Data Fiduciary that uses personal data in automated decisions needs a way for those corrections to reach the data the system actually uses.
Erasure and retention follow the general rule. Under Section 8(7), personal data must be erased once consent is withdrawn or the purpose is no longer served, whichever is earlier, unless another law requires it to be retained, and the Data Fiduciary must have its Data Processors erase their copies too. AI work tends to multiply copies of data, in training sets, evaluation sets, feature stores and vendor environments. Recording those copies in the data inventory is what makes erasure possible when it is due. Section 8(5) security safeguards and Section 8(6) breach notification apply to these copies as to any other personal data.
Children's data has the strictest rules. A child under the Act is anyone under 18. Section 9 requires verifiable consent from a parent or lawful guardian before processing a child's personal data, using the mechanisms in Rule 10. Two things are barred even with that consent: processing likely to have a detrimental effect on a child's well-being, and tracking, behavioural monitoring or targeted advertising directed at children. A system that profiles children's behaviour to target them with advertising is the kind of processing the second bar addresses. Rule 12 sets out narrow exemptions for specific classes and purposes, and breach of Section 9 carries a penalty of up to ₹200 crore.
If the Central Government notifies a Data Fiduciary as a Significant Data Fiduciary, Section 10 adds periodic Data Protection Impact Assessments covering Data Principals' rights, the purpose of processing and risk management, along with periodic audits and an independent data auditor. For an organisation that uses personal data in models, those assessments are the natural place to examine that processing. Breach of the Section 10 duties carries up to ₹150 crore.
Sections 8, 9, 10 and 12 commence on 13 May 2027. Throughout, these are applications of general provisions to AI systems, not rules written for AI.
- Section 8(3) accuracy applies to data used in decisions about the Data Principal, whether a person or a model makes them.
- Section 8(7) erasure reaches every copy, including training and evaluation sets held by processors.
- Tracking, behavioural monitoring and targeted advertising directed at children are barred even with parental consent.
- For a notified Significant Data Fiduciary, periodic Data Protection Impact Assessments and audits are the natural place to examine model-related processing.
Check yourself
5 random questions from this module. Answers are marked straight away and don't count toward the exam.