30 questions covering all 10 modules. Pick an answer to see the explanation immediately. A score of 80% or more means you are well prepared. This DPDPA 2023 course page explains dpdpa final assessment in plain language.
Advertisement
Questions (dpdpa final assessment)
Q1. Which data does the DPDP Act cover?
The Act covers personal data in digital form and non-digital data that is subsequently digitised.
Q2. Which case recognised privacy as a fundamental right?
Puttaswamy (2017) is the foundation for India’s data protection law.
Q3. When does DPDPA reach processing outside India?
Section 3 gives the Act extra-territorial reach for such activities.
Q4. Who decides the purpose and means of processing?
That decision-making role defines a Data Fiduciary.
Q5. For a child, who exercises the rights of the Data Principal?
The definition of Data Principal includes the parent or lawful guardian of a child.
Q6. A vendor processes data for you under a contract. Who is accountable to the Data Principal?
Section 8(1) keeps the fiduciary responsible, irrespective of any agreement or processor failure.
Q7. Which of these is NOT a right under Sections 11 to 14?
Portability is a GDPR right; DPDPA does not grant it.
Q8. Where should a Data Principal take a grievance first?
The Board expects the principal to exhaust the fiduciary’s grievance mechanism first.
Q9. Maximum penalty for a Data Principal breaching their duties?
The Schedule caps it at ₹10,000.
Q10. Which is NOT a requirement of valid consent?
Bundling purposes breaks the “specific” and “unconditional” requirements.
Q11. Withdrawing consent must be…
Section 6(4) mirrors ease of giving.
Q12. Which is a legitimate use without consent?
Medical emergencies are listed in Section 7.
Q13. Maximum penalty for failing to take reasonable security safeguards?
The Schedule sets up to ₹250 crore.
Q14. Detailed breach report to the Board is due within…
The Rules require a detailed report within 72 hours unless extended.
Q15. Minimum log retention under the Rules?
Logs and related personal data must be retained for one year.
Q16. What is the default position on cross-border transfers?
Section 16 is a negative-list model.
Q17. If a sectoral law is stricter than DPDPA on transfers, which applies?
Section 16(2) preserves stricter laws.
Q18. Which processing enjoys a notable exemption for outsourcing?
Section 17(1)(d) covers it.
Q19. Who must appoint a Data Protection Officer based in India?
Section 10 makes it an SDF obligation.
Q20. A processor may be engaged only under…
Section 8(2).
Q21. Must a fiduciary publish a contact for questions?
Section 8(9).
Q22. In DPDPA, a child is someone under…
Section 2(f).
Q23. Which is prohibited for children’s data?
Section 9(3).
Q24. Which is an extra duty of an SDF?
Section 10(2).
Q25. Who inquires into breaches and imposes penalties?
The Board is the primary regulator.
Q26. Appeals against Board orders go to…
TDSAT is the appellate body.
Q27. Maximum penalty for breaching children’s obligations?
The Schedule sets up to ₹200 crore.
Q28. Which Section 7 ground often covers employee data?
Section 7(i).
Q29. For an edtech app aimed at children, which is generally prohibited?
Section 9(3).
Q30. Which exemption helps an Indian BPO processing a foreign client’s customer data?
It exempts non-resident data processed under a foreign contract.
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)