Lesson 1.8: Your first scoping exercise and module test

Module 1 · Lesson 1.8 of 8 · About 30 minutes · Your first scoping exercise and

Put it all together: scope your own organisation and take the Module 1 test. This DPDPA 2023 course page explains your first scoping exercise and in plain language.

your first scoping exercise and - DPDPA 2023 course lesson banner

What you will learn about your first scoping exercise and

Complete a scoping worksheet for your organisation
Identify your top five risks
Pass the Module 1 test with 70 percent or more

Part 1: Scoping worksheet (15 minutes) (your first scoping exercise and)

Tick each item as you finish it.

0 of 8 done

List all types of people whose data you hold
List every system, app, spreadsheet and paper file that holds it
Mark which of these are digital
Write your role for each: fiduciary or processor
Note whether any data relates to children
Note whether you send data outside India (cloud, support teams)
List vendors who process data for you
Name one person responsible for privacy

Part 2: Quick risk spotter

If you see this	The risk is	Do this
Customer data in shared spreadsheets	Leak and no access control	Move to access-controlled storage
No privacy notice on forms	Invalid consent	Add the notice (Lesson 1.5)
Old data never deleted	Breach of erasure duty	Set retention rules
Vendors with no contract terms	Fiduciary stays liable	Add data protection clauses
No breach plan	Late reporting	Write a response plan

Part 3: Module 1 test (15 minutes) (your first scoping exercise and)

Check your understanding of your first scoping exercise and

Q1. Which data does the Act cover?

Q2. Who decides the purpose and means of processing?

Q3. Which is the default ground for processing?

Q4. The main duties take effect after:

Q5. Does DPDPA have a sensitive data category?

Q6. Who must appoint a DPO?

Q7. A foreign site offering services to Indian users is:

Q8. Is withdrawal of consent as easy as giving it?

Well done. You have finished Module 1. Continue to Module 2: Key Definitions and Roles.

← Timeline and phased commencement Module 2: Key Definitions & Roles →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for your first scoping exercise and: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.