Learn the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 through 30 structured modules, quizzes, and a final exam, with a certificate when you pass.
Read this before you enrol. It is the note from the first page of the programme.
Prerequisites
An e-learning account (separate from the Consent Guru workspace login), so your progress, quizzes, and certificate stay with you.
No earlier DPDP module. This foundation programme begins with privacy, data protection, and the terms used in the Act.
About 15 minutes a day for 30 days.
A score of 60% or more on each module quiz. The final exam passes at 50%.
Guidelines
Legal status note: The Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology on 13 November 2025. The Act and Rules have a phased commencement structure. References in this programme should therefore be read subject to the applicable commencement date.
This training material is educational in nature and should be read with the official Gazette notifications and the final statutory text.
Verify a certificate
Enter the certificate ID printed on a Consent Guru DPDP certificate.
Modules
01Introduction to Data Protection and Privacy
Privacy is about appropriate control and protection of information about individuals. Data protection is the organisational framework that turns that principle into rules, responsibilities, processes and safeguards. Cybersecurity is a major supporting layer, but it is not the whole of privacy compliance. A secure system can still misuse data if it collects information for an unclear purpose or retains it unnecessarily. Conversely, a well-written privacy policy is not sufficient if the underlying systems are insecure.
02DPDP Act 2023 and DPDP Rules 2025
The Act establishes the legal rights, duties, obligations and enforcement architecture. The Rules provide operational detail. Commencement dates determine when specific provisions become legally operative. A mature organisation should maintain a live legal register, identify future obligations early and use the time before commencement to test its people, processes and technology.
03Key Definitions and Terminology
Definitions are not academic terminology. They determine the scope of the compliance programme. The Data Principal is the individual. The Data Fiduciary decides the purpose and means. The Data Processor acts on behalf of the Fiduciary. Processing covers a very wide range of operations. Once these roles are correctly identified, the organisation can map responsibilities, contracts, security controls and rights workflows much more accurately.
04Applicability, Territorial Scope and Exemptions
Applicability should be assessed systematically. Section 3 establishes the territorial and processing scope, while Section 17 provides specific exemptions. Neither provision should be interpreted through assumptions such as 'our server is abroad' or 'this is a government activity'. The organisation should document the facts, identify the exact statutory provision and preserve the reasoning behind its conclusion.
05Personal Data and Digital Personal Data
Personal data should be understood in context, including direct and indirect identification. Digital processing is broad and includes collection, storage, use, sharing and deletion. Data minimisation reduces both privacy risk and cyber risk. Good design asks what information is necessary before asking how much information technology can collect.
06Data Principal
The Data Principal is the individual whose personal data is being processed. The Act gives the individual important rights relating to access, correction, erasure, grievance redressal and nomination. Organisations must translate those rights into practical workflows. A good rights programme includes authentication, data discovery, legal review, secure response, timelines, escalation and audit evidence. The goal is not merely to close tickets; it is to give individuals meaningful control without creating a new security vulnerability.
07Data Fiduciary
A Data Fiduciary is the central accountability point in a processing activity. Section 4 establishes the lawful-processing framework, while Section 8 creates broad operational responsibilities. A strong Fiduciary programme begins with understanding purposes and data flows, then builds appropriate notice, consent or legitimate-use analysis, processor governance, security, retention and rights mechanisms. Outsourcing a process may change who performs the work, but it does not automatically eliminate the organisation's accountability.
08Data Processor
A Data Processor performs processing on behalf of a Data Fiduciary, but the relationship creates significant privacy and cybersecurity risk. Effective processor management starts before onboarding and continues through the entire contract lifecycle. Due diligence, clear instructions, security controls, access restrictions, incident obligations, subprocessor governance and secure exit procedures should be documented and tested.
09Consent under the DPDP Framework
Consent should be meaningful, specific and provable. Section 6 places the organisation under a high evidentiary responsibility because the Data Fiduciary must be able to demonstrate the relevant notice and consent. A good consent system therefore combines clear communication, affirmative action, purpose separation, reliable records, withdrawal mechanisms and processor propagation. Consent should never be designed as a trap or as a technical obstacle.
10Notice, Transparency and Informed Consent
Transparency is a practical requirement, not a public-relations exercise. A good notice allows a reasonable person to understand the processing before making a decision. Rule 3's emphasis on standalone presentation, plain language, itemised data, specified purposes and rights mechanisms should influence product design, not just legal drafting. Privacy teams should test notices with ordinary users rather than assuming that legal accuracy automatically means clarity.
11Certain Legitimate Uses
Certain legitimate uses are an important part of the DPDP framework because organisations sometimes need to process personal data without relying on consent. However, legitimate use is not a general exemption from privacy responsibility. The exact statutory circumstance, purpose, necessity, scope, retention and safeguards should be documented. Organisations should be particularly careful about secondary uses and function creep.
12General Obligations of a Data Fiduciary
Section 8 should be understood as an accountability framework. It expects the Data Fiduciary to manage processing responsibly from collection through deletion. Security safeguards, processor governance, accuracy, retention, contact mechanisms and grievance handling are connected parts of one programme. Compliance becomes much stronger when each requirement has an owner, a documented process, a technical control where necessary and evidence that the process actually operates.
13Processing Personal Data of Children
Children's data requires special care because children may be less able to understand or challenge data practices. Section 9 and the Rules create enhanced requirements around parental consent and specified processing practices. Organisations serving children should build age assurance, parental mechanisms, minimisation, access controls, secure recovery and appropriate retention into the product lifecycle. Educational or healthcare contexts do not mean that every possible use of children's data is automatically justified.
14Significant Data Fiduciary
Significant Data Fiduciaries require a stronger governance architecture because the scale or nature of their processing can create higher risk. Section 10 establishes enhanced responsibilities, while Rule 13 provides recurring DPIA and audit requirements and directs attention to algorithmic systems. The objective is continuous risk management. Organisations should not wait for a problem before assessing high-impact processing.
15Rights of the Data Principal
Data Principal rights are operational processes, not merely statements in a privacy policy. Organisations need authentication, data discovery, decision rules, processor coordination, secure communication and audit trails. Access, correction, erasure, grievance and nomination should each have a defined workflow. The organisation should also be able to explain why a particular action was taken when another law requires continued retention or processing.
16Duties of the Data Principal
Section 15 recognises that the Data Principal also has responsibilities. Authenticity, lawful conduct and responsible use of grievance mechanisms help protect the privacy system from abuse. Organisations should therefore design rights workflows that are both user-friendly and resistant to impersonation. The best system does not choose between privacy and security; it uses security controls to protect genuine privacy rights.
17Processing Personal Data Outside India
Cross-border processing requires an organisation to understand the entire data flow. Section 16 creates the statutory framework for restrictions, while Rule 15 provides operational detail concerning transfers. Organisations should map where data is stored, processed, accessed and backed up. They should also examine foreign vendors, administrative access, encryption, contractual protections and other applicable Indian laws.
18Exemptions under the DPDP Act
Exemptions are necessary because certain processing activities serve important legal, judicial, regulatory or public purposes. However, the organisation must establish the exact statutory basis and avoid extending the exemption beyond its intended scope. Good governance records the reason for relying on an exemption, limits data to what is necessary, applies appropriate safeguards and checks other applicable laws.
19Reasonable Security Safeguards
Reasonable security safeguards are risk-based and layered. Section 8 creates the responsibility, while Rule 6 identifies concrete categories of safeguards. Organisations should protect personal data across identity, application, database, network, endpoint, cloud and vendor environments. Security should also be tested and monitored because a control that exists on paper but is not functioning does not provide reliable protection.
20Personal Data Breach and Breach Response
Breach response should be planned before a breach occurs. Organisations need a clear escalation path, incident team, evidence-preservation procedure, data-discovery capability and notification process. The technical team must identify how the incident happened, while the privacy and legal teams determine the implications for Data Principals and regulators. A mature organisation also learns from each incident and improves its controls.
21Data Protection Board of India
The Data Protection Board forms a central part of the statutory enforcement architecture. Organisations should understand the Board's role, maintain reliable records and establish a coordinated regulatory-response process. Legal, privacy, cybersecurity and management functions should work together. The strongest response is not simply a carefully drafted letter; it is a response supported by accurate operational evidence.
22Consent Manager
A Consent Manager is intended to make consent more understandable and manageable for Data Principals. It is not merely a checkbox service. The statutory and Rules framework creates registration, governance and operational expectations. Because the Consent Manager may hold sensitive records about consent relationships, it should be protected using strong identity, access, logging and API security. User control should remain central throughout the consent lifecycle.
23Data Protection Officer and Contact Mechanism
A DPO or designated privacy contact provides organisational accountability. For SDFs, the Act specifies a stronger statutory role with reporting and regulatory responsibilities. Rule 9 reinforces the need for visible contact information. The organisation should ensure that privacy enquiries reach a trained person, that urgent matters are escalated and that rights and grievances can be tracked from receipt to closure.
24Grievance Redressal
Grievance redressal is an important accountability mechanism. It allows the organisation to detect problems that may not appear in technical monitoring. A mature grievance process treats complaints as evidence and risk signals, not merely as tickets to close. The workflow should be secure, traceable, timely and connected to the wider privacy and cybersecurity programme.
25Enforcement, Inquiry and Compliance Directions
Enforcement readiness depends on ordinary governance discipline. The Board's role means that organisations should be able to explain what they did, why they did it and what evidence supports their explanation. Policies, contracts and technical controls should be connected. When an incident occurs, preserve evidence, establish a factual timeline, coordinate the response and avoid speculative statements.
26Penalties and Financial Consequences
Financial penalties make DPDP a board-level risk-management issue. The ₹250 crore maximum for specified security failures demonstrates the scale of potential exposure, but organisations should not focus only on the number. The deeper lesson is accountability. Management should know what data is processed, what safeguards exist, what risks remain, who accepted those risks and whether corrective actions are completed.
27Data Retention, Erasure and Deletion
Retention and deletion are core parts of the personal-data lifecycle. Section 8 establishes the purpose-based principle, while Rule 8 provides specified retention requirements for certain entities and purposes. Organisations should distinguish information that must be retained by law from information that can be deleted. They should also address copies held by processors, analytics platforms, backups and employees. Good deletion reduces privacy exposure, storage cost and cybersecurity attack surface.
28Privacy Governance, Audit and Data Protection Impact Assessment
Governance makes privacy continuous. DPIAs help organisations identify risk before harm occurs, while audits test whether controls actually work. For SDFs, the Act and Rules create stronger recurring requirements. Organisations should connect DPIA findings to risk registers and remediation plans. The objective is not to produce paperwork; it is to make risky processing safer, more transparent and more accountable.
29DPDP Compliance Programme for an Organisation
A DPDP compliance programme should connect law, people, process and technology. Start with discovery. Understand what personal data exists and why it is processed. Then establish legal, governance, security, rights, vendor and retention controls. Finally, test the programme. Compliance becomes sustainable when it is embedded in procurement, product development, cybersecurity, Human Resources, customer service and management reporting.
30Final DPDP Compliance Readiness Assessment
DPDP readiness is the ability to demonstrate responsible processing in practice. An organisation should know its data, understand its purposes, identify its roles and vendors, protect information, respect Data Principal rights, manage retention and respond to breaches. The final goal is not a certificate or a policy document. It is a functioning privacy and security culture in which people understand their responsibilities and systems support them.
