DSCI DCPP cheat sheet

Personal data (personal information) = any information relating to an identified or identifiable natural person; identifiability can be direct (name, ID number) or indirect (IP address, device ID, location trail, cookie).

Data Protection Impact Assessment (DPIA) is required when processing is likely to result in high risk to data subjects; triggers typically include large-scale sensitive data, systematic monitoring, profiling, or new technology.

Data minimisation: collect only data that is adequate, relevant, and limited to what is necessary for the stated purpose; it is judged at the point of collection and re-assessed when purposes change.

Purpose limitation: data may be processed only for the purposes specified at collection unless a lawful basis exists for the new purpose; compatible reuse is assessed by factors such as link to original purpose, context, and expectations.

Controller vs processor: the controller determines purposes and means; the processor acts on the controller's documented instructions and cannot use data for its own purposes without becoming a controller.

Data subject rights typically include access, correction, erasure, restriction, portability, and objection; erasure is not absolute and is balanced against legal retention obligations and freedom of expression.

Consent is valid only when freely given, specific, informed, unambiguous, and withdrawable; silence, pre-ticked boxes, and bundled consent fail these tests.

Privacy by design and by default: privacy protections are embedded into systems at the design stage, and default settings must minimise data collection and sharing without user action.

Pseudonymisation replaces identifiers with tokens so data cannot be attributed to a person without additional separately held information; it reduces risk but does not make data anonymous.

Article 21 of the Constitution of India: the Supreme Court in K.S. Puttaswamy (2017) held privacy is a fundamental right, with tests of legality, necessity, and proportionality for state intrusion.

Digital Personal Data Protection Act, 2023 (DPDP Act): applies to digital personal data processed in India and to processing outside India if it relates to offering goods or services to data principals in India.

DPDP Act roles: Data Principal (the individual), Data Fiduciary (determines purpose and means), and Significant Data Fiduciary (designated by government based on volume, sensitivity, and risk).

DPDP Act lawful basis: processing requires consent or certain legitimate uses; consent must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action, and must be withdrawable.

DPDP Act consent notice: before requesting consent, the Data Fiduciary must give a notice stating the personal data sought, the purpose, and how to exercise rights and complain to the Data Protection Board.

DPDP Act rights of Data Principals: access to a summary of data, correction and erasure, grievance redressal, and nomination of a person to exercise rights in case of death or incapacity.

DPDP Act obligations: accuracy, security safeguards, breach notification to the Data Protection Board and affected Data Principals, and erasure when purpose is served unless retention is required by law.

DPDP Act cross-border transfer: transfers are permitted except to countries restricted by the Central Government notification; the restricted-list model differs from the adequacy model of GDPR.

DPDP Act enforcement: the Data Protection Board of India adjudicates breaches and may impose penalties, including amounts up to INR 250 crore for failure to take reasonable security safeguards.

GDPR applies extraterritorially when an organisation offers goods or services to EU data subjects or monitors their behaviour, even without an EU establishment (Article 3(2)).

GDPR lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests; special category data additionally needs an Article 9 condition.

GDPR cross-border transfer mechanisms: adequacy decisions, standard contractual clauses (SCCs), binding corporate rules, and derogations; Schrems II requires a transfer impact assessment.

CCPA/CPRA (California): applies to for-profit businesses meeting thresholds; grants rights to know, delete, correct, and opt out of sale/sharing, with a limited right to limit use of sensitive personal information.

Common global transfer tools: adequacy, SCCs, binding corporate rules, certification mechanisms, and country-specific whitelists; the destination country's surveillance laws affect the assessment.

Data localisation models: strict localisation (data must remain in country), conditional localisation (copy retained locally), and no localisation but transfer restrictions.

Adequacy decisions are not static: they are periodically reviewed and can be invalidated by courts, so transfer programmes need fallback mechanisms.

Cross-border data flow documentation typically includes a data map, transfer register, transfer impact assessment, and executed contractual clauses per data flow.

Regional instruments: GDPR (EU), UK GDPR, LGPD (Brazil), PIPL (China), PDPA (Singapore), Privacy Act (Australia), and DPDP Act (India) each have distinct lawful-basis and transfer rules.

Programme governance structure: accountable executive or DPO, privacy office, cross-functional steering committee, and business-unit privacy champions with defined roles.

Records of processing activities (RoPA) are the backbone artefact: each record captures purpose, categories of data and subjects, recipients, transfers, retention, and security measures.

Privacy risk assessment scoring typically multiplies likelihood by impact and classifies risk as low, medium, or high; high residual risk requires senior sign-off before processing.

Data retention schedule: set retention periods per data category and purpose, trigger deletion at period end, and document legal-hold exceptions.

Vendor management: due diligence, contractual data processing terms, security and privacy questionnaires, periodic reassessment, and offboarding deletion confirmation.

Privacy training and awareness: role-based training (all staff, developers, marketers, HR) with completion tracking and periodic refreshers.

Metrics for programme effectiveness include DPIA completion rate, data subject request turnaround time, incident count, training completion, and vendor assessment coverage.

Privacy notices and consent management: notices must be layered and versioned; consent records must capture timestamp, scope, and withdrawal.

Audit and accountability: internal audits, privacy control testing, and documented evidence support regulatory defence and board reporting.

Privacy-enhancing technologies: encryption at rest and in transit, tokenisation, pseudonymisation, differential privacy, secure multi-party computation, and homomorphic encryption.

Data classification tiers (public, internal, confidential, restricted) drive access control, encryption, retention, and vendor requirements.

Access control principles: least privilege, role-based or attribute-based access, periodic access reviews, and logging of privileged access.

Data subject request (DSR) workflow: intake, identity verification, data discovery across systems, fulfilment or lawful refusal, response within statutory deadline, and audit trail.

Incident response lifecycle: preparation, detection, containment, assessment, notification, remediation, and post-incident review.

Breach notification clocks vary by jurisdiction: GDPR generally requires notifying the supervisory authority within 72 hours of awareness; DPDP Act requires notifying the Data Protection Board and affected Data Principals without delay.

Incident severity assessment weighs data sensitivity, volume, identifiability, containment status, and potential harm to individuals.

Privacy engineering in SDLC: privacy requirements at design, threat modelling, DPIA at design stage, pre-release privacy review, and post-deployment monitoring.

Logging and monitoring must balance security needs with data minimisation: avoid logging sensitive data in plaintext and set log retention limits.