I85PREP
⌘ K
DSCI DCPP study materials
DSCI DCPP study resources

DSCI DCPP practice questions

One question at a time. Build your DSCI DCPP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Privacy fundamentals and concepts

Under the GDPR, which principle requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes?

  1. Storage limitation
  2. Integrity and confidentiality
  3. Purpose limitation Correct answer.
  4. Data minimisation

Explanation

Purpose limitation is the GDPR principle that binds controllers to the stated, explicit and legitimate purposes at collection and forbids incompatible secondary processing. Storage limitation instead caps how long data is kept, and minimisation limits how much is collected.

Question 2Privacy fundamentals and concepts

A company processes personal data only to the extent necessary to fulfil a specific service, collecting no extra fields. Which GDPR principle is being applied?

  1. Accountability
  2. Accuracy
  3. Lawfulness and fairness
  4. Data minimisation Correct answer.

Explanation

Data minimisation requires that personal data be adequate, relevant and limited to what is necessary for the purpose. Collecting no extra fields is the classic operational expression of that principle.

Question 3Privacy fundamentals and concepts

In privacy terminology, what distinguishes a data controller from a data processor?

  1. The controller is always a public authority, while the processor is always a private company.
  2. The controller determines the purposes and means of processing, while the processor acts on the controller's behalf. Correct answer.
  3. The controller handles personal data, while the processor handles only anonymised data.
  4. The controller stores data on-premises, while the processor uses cloud services.

Explanation

The controller decides why and how personal data is processed; the processor carries out processing on the controller's instructions. Location, sector and data type do not define the roles.

Question 4Privacy fundamentals and concepts

Which category of data does the GDPR treat as a special category requiring additional protection?

  1. Publicly available company registration numbers
  2. Business contact details
  3. Transaction amounts on a corporate card
  4. Biometric data used to uniquely identify a person Correct answer.

Explanation

Special categories under the GDPR include biometric data processed for unique identification, along with data such as health, racial or ethnic origin, and religious beliefs. Ordinary commercial and contact data fall outside that list.

Question 5Privacy fundamentals and concepts

Which statement best describes the concept of 'personal data'?

  1. Only data held in structured databases
  2. Only data that the individual has explicitly shared
  3. Only information that includes a full legal name and address
  4. Any information relating to an identified or identifiable natural person Correct answer.

Explanation

Personal data is any information relating to an identified or identifiable natural person, and identifiability can be indirect through identifiers or combinations of data. It is not limited to names, databases or voluntarily shared information.

Question 6Privacy fundamentals and concepts

What is the core purpose of a privacy notice provided to data subjects?

  1. To publish the organisation's marketing preferences
  2. To inform individuals about how their personal data is collected, used, shared and retained Correct answer.
  3. To transfer legal liability for processing to the data subject
  4. To obtain a signature that replaces the need for a legal basis

Explanation

A privacy notice gives transparency about the purposes, legal basis, recipients, retention and rights associated with processing. It supports informed individuals but does not itself create a legal basis or shift liability.

Question 7Privacy fundamentals and concepts

Which concept describes data that can no longer be linked to an individual by any reasonably likely means?

  1. Pseudonymised data
  2. Encrypted data with the key stored alongside
  3. Aggregated data with small cell counts
  4. Anonymised data Correct answer.

Explanation

Anonymisation means the data can no longer be attributed to an identified or identifiable person by reasonably likely means, taking account of available technology. Pseudonymisation and encryption remain reversible and therefore remain personal data.

Question 8Privacy fundamentals and concepts

Which of the following is a recognised data subject right under modern privacy laws such as the GDPR?

  1. The right to demand deletion of data held under a legal retention obligation
  2. The right to veto any processing by a public authority
  3. The right to receive a share of profits from data sales
  4. The right to access personal data held about oneself Correct answer.

Explanation

A right of access lets individuals obtain confirmation and a copy of their personal data along with related information. Other rights exist, but they are qualified and do not include profit sharing or an absolute veto.

Question 9Privacy fundamentals and concepts

A retailer wants to send marketing emails to existing customers and relies on legitimate interests rather than consent. Which condition is most relevant to whether this is permissible under the ePrivacy rules commonly applied in the EU?

  1. The customer must be a business rather than a consumer.
  2. The product marketed must be identical to the one previously purchased and the customer must have been given an easy opt-out at collection and in each message. Correct answer.
  3. The retailer must obtain a signed paper form from each customer.
  4. The retailer must delete all purchase history before sending.

Explanation

The soft opt-in exception generally allows email marketing of similar products to existing customers where contact details were obtained in a sale, an easy opt-out was offered at collection, and each message allows opting out. It does not require paper forms or deletion of purchase history.

Question 10Privacy fundamentals and concepts

Which situation best illustrates 'further processing' that is incompatible with the original purpose under the purpose limitation principle?

  1. Using a customer's support ticket email to sell that email address to a data broker Correct answer.
  2. Using payroll data to calculate an employee's statutory tax deduction
  3. Using transaction data to detect fraudulent payments for the same account
  4. Using an address provided for delivery to also send a legally required product recall notice

Explanation

Selling contact details to a broker is a new commercial purpose unrelated to the reason the data was collected, so it is incompatible further processing. The other examples are compatible uses tied to the original service or legal duties.

Question 11Privacy fundamentals and concepts

An organisation receives a subject access request from an individual. Which response best reflects the typical requirement?

  1. Refuse any request that mentions more than one data category
  2. Provide only data created in the last seven days
  3. Provide a copy of the personal data and supporting information within the statutory period, after verifying identity Correct answer.
  4. Charge a fee in every case before responding

Explanation

Controllers must verify the requester's identity and then supply the personal data plus information such as purposes and recipients within the statutory deadline, generally one month under the GDPR. Blanket refusals, mandatory fees and arbitrary short lookback windows are not compliant.

Question 12Privacy fundamentals and concepts

Which practice is most consistent with the privacy principle of data protection by design?

  1. Retaining data indefinitely in case it becomes useful
  2. Building default settings that share the minimum data and offering opt-in for optional sharing Correct answer.
  3. Adding a consent checkbox to an existing system after launch
  4. Collecting all available fields so future projects have more data

Explanation

Data protection by design means embedding protections such as data-minimising defaults into systems from the outset. Retrofitting consent or hoarding data does not implement privacy in the design of processing.

Question 13Privacy fundamentals and concepts

What is the practical significance of pseudonymisation for a controller?

  1. It reduces risk and can support security obligations, but the data remains personal data. Correct answer.
  2. It permanently prevents any re-identification.
  3. It removes the data from the scope of privacy law entirely.
  4. It eliminates the need for a legal basis for processing.

Explanation

Pseudonymisation replaces direct identifiers with artificial keys so the data cannot be attributed without additional information kept separately. It lowers risk and is encouraged as a safeguard, but the data remains personal data and still needs a legal basis.

Question 14Privacy fundamentals and concepts

Which legal basis under the GDPR would most appropriately justify processing an employee's bank details to pay their salary?

  1. Legitimate interests of a third party
  2. Performance of a contract Correct answer.
  3. Consent
  4. Vital interests

Explanation

Paying salary is necessary to perform the employment contract, so contract performance is the natural basis. Consent is inappropriate in an employment relationship because of the power imbalance, and the other bases do not fit routine payroll.

Question 15Privacy fundamentals and concepts

A company wants to transfer personal data to a service provider in a country without an adequacy decision. Which mechanism is most commonly used to legitimise the transfer?

  1. Relying on the data subject's general awareness of the company
  2. A verbal assurance from the provider's sales team
  3. Standard contractual clauses approved by the relevant authority Correct answer.
  4. Publishing the data on a public website

Explanation

Where no adequacy decision exists, transfer tools such as standard contractual clauses, with a transfer impact assessment where needed, provide appropriate safeguards. Informal assurances or public disclosure do not meet the requirement.

Question 16Privacy fundamentals and concepts

Which scenario most clearly requires a data protection impact assessment before processing begins?

  1. Paying suppliers through an established accounting system
  2. Systematically monitoring a public area using facial recognition technology Correct answer.
  3. Updating the company's privacy notice wording
  4. Sending a routine internal newsletter to staff

Explanation

A DPIA is required for processing likely to result in high risk, such as large-scale systematic monitoring or innovative technologies like facial recognition in public spaces. Routine administrative processing and notice updates do not meet that threshold.

Question 17Privacy fundamentals and concepts

Which statement correctly describes the relationship between 'privacy' and 'data protection'?

  1. They are identical terms with no meaningful distinction.
  2. Privacy applies only to celebrities, while data protection applies to everyone.
  3. Data protection applies only to paper records, while privacy applies to digital records.
  4. Privacy is a broad right to be let alone, while data protection is a set of rules governing the processing of personal data. Correct answer.

Explanation

Privacy is a broader concept covering personal autonomy and freedom from intrusion, while data protection is the specific legal and organisational framework for handling personal data. The two overlap but are not synonymous.

Question 18Privacy fundamentals and concepts

An online service asks users to consent to cookies. Which practice best supports valid consent?

  1. Requiring users to email the company to withdraw consent
  2. A banner where rejecting is as easy as accepting and granular choices are offered Correct answer.
  3. Pre-ticked boxes for all non-essential cookies
  4. Bundling cookie consent with acceptance of the terms of service

Explanation

Valid consent must be freely given, specific, informed and unambiguous, which means genuine choice with equally easy accept and reject paths and granular options. Pre-ticked boxes, bundling and difficult withdrawal undermine those conditions.

Question 19Privacy fundamentals and concepts

Which pair correctly matches a data subject right with its meaning?

  1. Right to portability - deletion of all data held
  2. Right to rectification - correction of inaccurate personal data Correct answer.
  3. Right to object - automatic approval of every request
  4. Right to erasure - transfer of data to a competitor

Explanation

Rectification allows individuals to have inaccurate personal data corrected and incomplete data completed. Portability concerns receiving and reusing data, objection concerns stopping certain processing, and erasure concerns deletion in defined circumstances.

Question 20Privacy fundamentals and concepts

A marketing team wants to build profiles of website visitors to predict their income bracket for targeted advertising. Which analysis best captures the privacy concern?

  1. Profiling can create high-risk inferences about individuals and may trigger transparency, objection and DPIA obligations. Correct answer.
  2. Profiling is prohibited in all circumstances under privacy law.
  3. Profiling raises no concerns because the data is collected automatically.
  4. Profiling is acceptable as long as the website uses HTTPS.

Explanation

Profiling can produce inferences about individuals, including sensitive attributes, and can be high-risk, so transparency, rights to object and impact assessments may apply. Encryption alone does not address those substantive risks.

Question 21Privacy fundamentals and concepts

Which statement best reflects the accountability principle?

  1. Controllers are exempt from compliance if they are small businesses.
  2. Controllers must notify every processing activity to all data subjects individually.
  3. Controllers may delegate all responsibility to their processors.
  4. Controllers must be able to demonstrate compliance through records, policies and evidence. Correct answer.

Explanation

Accountability requires controllers to take responsibility for compliance and to be able to demonstrate it, for example through records of processing, policies and assessments. It does not create a blanket small-business exemption or transfer responsibility to processors.

Question 22Privacy fundamentals and concepts

An organisation argues that because it has anonymised a dataset, it can ignore a data subject's erasure request for that dataset. Which analysis is most accurate?

  1. Erasure requests never apply to datasets used for analytics.
  2. Any dataset with a unique identifier is automatically anonymous.
  3. Anonymisation is never possible, so erasure always applies.
  4. True anonymisation removes the data from personal data scope, but the organisation must show re-identification is not reasonably likely and that pseudonymised records are not being treated as anonymous. Correct answer.

Explanation

Genuinely anonymous data falls outside personal data rules, but the threshold is strict and context-dependent, and pseudonymised data with re-identification keys remains in scope. Organisations cannot relabel pseudonymised data as anonymous to avoid erasure obligations.

Question 23Privacy fundamentals and concepts

A controller relies on legitimate interests for a new analytics feature. Which approach best reflects the required balancing test?

  1. Rely on the interests of the processor rather than the controller.
  2. Assess the necessity of the processing, weigh it against individuals' reasonable expectations and impact, and offer an opt-out where appropriate. Correct answer.
  3. Assume that any commercial interest automatically outweighs individual interests.
  4. Skip the assessment if the data was obtained from a third party.

Explanation

The legitimate interests basis requires a three-part test: a legitimate interest, necessity of the processing, and a balancing against individuals' interests and reasonable expectations, with safeguards such as opt-outs. Commercial interest does not automatically prevail.

Question 24Privacy fundamentals and concepts

Which situation best demonstrates a conflict between the storage limitation principle and a competing legal obligation?

  1. A hospital deletes treatment records immediately after discharge
  2. A retailer keeps marketing preferences after a customer unsubscribes
  3. A bank keeps transaction records for the period required by anti-money-laundering law despite a general deletion request Correct answer.
  4. A gym keeps expired membership photos for future promotions

Explanation

Storage limitation does not override specific legal retention duties, so a bank may need to retain records for the statutory period even when an individual asks for deletion. The other examples are either unnecessary retention or premature deletion.

Question 25Privacy fundamentals and concepts

An organisation wants to rely on consent for processing that is a condition of receiving a service. Which analysis is most accurate?

  1. Consent is valid only if the data subject is an employee.
  2. Consent is unlikely to be freely given where refusal prevents access to the service, so another basis should be considered. Correct answer.
  3. This is valid because consent is always the strongest legal basis.
  4. Consent is valid if the terms and conditions mention it in small print.

Explanation

Consent must be freely given, and conditioning service access on consent to unnecessary processing undermines that. In such cases the controller should identify a more appropriate basis such as contract performance.

Question 26Privacy fundamentals and concepts

Which term describes the individual to whom a specific item of personal data relates, as understood in data protection law?

  1. Data controller
  2. Data processor
  3. Data subject Correct answer.
  4. Supervisory authority

Explanation

The data subject is the identified or identifiable natural person whose personal data is processed. The controller decides purposes and means, the processor acts on the controller's behalf, and the supervisory authority is the regulator. None of those other roles describes the individual the data is about.

Question 27Privacy fundamentals and concepts

An organisation collects a customer's name together with a randomly generated account number stored in a separate table. Which classification best fits the name?

  1. Anonymous data, because it is stored apart from the number
  2. Non-personal data, because no address was collected
  3. Personal data, because it relates to an identifiable individual Correct answer.
  4. Special category data, because names are sensitive by nature

Explanation

A name is personal data whenever it relates to an identified or identifiable person, regardless of what other fields are collected. Storage in a separate table does not anonymise it, and names are not a special category of sensitive data. The absence of an address is irrelevant to whether the name itself is personal data.

Question 28Privacy fundamentals and concepts

Which concept captures the idea that a person should be able to control how information about them is collected and used?

  1. Information security
  2. Data minimisation
  3. Informational self-determination Correct answer.
  4. Records retention

Explanation

Informational self-determination is the principle that individuals should be able to decide about the disclosure and use of their own information. Security, minimisation, and retention are operational or legal controls that serve privacy but do not express that control-based idea. The concept originates in constitutional privacy thinking and underpins modern data protection.

Question 29Privacy fundamentals and concepts

Which statement best distinguishes a data controller from a data processor?

  1. A controller is always the data subject's employer, while a processor is always a cloud vendor
  2. A controller must be a public body, while a processor may be any private company
  3. A controller only stores data, while a processor decides why it is collected
  4. A controller determines the purposes and means of processing, while a processor acts on the controller's instructions Correct answer.

Explanation

The defining test is decision-making authority: the controller sets the purposes and essential means of processing, and the processor handles data on the controller's behalf. Entity type, sector, and the specific technology used do not determine the role. A processor that goes beyond instructions can itself become a controller for that processing.

Question 30Privacy fundamentals and concepts

A hospital shares patient records with a research institute that will analyse them for a new study. Which factor is most important in deciding whether the institute is a separate controller or a processor?

  1. Whether the institute signs a confidentiality agreement with the hospital
  2. Whether the institute is located in the same country as the hospital
  3. Whether the institute decides the research questions and analytic methods Correct answer.
  4. Whether the institute stores the records on its own servers

Explanation

Determining the research purposes and the essential means of analysis indicates that the institute decides how and why the data is processed, which points to controller status. Hosting location, jurisdiction, and confidentiality contracts are relevant safeguards but do not settle the role question. The decisive element is substantive decision-making authority over purposes and means.

Question 31Privacy fundamentals and concepts

Which situation best illustrates the principle of purpose limitation in practice?

  1. A bank keeps transaction records for the period required by financial regulation Correct answer.
  2. A gym collects health information from members and later sells it to an insurer without telling them
  3. A university collects applicant data and uses it to assess admissions as announced
  4. A retailer collects an email address for order updates and also uses it for unrelated advertising without a compatible basis

Explanation

Purpose limitation requires that data collected for specified purposes not be used for incompatible new purposes; retention mandated by law is a separate, specified purpose and is compatible. Selling data to an unrelated party or repurposing it for unrelated advertising without a lawful basis breaches the principle. Using data for the purpose announced at collection is consistent with it but does not illustrate a limitation scenario.

Question 32Privacy fundamentals and concepts

A controller wants to reduce risk while still being able to re-identify records internally for fraud checks. Which approach best fits the concept of pseudonymisation?

  1. Replacing identifiers with tokens and keeping the mapping key separately under strict access controls Correct answer.
  2. Deleting all identifiers permanently so records can never be linked to anyone
  3. Aggregating records into group totals so individual rows no longer exist
  4. Encrypting the entire database and discarding the decryption key after loading

Explanation

Pseudonymisation replaces direct identifiers with tokens while a mapping key is kept separately, so re-identification remains possible under controls. Permanent deletion of identifiers and key destruction produce anonymisation, removing the ability to re-link. Aggregation also removes individual-level records rather than pseudonymising them.

Question 33Privacy fundamentals and concepts

Which statement best explains why 'privacy' is broader than 'data protection'?

  1. Privacy covers only information held in digital systems, while data protection covers paper records
  2. Data protection applies only to governments, while privacy applies only to companies
  3. Privacy concerns a wider set of interests including bodily and territorial matters, while data protection focuses on processing of personal data Correct answer.
  4. Privacy is a technical standard, while data protection is a marketing term

Explanation

Privacy is a broad concept spanning bodily, spatial, and informational interests, whereas data protection is a narrower legal regime governing the processing of personal data. Data protection rules cover both digital and paper records, and they apply to private and public organisations alike. Treating the two as identical obscures this difference in scope.

Question 34Privacy fundamentals and concepts

A controller is designing a new loyalty app and wants to embed privacy protections from the outset. Which action most directly reflects data protection by design?

  1. Conducting a privacy review only after the app has launched to users
  2. Adding a longer privacy notice at the end of the development cycle
  3. Setting default settings that collect the minimum data needed and require users to opt in to sharing Correct answer.
  4. Assigning privacy responsibility to the legal team alone after launch

Explanation

Data protection by design means building safeguards such as privacy-protective defaults and minimisation into the system before and during development. Post-launch reviews, late documentation, and delegating responsibility to one team after the fact are reactive measures. The principle requires proactive technical and organisational choices embedded in the design.

Question 35Privacy fundamentals and concepts

An organisation wants to rely on a lawful basis for processing that is genuinely optional for the individual. Which characteristic is essential for consent to be valid?

  1. It must be bundled with the terms of service so users accept everything together
  2. It must be specific, informed, and given freely, with an easy way to withdraw Correct answer.
  3. It must be documented only verbally to avoid creating records
  4. It must be obtained once and remain valid indefinitely without renewal

Explanation

Valid consent requires a specific, informed indication of wishes given freely, and the individual must be able to withdraw it as easily as it was given. Bundling consent with service terms undermines freeness, and consent is not permanent. Verbal-only documentation also fails to demonstrate consent when challenged.

Question 36Privacy fundamentals and concepts

A company plans to use biometric facial recognition to verify employee attendance. Which analysis best reflects the privacy risk profile of this processing?

  1. It is low risk because employees are adults who understand the technology
  2. It is automatically permitted because attendance recording is a normal employment function
  3. It involves special category data and continuous monitoring, so it warrants heightened scrutiny and a necessity assessment Correct answer.
  4. It is low risk provided the data is stored on company servers rather than in the cloud

Explanation

Biometric data used for unique identification is a special category, and attendance monitoring adds a surveillance dimension, so the processing needs a documented necessity and proportionality assessment. Employment context does not remove the need for a lawful basis and safeguards. Storage location alone does not mitigate the sensitivity or monitoring risk.

Question 37Privacy fundamentals and concepts

Which scenario best illustrates the transparency principle in operation?

  1. A controller collects additional data silently to improve its services
  2. A controller hides data collection details in a lengthy contract to avoid alarming users
  3. A controller refuses to explain its processing because the data is pseudonymised
  4. A controller publishes a clear notice explaining what data it collects, why, and how long it keeps it Correct answer.

Explanation

Transparency requires clear, accessible information about the purposes, categories, and retention of personal data so individuals can understand the processing. Concealing details, silent collection, and refusing to explain all undermine that requirement. Pseudonymisation reduces risk but does not remove the duty to inform.

Question 38Privacy fundamentals and concepts

A company argues that because it has aggregated its customer data into statistics, it can treat the dataset as outside data protection law. Which response is most accurate?

  1. Aggregation may reduce risk, but the data remains personal data if individuals can still be identified by reasonably likely means Correct answer.
  2. Aggregation always removes legal obligations, so the company is correct
  3. Aggregation is prohibited unless every customer gives fresh consent
  4. Aggregation converts personal data into special category data

Explanation

Aggregation is a risk-reduction technique, but the legal classification depends on whether individuals remain identifiable by reasonably likely means, including combining the data with other available information. Aggregation is neither a blanket exemption nor a prohibited practice. It also does not transform data into a special category.

Question 39Privacy fundamentals and concepts

Which pair correctly matches a privacy principle with its practical implication?

  1. Accountability - responsibility for compliance rests solely with the data subject
  2. Data minimisation - collect as much data as possible in case it becomes useful
  3. Storage limitation - data should be kept no longer than necessary for the stated purpose Correct answer.
  4. Accuracy - outdated records may be left uncorrected if they are archived

Explanation

Storage limitation requires that personal data be kept only as long as needed for the purpose, after which it should be deleted or anonymised. Minimisation calls for collecting only what is necessary, accuracy requires correcting inaccurate data, and accountability places responsibility on the controller. The other pairings invert or misstate their principles.

Question 40Privacy fundamentals and concepts

A controller receives a request to erase personal data that it also must retain to comply with a tax law. Which analysis best reflects how the principles interact?

  1. The legal retention obligation can justify continued storage of the specific data required, while other data should be handled per the request Correct answer.
  2. The controller should delete the tax records and accept any regulatory penalty
  3. The retention obligation allows the controller to keep all data about the individual indefinitely
  4. The erasure request must always be granted immediately, regardless of other laws

Explanation

Erasure rights are not absolute; where a legal obligation requires retention, the controller may keep the specific data needed to comply while addressing the rest of the request. Retention obligations are purpose-specific and do not authorise indefinite storage of everything. Deleting legally required records would itself breach the law.

Question 41Indian privacy and data protection legal framework

Under the Digital Personal Data Protection Act, 2023, which term refers to the individual to whom the personal data relates?

  1. Significant Data Fiduciary
  2. Data Principal Correct answer.
  3. Data Processor
  4. Data Fiduciary

Explanation

The DPDP Act, 2023 uses 'Data Principal' to describe the natural person to whom the personal data relates, and the Act also recognises the exercise of rights on behalf of a child or a person with disability through a lawful guardian. The other three terms describe entities that determine or process data rather than the individual.

Question 42Indian privacy and data protection legal framework

Which legislation in India governs the processing of personal data and gives Data Principals rights such as access, correction and grievance redressal?

  1. The Information Technology Act, 2000
  2. The Consumer Protection Act, 2019
  3. The Digital Personal Data Protection Act, 2023 Correct answer.
  4. The Right to Information Act, 2005

Explanation

The Digital Personal Data Protection Act, 2023 is India's comprehensive statute on processing digital personal data and confers rights on Data Principals, including the right to access information, correction and erasure, grievance redressal, and nomination. The IT Act, 2000 addresses cyber offences and electronic signatures and predates this dedicated framework.

Question 43Indian privacy and data protection legal framework

A company wants to process a user's personal data. Under the DPDP Act, 2023, what is the primary lawful basis for such processing?

  1. Registration with a self-regulatory body
  2. The consent of the Data Principal, or certain legitimate uses Correct answer.
  3. Approval from the Data Protection Board of India
  4. A court order in every instance

Explanation

Section 4 of the DPDP Act, 2023 permits processing only for a lawful purpose where the Data Principal has given consent or where the processing falls within the enumerated legitimate uses. Consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action.

Question 44Indian privacy and data protection legal framework

Under the DPDP Act, 2023, which body is established to inquire into breaches and impose penalties on Data Fiduciaries?

  1. The Telecom Regulatory Authority of India
  2. The Competition Commission of India
  3. The Securities and Exchange Board of India
  4. The Data Protection Board of India Correct answer.

Explanation

The DPDP Act, 2023 establishes the Data Protection Board of India as the adjudicating authority that inquires into personal data breaches and imposes monetary penalties. It is a digital-by-design body distinct from sectoral regulators.

Question 45Indian privacy and data protection legal framework

A Data Fiduciary must give a Data Principal a notice before seeking consent. Which of the following is a required content element of that notice under the DPDP Act, 2023?

  1. The names of all other Data Principals
  2. The purpose of processing and the manner of exercising rights Correct answer.
  3. The fiduciary's marketing strategy
  4. The fiduciary's internal audit reports

Explanation

Section 5 requires the consent notice to state the personal data sought, the purpose of processing, and the manner in which the Data Principal may exercise rights and complain to the Board. The notice must be in clear and plain language and available in English or any language listed in the Eighth Schedule.

Question 46Indian privacy and data protection legal framework

A Data Fiduciary wants to use a user's data for a new purpose not covered by the original consent. What does the DPDP Act, 2023 require?

  1. Only an email informing the user after processing begins
  2. Nothing, because consent is perpetual once given
  3. Approval from the Data Protection Board before processing
  4. Fresh consent for the new purpose, since consent must be specific Correct answer.

Explanation

Consent under the DPDP Act, 2023 must be free, specific, informed, unconditional and unambiguous. Using data for a materially different purpose exceeds the scope of the original consent and requires fresh consent supported by a new notice.

Question 47Indian privacy and data protection legal framework

Which of the following best describes the 'legitimate uses' under the DPDP Act, 2023 that permit processing without consent?

  1. Only processing by foreign governments
  2. Specified situations such as state functions, legal obligations, medical emergencies and employment purposes Correct answer.
  3. Any commercial purpose the fiduciary finds profitable
  4. Processing of anonymised data for research

Explanation

Section 7 of the DPDP Act, 2023 lists legitimate uses that allow processing without consent, including voluntary provision of data, state functions and services, legal obligations, compliance with judgments, medical emergencies, safety during disasters, and employment-related purposes. These are specific and exhaustive categories, not a general commercial exception.

Question 48Indian privacy and data protection legal framework

A Data Fiduciary is a Significant Data Fiduciary. Which additional obligation is specifically imposed on it by the DPDP Act, 2023?

  1. Appointing a Data Protection Officer based in India Correct answer.
  2. Publishing its annual profits
  3. Transferring all data abroad
  4. Charging users for data access

Explanation

A Significant Data Fiduciary must appoint a Data Protection Officer based in India who reports to its board, along with other duties such as an independent data auditor and periodic impact assessments. These enhanced obligations reflect the higher risk associated with its processing.

Question 49Indian privacy and data protection legal framework

Under the DPDP Act, 2023, how is a Data Principal's consent withdrawal treated?

  1. It transfers ownership of the data to the fiduciary
  2. It requires a court order
  3. It must be as easy to withdraw as to give, and processing must stop unless another lawful basis applies Correct answer.
  4. It has no effect once processing has begun

Explanation

Section 6 provides that a Data Principal may withdraw consent at any time, and the ease of withdrawal must be comparable to the ease of giving consent. On withdrawal, the Data Fiduciary must cease processing unless a separate lawful basis, such as a legitimate use, applies.

Question 50Indian privacy and data protection legal framework

Which of the following is a right available to a Data Principal under the DPDP Act, 2023?

  1. The right to demand compensation from other Data Principals
  2. The right to compel the fiduciary to delete all records of a past transaction
  3. The right to veto any future legislation
  4. The right to obtain a summary of personal data processed and the identities of Data Fiduciaries with whom it was shared Correct answer.

Explanation

Section 11 gives Data Principals the right to access a summary of the personal data processed, the identities of all Data Fiduciaries with whom it has been shared, and a description of the data. Related rights include correction, erasure, grievance redressal and nomination.