Privacy Fundamentals and Concepts
Privacy fundamentals is the conceptual spine of DCPP: definitions, principles and the reasoning used to decide whether processing is defensible. Questions typically ask you to classify data, identify the lawful basis for a new use, or spot purpose creep - not to recite a statute.
Principles you must apply
The OECD and GDPR-derived canon runs: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. The DPDP Act 2023 expresses similar ideas through notice, consent, purpose limitation, erasure and accountability, but uses Indian vocabulary (Data Principal, Data Fiduciary).
Distinctions that generate marks
- Personal data vs sensitive data: sensitivity raises safeguards; it does not change whether the data is personal.
- Pseudonymisation vs anonymisation: pseudonymised data stays in scope where re-identification is reasonably possible; anonymised data generally falls outside.
- Consent vs legitimate use: consent must be free, specific, informed, unconditional and unambiguous, by clear affirmative action; it is not a blanket licence for future uses.
- Privacy vs security: security protects confidentiality, integrity and availability; privacy asks whether the processing is justified.
- Privacy by design and default: protections built into the system and the default settings.
Worked example
A lending app collects PAN, bank statements and device location at onboarding for KYC and fraud checks. Six months later marketing reuses the location feed to target loan offers.
- The original notice and consent covered KYC and fraud, not marketing.
- Marketing needs a fresh, specific notice and consent; DPDP's legitimate uses do not include marketing.
- Minimisation challenges continuous location tracking where periodic checks suffice.
- KYC records may be retained for legal obligations; marketing data must be deleted when that purpose ends. Conclusion: purpose limitation is breached; separate consent and a retention rule are required.
Traps
- Treating consent as the only lawful basis, or as permanent.
- Assuming 'publicly available' means unrestricted reuse.
- Confusing a security incident with a reportable personal data breach.