I85PREP
⌘ K
DSCI DCPP study materials
DSCI DCPP study resources

DSCI DCPP: Indian Privacy and Data Protection Legal Framework

DSCI DCPP · Work through your exam, one topic at a time.

All guide sections

Indian Privacy and Data Protection Legal Framework

Indian privacy law is layered: constitutional principle, the IT Act's security provisions, sectoral regulators, and now a comprehensive statute. DCPP tests your ability to choose the right instrument and apply DPDP roles correctly.

The layers

  • Article 21: K.S. Puttaswamy (2017) read privacy as a fundamental right, with proportionate-processing tests.
  • IT Act 2000: Section 43A (compensation for inadequate security by a body corporate) and the SPDI Rules 2011 (consent, purpose, security, grievance officer for sensitive personal data such as passwords, financial, health, biometric and sexual-orientation data). Sections 72 and 72A criminalise disclosure.
  • DPDP Act 2023: applies to digital personal data processed in India and to processing abroad connected with offering goods or services to Data Principals in India. It introduces Data Principal, Data Fiduciary, Data Processor, Consent Manager and Significant Data Fiduciary (SDF).
  • DPDP Rules 2025: operationalise notice, consent records, breach intimation, SDF duties and Board procedure.
  • Sectoral: RBI, SEBI, IRDAI and TRAI add localisation and outsourcing rules.

Core obligations

Notice in clear language; consent that is free, specific, informed, unconditional and unambiguous; purpose limitation; accuracy; erasure on withdrawal; security safeguards; breach intimation to the Board and affected Data Principals in the prescribed form and manner; grievance redressal. Children under 18 need verifiable parental consent, and behavioural tracking or targeted advertising at children is barred. SDFs must appoint an India-based DPO, run DPIAs, and commission independent audits. Penalties reach ₹250 crore for security-safeguard failures.

Worked example

A hospital app stores health records with a cloud vendor abroad. A patient requests erasure.

  • Patient = Data Principal; hospital = Data Fiduciary; vendor = Data Processor.
  • Erasure must be honoured unless medical-records law requires retention; tell the patient the outcome.
  • The processor contract must mandate security, breach notice and deletion.
  • If the hospital is an SDF, DPIA and audit evidence are needed.
  • Cross-border storage is permitted unless the government restricts the country under Section 16.

Traps

  • Assuming SPDI Rules and DPDP use the same definitions; DPDP has no 'sensitive personal data' category.
  • Expecting an explicit 'right to be forgotten'; DPDP gives erasure on withdrawal or purpose completion.
  • Forgetting that DPDP covers digital data and digitised records, not paper files.