DSCI DCPP study plan

Define the core vocabulary of privacy (personal data, processing, controller, processor, data subject) and write your own one-sentence definition for each without looking at notes

Map the DPDP Act's key obligations (notice, consent, purpose limitation, data minimisation, accuracy, storage limitation, security, grievance redressal) to the corresponding privacy principle each one implements

Distinguish consent, legitimate use, and state/legal exemptions under the DPDP Act using three worked scenarios you write yourself

List the categories of rights the DPDP Act gives Data Principals and compare them against the GDPR rights list in a two-column table

Outline the DPDP Act's structure chapter by chapter and note which sections create duties for Data Fiduciaries versus which create rights or remedies

Explain the role, composition, and enforcement powers of the Data Protection Board of India in your own words

Trace the significance of the DPDP Rules on procedural mechanics (notice content, consent manager registration, breach notification timelines) and flag anything still open to change

Compare the DPDP Act with the earlier SPDI Rules framework and identify what changed for organisations handling sensitive data

Draft a 300-word plain-language summary of the Indian regime suitable for a non-lawyer colleague

Classify the DPDP Act's penalty tiers by obligation breached and memorise the maximum amounts associated with each category

Explain the special protections for children's data and how verifiable parental consent is expected to work

Describe the cross-border transfer approach under the DPDP Act and contrast it with GDPR adequacy decisions and SCCs

Summarise how sectoral regulators (RBI, SEBI, IRDAI, TRAI) add privacy-adjacent obligations on top of the DPDP Act

Answer 20 mixed scenario questions on Indian law and record your reasoning for each

Compare GDPR, DPDP Act, CCPA/CPRA, LGPD, and PIPL across lawful basis, data subject rights, breach timelines, and transfer mechanisms in a single matrix

Explain the GDPR's seven principles and how each maps onto at least one DPDP Act provision

Walk through the Schrems II consequences for transfers and describe when SCCs, BCRs, or derogations are the appropriate tool

Identify what makes a country's law 'adequate' and list the practical steps an organisation takes before relying on adequacy

Draft a 400-word briefing on the compliance tension between GDPR's data localisation-adjacent expectations and India's transfer regime

Structure a privacy programme using the NIST Privacy Framework or IAPP-style accountability model, naming owners for each function

Write a data inventory and record-of-processing template with fields that satisfy both DPDP Act and GDPR record-keeping needs

Design a consent lifecycle: collection, recording, withdrawal, and downstream propagation to processors

Build a third-party due-diligence checklist for processors and sub-processors including audit rights and breach notification clauses

Produce a 12-month privacy training and awareness calendar segmented by role (engineering, marketing, HR, support)

Draft a DPIA methodology with screening criteria, risk scoring, and sign-off gates, then apply it to a hypothetical profiling use case

Write a privacy notice for a fictional app that satisfies DPDP Act notice requirements in plain language

Map the incident response lifecycle (detect, contain, assess, notify, remediate, learn) and specify who decides to notify and on what timeline

Compare breach notification duties across DPDP Act, GDPR (72 hours), and US state laws in a decision table

Design key privacy metrics (consent rates, DSAR turnaround, vendor coverage, training completion) and set target thresholds

Apply privacy-by-design and data-minimisation principles to a feature spec, documenting three concrete design changes

Explain pseudonymisation, anonymisation, tokenisation, and encryption at rest/in transit, and state which one satisfies which legal requirement

Describe how to operationalise data subject access and deletion requests end to end, including systems that are hard to reach

Set up a personal data retention schedule with justification for each retention period

Revisit week 1 concepts and correct any definitions you now see were imprecise

Take two full-length timed practice exams and score each domain separately to find weak areas

Re-study your two lowest-scoring domains using your own week 1-7 deliverables as the source material

Recite from memory the DPDP Act penalty tiers, breach timelines, and transfer rules without notes

Build a one-page pre-exam sheet of the 20 facts you most often got wrong

Simulate explaining the Indian regime to a sceptical executive in five minutes