Data Protection (DPDP Act) and Regulatory Compliance
This domain tests the Digital Personal Data Protection Act, 2023 and how it layers over RBI, CERT-In and sectoral obligations in a financial entity.
Core rules
- The Act covers digital personal data processed in India, and processing outside India that relates to offering goods or services to data principals in India.
- Roles: Data Principal (the individual), Data Fiduciary (who determines purpose and means), Data Processor (who acts for the fiduciary), Consent Manager (registered, accountable to the principal), and Significant Data Fiduciary - notified on volume, sensitivity and risk, with extra duties of DPIA, periodic audit, an India-based DPO and algorithmic due diligence.
- Consent must be free, specific, informed, unconditional and unambiguous, with clear affirmative action, and notice must be available in the languages listed in the Eighth Schedule. Legitimate uses such as voluntary provision, state functions, employment and medical emergencies do not need consent.
- Rights: access, correction, erasure, grievance redressal and nomination. Duties of the fiduciary: accuracy, security safeguards, breach intimation to the Data Protection Board and affected principals, and erasure on withdrawal.
- Children under 18 need verifiable parental consent, and behavioural tracking or targeted advertising directed at children is barred. Cross-border transfer is permitted except to countries on the Central Government's negative list. Penalties reach ₹250 crore for failure of security safeguards, adjudicated by the Data Protection Board.
Worked example
A bank's KYC vendor misconfigures storage, exposing 50,000 customers' PAN data. The bank is the Data Fiduciary and the vendor a Processor. Steps: contain and preserve evidence, intimate the Data Protection Board and affected principals without delay, run the CERT-In 6-hour report in parallel, and assess contractual recovery from the vendor. Erasure requests cannot override statutory record retention under KYC and PMLA rules.
Traps that cost marks
Importing GDPR concepts such as mandatory DPOs for every fiduciary. Believing consent is the only lawful basis. Forgetting that retention laws override erasure. Overlooking children's data. Assuming penalties are one-off rather than per breach.