Find any section, rule or FAQ in the Rules Ready Reckoner
Type at least 3 characters to search the Rules Ready Reckoner.
⚖️
Educational Content - Not Legal Advice
Please read before continuing
This programme is provided by SkillsDA for general educational and corporate compliance training purposes only.
It does not constitute legal advice and does not create a lawyer-client or advisory relationship.
It is not affiliated with, endorsed by, or issued by the Ministry of Electronics & IT (MeitY), the Government of India, or the Data Protection Board of India.
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (including phased effective dates) may be amended or clarified after this content was last reviewed. See the content version note in Resources.
Before relying on this material for any compliance decision, verify the current position using official sources (MeitY, e-Gazette, PIB) and consult a qualified lawyer or your organisation's Data Protection Officer / compliance lead.
The certificate issued is a Certificate of Completion of this corporate training programme only - not a government licence, statutory authorisation, or professional-body credential (e.g. not equivalent to industry-body DPO certifications).
🔒The course content is for your own learning. Please do not copy, screenshot, record or share it. Course pages show your learner ID.
DPDP Awareness Training and Certification
Understand India's data protection law - in your own language.
A practical, role-based training guide to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Learn what applies to your sector and your job, practise on realistic scenarios, then prove it in a final assessment.
Curriculum
From first principles to AI
Start with the framework and definitions, work through duties and rights, then apply it to consent, enforcement and automated processing.
1
DPDPA Framework, Scope & Key Definitions
2
Grounds for Processing Personal Data
3
General Obligations of the Data Fiduciary
4
Rights & Duties of Data Principals
5
Child & Vulnerable Data Subjects
6
Significant Data Fiduciaries (SDF)
7
Penalties, Board & Enforcement
8
Operationalizing Compliance
9
Consent Management Under DPDPA
10
Dos and Don'ts
11
Case Studies for Assessment
12
DPDPA Compliance for AI, ML & Automated Processing
Languages · Powered by Live BHASHINI
Learn in the language you think in
Pick your language here and the course opens in it when you start. You can switch any time inside the course across all 23 languages.
Live Neural Machine Translation (NMT) & Transliteration powered by BHASHINI. Legal citations and the Act and Rules remain in their official text.
How it works
Built around your job, not a generic syllabus
Tell us your context
Choose your industry sector, sub-sector and role so the content matches the data you handle.
Work through the modules
Short lessons with a quiz after each, and a dashboard that tracks progress and weak areas.
Practise on scenarios
Role-based simulations and case studies put the law to work.
Get certified
Pass the final exam and receive your SkillsDA certificate.
Pricing
Plans for individuals and organisations
Every plan includes all modules, all 23 languages, simulations, the final exam and the certificate.
Seats
Discount
Price per learner
Prices shown as “₹ ____” are not set yet - fill them in the PRICING block at the top of this page's script.
Contact
Talk to us
For enterprise quotes, bulk enrolments, or any question about the programme.
DPDPAThe Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) - India's primary law governing how organisations collect, use, and protect personal data. Awareness Training
Your personalised compliance learning portal for India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
✓ Signed in
Based on DPDPAThe Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) - India's primary law governing how organisations collect, use, and protect personal data. 2023 (No. 22 of 2023) & DPDP Rules 2025The Digital Personal Data Protection Rules, 2025 - the operating rules notified on 13 Nov 2025 that implement the DPDPA, including consent, breach, and DPO requirements.
Course Dashboard
Your progress, your modules and your badges at a glance
0 of 0 modules completed0%
💡 Today's Compliance Keypoint
🧭 Role-Based Compliance
What DPDPA means for your specific role - top daily actions and common pitfalls, tailored to .
🏅 Achievement Badges
📚 Your Training Modules
📋
All modules completed!
You have completed all mandatory training modules. Complete the Final Assessment Exam to earn your certificate.
🏆
Training Complete!
You passed the Final Assessment. Your certificate is ready.
Official sources, a DPDP Rules 2025 summary, glossary, and case studies
⚠️
Information provided in this training program is for general educational and training purposes only. It does not constitute legal advice, and using it does not create a lawyer-client or advisory relationship. View full disclaimer
The Board's constitution and digital functioning (Rules 17-21) are in force from 13 Nov 2025. MeitY is operationalising the Board and its complaint portal - check the MeitY link above for updates once published.
📋 DPDP Rules, 2025 - Summary
Phased Implementation Timeline
Phase
Rules
Effective
Covers
Phase I
Rules 1, 2, 17-21
13 Nov 2025 (immediate)
Definitions, plus the constitution, appointment, procedures & digital functioning of the Data Protection Board of India.
Phase II
Rule 4
13 Nov 2026 (+12 months)
Registration, eligibility (₹2 Cr minimum net worth) and operational obligations of Consent Managers.
Phase III
Rules 3, 5-16, 22, 23
13 May 2027 (+18 months)
Notice & consent, security safeguards, breach notification, retention & erasure, children's/vulnerable persons' consent, Significant Data Fiduciary obligations, Data Principal rights, cross-border transfer, exemptions, and appeals - the bulk of day-to-day compliance obligations.
Key Themes
✓Standalone, itemised, plain-language notice (Rule 3) - consent can no longer be buried inside long Terms of Service.
✓A registered Consent Manager ecosystem (Rule 4) for interoperable consent dashboards, live from Nov 2026.
✓Two-stage breach notification (Rule 7): "without delay" intimation, then a detailed report to the Board within 72 hours.
✓Objective retention & erasure triggers (Rule 8) with a mandatory 48-hour pre-erasure notice to the Data Principal.
✓Enhanced obligations for Significant Data Fiduciaries (Rule 13): India-based DPO, annual DPIA + audit, algorithmic accountability.
✓Enforceable Data Principal rights (Rule 14): access, correction, erasure, nomination and grievance redressal.CRITICAL PENALTY
🔤 Terms You Should Know
A quick-reference glossary of the core defined terms used throughout this training and across the DPDPA 2023 & DPDP Rules 2025.
Term
What it means
Anonymisation
Processing personal data so that no data principal can be identified, whether directly or indirectly - anonymised data falls outside DPDPA's scope since it is no longer "personal data."
Appeal to TDSAT (S.29)
The Telecom Disputes Settlement and Appellate Tribunal is the designated appellate forum for a Data Fiduciary or Data Principal to challenge an order or penalty issued by the Data Protection Board of India.
Board
The Data Protection Board of India - the adjudicatory body set up under the Act to enforce compliance, hear complaints, impose penalties, and direct breach remediation. Its constitution and digital functioning took effect from 13 Nov 2025.
Certain Legitimate Uses (S.7)
Specific situations where a Data Fiduciary may process personal data without obtaining consent - e.g. voluntarily provided data for a stated purpose, State functions/benefits, medical emergencies, employment purposes, and compliance with law.
Consent (S.6)
Free, specific, informed, unconditional and unambiguous affirmation with clear consenting action, signifying agreement to processing limited to the stated purpose - and only as much data as is necessary for that purpose.
Consent Artefact
The record generated when a Data Principal gives, manages, reviews or withdraws consent - typically through a Consent Manager's interoperable platform.
Consent Manager (S.2(g), Rule 4)
An entity registered with the Board that acts as a single point of contact, enabling a Data Principal to give, manage, review and withdraw consent through an accessible, transparent, interoperable platform. Must be a company with ≥₹2 Cr net worth; live from 13 Nov 2026.
Cross-Border Data Transfer (S.16)
Transfer of personal data outside India, permitted by default except to countries the Central Government specifically restricts by notification.
Data Fiduciary (S.2(i))
Any person who, alone or jointly with others, determines the purpose and means of processing personal data. Carries the primary compliance obligations under the Act.
Data Fiduciary's General Obligations (S.8)
The baseline duties every Data Fiduciary carries regardless of size or sector - ensuring data accuracy, implementing reasonable security safeguards (S.8(5)), notifying breaches (S.8(6)), and remaining liable even where a Processor or third-party certification (e.g. ISO 27001, SOC 2) is involved.
Data Principal (S.2(j))
The individual to whom the personal data relates. Includes, in the case of a child, the parent or lawful guardian, and in the case of a person with disability, their lawful guardian.
Data Processor (S.2(k))
Any person who processes personal data on behalf of a Data Fiduciary, e.g. under a service contract. Processor obligations flow through contractual terms with the Fiduciary rather than directly under most sections of the Act.
Data Protection Impact Assessment (DPIA)
A structured assessment of the risk to Data Principals' rights from a processing activity, weighed against its benefit - a mandatory annual obligation for Significant Data Fiduciaries under Rule 13.
Data Protection Officer (DPO)
For a Significant Data Fiduciary, an individual based in India who reports to the Board of Directors (or equivalent governing body) and serves as the point of contact for grievance redressal under S.13 - distinct from the Board (Data Protection Board of India).
Deemed Consent
An earlier draft-stage concept largely superseded in the enacted Act by "Certain Legitimate Uses" (S.7) - included here as a term you may still see referenced in pre-2023 commentary or older training materials.
Duties of the Data Principal (S.15)
Statutory obligations placed on the individual, not just the organisation - including not impersonating another person, not suppressing material information, and not filing false or frivolous grievances/complaints. Breach carries a LOW PENALTY and gives Data Fiduciaries a legitimate defence against bad-faith actors.
Grievance Officer / Grievance Redressal (S.13)
The Data Fiduciary's designated contact for a Data Principal to raise and have grievances addressed, with a response required within the timeline prescribed by rules.
Nomination (S.14)
A Data Principal's right to nominate another individual to exercise their rights under the Act in the event of death or incapacity.
Notice (Rule 3)
A standalone, itemised, plain-language communication to the Data Principal at or before the point of seeking consent - must be separable from other information such as Terms of Service, not bundled.
Penalty Schedule (S.33)
The Act's tiered monetary penalty structure, adjudicated by the Board - a CRITICAL PENALTY for failing to implement reasonable security safeguards, a HIGH PENALTY for breach-notification failures, a HIGH PENALTY for Significant Data Fiduciary non-compliance, and a MEDIUM PENALTY for any other provision. Penalties are financial only - the Act itself has no criminal/imprisonment provisions.
Personal Data (S.2(t))
Any data about an individual who is identifiable by or in relation to such data. DPDPA does not create a separate "sensitive personal data" category - all personal data attracts the same statutory obligations.
Personal Data Breach (S.2(u))
Any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data, that compromises its confidentiality, integrity or availability.
Processing (S.2(x))
A wholly or partly automated operation or set of operations performed on digital personal data - including collection, recording, organisation, storage, use, sharing, and erasure.
Reasonable Security Safeguards (Rule 6)
The seven minimum measures a Data Fiduciary must implement: encryption/masking/tokenisation, access control, monitoring & logging, backup/business-continuity, 1-year log retention, contractual security terms with Processors, and organisational policies & training.
Retention & Erasure (Rule 8)
Objective triggers (such as purpose fulfilment or a defined inactivity period) after which personal data must be erased, subject to a mandatory 48-hour advance notice to the Data Principal before erasure.
Right to Access Information (S.11)
A Data Principal's right to obtain a summary of their personal data being processed, the processing activities undertaken, and identities of Data Fiduciaries/Processors it has been shared with.
Right to Correction and Erasure (S.12)
A Data Principal's right to have inaccurate or incomplete personal data corrected, and to have it erased once it is no longer necessary for the stated purpose (subject to legal retention requirements).
Service Blocking Power (S.37)
After the Board imposes monetary penalties on an entity two or more times and advises that it is in the interest of the general public, the Central Government may direct blocking of that entity's services in India - a potential existential business consequence beyond the financial penalty itself.
Significant Data Fiduciary - SDF (S.10, Rule 13)
A Data Fiduciary notified by the Central Government based on factors like volume/sensitivity of data processed, risk to Data Principal rights, and sovereignty/electoral-integrity concerns. Carries enhanced obligations: India-based DPO, annual DPIA and audit, and algorithmic accountability.
Unlawful Inducement (S.6(9))
Offering a financial or other benefit contingent on giving consent (e.g. "get extra cashback if you consent to sharing your data with partners") - this makes the consent non-"free" and therefore invalid. Loyalty/reward mechanics must be decoupled from consent decisions.
Verifiable Consent (S.9, Rule 9)
The heightened consent standard for processing a child's or person-with-disability's personal data - requires verifiable parental or lawful-guardian consent before processing, and prohibits behavioural tracking/targeted advertising directed at children.
Voluntary Undertaking (S.32)
A proactive compliance mechanism allowing an entity under Board investigation to offer binding commitments to remediate; once accepted by the Board, it bars further proceedings on that same matter.
Withdrawal of Consent (S.6(4))
A Data Principal's right to withdraw consent at any time, with the withdrawal required to be as easy to action as giving consent was - e.g. a Data Fiduciary must stop marketing outreach the moment consent is withdrawn, checked before every subsequent contact.
🗂️ Case Studies & Lessons Learned
A note on sources: The DPDP Act, 2023 has no published Data Protection Board enforcement precedent yet - the Board and its complaint mechanism are still being operationalised, so no organisation has been through a public DPDPA enforcement action. The library below combines realistic, illustrative composites (tagged 🇮🇳 Illustrative DPDPA Scenario) with real, publicly reported Indian data incidents (tagged 📰 Real Reported Incident). Real incidents retain their source notes and tags so they remain clearly distinguishable. Use 🗂️ Show All Case Studies to browse the full library; the cases below are the ones relevant to your role.
⚖️ These case studies are training aids - not legal advice or findings of fact about any real organisation named. They are illustrative scenarios summarised for teaching purposes.
🔄 Content Version & Update Mechanism
DPDPA and the DPDP Rules, 2025 are rolling out in phases through May 2027, and MeitY may issue further notifications, schedules, or clarifications in the meantime - for example, ahead of the Consent Manager go-live on 13 November 2026. To keep this training current, SkillsDA reviews this Resources section against new MeitY/PIB notifications and Gazette amendments on a quarterly cycle, and immediately whenever a materially relevant notification is issued. The version above reflects the most recent review. Always cross-check the Official Sources links above for the current, authoritative text - this page is a training aid, not a substitute for the primary source.
🕒 Learner's Journey
Timestamped record of your activity in this programme, for compliance recordkeeping
ℹ️
Every module you open, every quiz or exam you submit, and every certificate you earn is timestamped and logged below.
📊 Summary
📋 Activity Log
Most recent activity first. Times are recorded in your device's local time zone at the moment each action occurred.
DPDP Awareness Training and Certification
MY LEARNING DASHBOARD
Welcome back,
Your courses, progress, assessments, certificates and invoices in one place.
🎯 Trainer Simulation
Make the call. See the consequence. DPDPA compliance is a judgment skill, not just a fact sheet.
ℹ️
How this works
Each simulation drops you into a realistic compliance situation with a decision to make. Pick an option to see the real-world consequence and the exact DPDPA provision behind it, then move to the next decision point. These are scored but don't affect your module or exam results - they're for practice.
📘 Rules Ready Reckoner
Look up any section of the DPDP Act 2023, the DPDP Rules 2025 and their Schedules, in plain language.
