Quiz 2: Final Assessment — DPDP Act 2023 Compliance

Question 1 of 10

The DPDP Act 2023 applies to the processing of personal data outside India when the processing is in connection with:

AAny activity involving Indian currency BOffering goods or services to Data Principals within India CAny activity conducted by an Indian-incorporated entity DBusiness activities that affect India's GDP

Question 2 of 10

Which of the following is a Data Processor's obligation under the DPDP Act?

AObtaining consent from Data Principals independently BAppointing a Data Protection Officer CProcessing data only under the Data Fiduciary's instructions and assisting with breach notification and rights fulfilment DPublishing a publicly accessible privacy policy

Question 3 of 10

Which of the following categories of Data Principal requires verifiable parental consent before their data can be processed?

AData Principals below the age of 25 BData Principals below the age of 18 (or a lower age if notified by the government) CData Principals who are students DData Principals who are first-time digital service users

Question 4 of 10

A startup processes personal data of its Indian customers using cloud servers in Germany. Under the DPDP Act, what is the most important compliance step for this cross-border transfer?

AObtaining a data transfer license from MeitY BEnsuring Germany is on the government's whitelist of permitted transfer destinations, once notified CFiling a cross-border transfer declaration with the RBI DAnonymising all data before transfer to Germany

Question 5 of 10

A company is designated as a Significant Data Fiduciary. Which of the following obligations applies to it that does NOT apply to a regular Data Fiduciary?

AObligation to respond to Data Principal rights requests BObligation to implement security safeguards CObligation to appoint a Data Protection Officer based in India DObligation to provide a consent notice before processing

Question 6 of 10

The DPDP Act's legitimate uses allow processing without consent for which purpose?

ATargeted digital advertising based on browsing history BProcessing by the state for provision of subsidies, licences, and benefits CMarket research about individual consumer behaviour DPersonalisation of streaming content recommendations

Question 7 of 10

A company discovers a breach that exposed 500 customers' payment data. The most time-sensitive obligation under the DPDP Act is:

AFiling an FIR with the local police BNotifying the Data Protection Board within the prescribed timeline CInforming the company's insurance provider DCommissioning a third-party forensic audit

Question 8 of 10

A company's consent notice states: 'By using our app, you consent to all uses of your data, now and in the future.' Is this valid consent under the DPDP Act?

AYes — broad consent is acceptable if disclosed in a notice BNo — consent must be specific to a stated purpose, not a catch-all for undefined future uses CYes — the consent was obtained through an affirmative action (using the app) DNo — app-based consent is not valid under the Act

Question 9 of 10

The Data Protection Board's enforcement process is primarily:

AConducted through physical courtroom hearings in New Delhi BDesigned as a digital, online process without mandatory physical appearances CDelegated to state-level privacy commissioners DConducted through the ordinary civil courts

Question 10 of 10

Which of the following is the most accurate comparison between DPDP Act and GDPR?

ADPDP is identical to GDPR and organisations that are GDPR compliant are automatically DPDP compliant BDPDP has fewer legal bases for processing, no right to data portability, and no mandatory DPO for non-SDF entities, but comparable penalty exposure CGDPR has higher penalties than DPDP and is the stricter framework for Indian businesses DDPDP requires data localisation for all personal data, unlike GDPR

Quiz 2 — Final Assessment