Quiz 3: Advanced — DPDP Act 2023 Compliance

Question 1 of 5

A company collects personal data from its loyalty programme members before the DPDP Act comes into force. After commencement, it wants to continue processing this data. What must it do?

AObtain fresh consent from all existing members before the Act's commencement date BSend a consent notice to existing members explaining the data held and processing purposes, giving them the opportunity to withdraw; existing members who do not withdraw are treated as having given deemed consent CDelete all pre-Act data and restart data collection under the new regime DNo action is required — pre-Act data is grandfathered permanently

Question 2 of 5

A company's privacy policy states it will share user data with 'trusted partners for marketing purposes.' A user consents to this policy. Is this sufficient consent for data sharing with third-party advertisers under the DPDP Act?

AYes — the policy discloses data sharing and the user consented BNo — consent must be specific to the purpose; 'trusted partners for marketing' is insufficiently specific to constitute valid consent under the Act CYes — consent to a comprehensive privacy policy covers all disclosed uses DNo — data sharing with any third party requires a separate data sharing agreement, not just consent

Question 3 of 5

A startup's product team argues that since the DPDP Rules have not been fully notified, DPDP compliance can be deferred. Is this correct?

AYes — the Act's obligations only apply once all Rules are notified BNo — the Act's primary obligations (consent, security safeguards, breach notification, Data Principal rights) apply from the date of commencement; Rules specify operational details but do not suspend core obligations CYes — MeitY has issued a blanket deferral for startups DNo — only the Rules relating to Significant Data Fiduciaries can be deferred

Question 4 of 5

A healthcare startup processes data for medical diagnosis. A patient withdraws consent. The startup argues it must retain the data for medical record-keeping under the Clinical Establishments Act. Which position is correct?

AThe patient's consent withdrawal overrides all other legal requirements; data must be deleted BThe startup may retain the data to the extent required by applicable law, even after consent withdrawal; the retention in that case is based on a legal obligation, not consent CThe startup must anonymise the data and may retain the anonymised version DThe startup must seek a fresh consent from the patient for the retention purpose

Question 5 of 5

A company engages a foreign cloud provider to host its customer data. Under the DPDP Act, which of the following most accurately describes the company's obligations?

AThe company has no DPDP obligations for data hosted outside India BThe company remains the Data Fiduciary and must ensure the foreign cloud provider is contractually bound to DPDP-equivalent obligations through a Data Processing Agreement CThe foreign cloud provider assumes Data Fiduciary obligations once it hosts the data DThe company must obtain explicit government approval for each cloud provider engagement

Quiz 3 — Advanced