DPDP flash cards and quiz
Ten cards on the DPDP Act and Rules, then eight questions. Tap a card to see the answer.
Flash cards
Quiz
1. When do most DPDP duties for businesses start?
Most duties and the penalties start eighteen months after the 13 November 2025 notifications. Source: G.S.R. 843(E), clause (c); DPDP Rules 2025, Rule 1(4)
2. What starts on 13 November 2026?
Only the Consent Manager rules start that day, one year after the 13 November 2025 notifications. Source: DPDP Rules 2025, Rule 1(3)-(4); G.S.R. 843(E), clause (b)
3. The ₹250 crore maximum penalty is for:
It is the highest fixed cap, set for one breach of the duty to take reasonable security safeguards. Penalties apply from 13 May 2027. Source: DPDP Act 2023, Schedule, item 1; G.S.R. 843(E), clause (c)
4. What is the longest complaint response period you may publish?
From 13 May 2027, the period you publish must be reasonable and no longer than 90 days. Source: DPDP Rules 2025, Rule 14(3); start date Rule 1(4)
5. After a breach, the detailed report must reach the Board within:
From 13 May 2027, within 72 hours of becoming aware of the breach, unless the Board allows longer on a written request. Source: DPDP Rules 2025, Rule 7(2)(b); start date Rule 1(4)
6. For how long, at minimum, must you keep processing logs?
From 13 May 2027, personal data, traffic data and processing logs must be kept at least one year from the date of processing. Source: DPDP Rules 2025, Rule 8(3); start date Rule 1(4)
7. From 13 May 2027, does the DPDP Act require an employer to get consent to use staff data for employment purposes?
Employment purposes are a 'legitimate use', which the Act allows without consent. Source: DPDP Act 2023, s.4(1)(b), s.7(i); G.S.R. 843(E), clause (c)
8. Under the DPDP Act, a child is anyone under:
A child is anyone who has not completed eighteen years of age. Source: DPDP Act 2023, s.2(f)
Next
Check what the Act covers in your business
The DPDP Act timeline: 2025, 2026, 2027
A drafting aid. Get legal advice for your situation.