DPDP Rules 2025 Deep Dive / DPO Practitioner

The privacy-facing surface of every product in India. How to write a Rule 3 standalone notice that survives an audit, how the Section 6 consent test actually works in practice, why cookies remain a grey zone, and how Consent Manager registration under Rule 4 changes the consent architecture from November 2026.

1. 1. Notice under Section 5 and Rule 3 11 min
2. 2. The Section 6 consent test and withdrawal architecture 10 min
3. 3. Cookies and the India grey zone 8 min
4. 4. Consent Manager registration under Rule 4 and the MeitY six 10 min

Data discovery, records of processing, and the retention regime introduced by Rule 8 and the Third Schedule. The specific-purpose test for erasure, the 3-year inactivity clock for e-commerce, gaming and social media platforms, the 48-hour pre-erasure notice, and how to layer retention across DPDP, sectoral rules and the Seventh Schedule government-security exception.

1. 1. Data discovery and classification 9 min
2. 2. Building a DPDP-fit Record of Processing Activities 10 min
3. 3. Rule 8 retention and the Third Schedule 12 min
4. 4. Layered retention across DPDP and sectoral rules 8 min

Access, correction, erasure, grievance and nomination as an operational workflow. Identity verification without over-collection, the internal SLA design that stays inside the 90-day hard cap, the escalation path from Fiduciary to Board, and Section 15 Data Principal duties that carry their own penalty.

1. 1. Section 11 access and Rule 14 workflow 9 min
2. 2. Section 12 correction, completion and erasure 9 min
3. 3. Section 13 grievance mechanism and escalation to the Board 9 min
4. 4. Section 14 nomination and Section 15 Data Principal duties 7 min

What changes the day your entity is notified as a Significant Data Fiduciary. Structuring a Data Protection Impact Assessment and independent audit on a 12-month clock; the Rule 13(3) algorithmic due diligence duty for AI/ML systems; the DPO role, qualifications, salary bands and reporting line; and the DPB adjudication and TDSAT appeal path.

1. 1. SDF designation under Section 10 and the Rule 13 programme 11 min
2. 2. Running a DPIA in practice 10 min
3. 3. The DPO role in detail: qualifications, salary bands, reporting line 10 min
4. 4. DPB adjudication and TDSAT appeal 9 min

The Rule 7 breach playbook read carefully. What triggers a personal data breach, what goes in the Stage 1 without-delay intimation, what goes in the Stage 2 72-hour detailed report, and how a single incident affecting personal data runs both the DPDP clock and the CERT-In 6-hour clock in parallel. Includes the Item 2 Schedule penalty exposure and the Star Health late-reporting pattern.

1. 1. What counts as a personal data breach 8 min
2. 2. Rule 7 Stage 1 and Stage 2 mechanics 10 min
3. 3. Parallel clocks: DPDP Rule 7 and CERT-In 6-hour 9 min
4. 4. Rule 6 security safeguards 9 min

The outward-facing surface of a DPO programme. Section 8(2) valid-contract requirement and the DPA clauses you cannot negotiate away; Section 16 + Rule 15 negative-list cross-border regime; and how the RBI Data Governance Framework (July 2026 draft), IRDAI Cyber Guidelines 2026, SEBI CSCRF and Telecom Cyber Security Rules layer over DPDP for BFSI, insurance and telecom DPOs. Includes Section 17 exemptions and the pending constitutional challenges before the Supreme Court and Delhi High Court.

1. 1. Section 8(2) DPA and the ten non-negotiable clauses 11 min
2. 2. Section 16 and Rule 15 cross-border transfer 9 min
3. 3. Sector overlays: RBI, SEBI, IRDAI, Telecom, Aadhaar 10 min
4. 4. Section 17 exemptions and the constitutional challenge 9 min

Final certification exam covering all seven content modules. Every question is anchored to a specific Rule, Schedule, Section, DPB rule, or sectoral overlay cited in the course. Randomised order, shuffled options, explanations shown after each question.

Lessons coming soon.