Cyber Law • Law Entrance Exams • Judiciary • Legal Competitive Exams • IT Law
These 50 multiple-choice questions cover India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, including key definitions, consent, individual rights, organisational duties, penalties and implementation. The final Rules were notified in November 2025.
Section A: DPDP Act, 2023 – Fundamentals
Q1. What is the full form of DPDP?
A. Data Privacy and Digital Protection B. Digital Personal Data Protection C. Digital Privacy Development Policy D. Data Processing and Disclosure Protocol
Answer: B. Digital Personal Data Protection
Explanation: The Act establishes a framework for processing digital personal data while recognising individuals' rights to protect their personal data.
Q2. In which year was the Digital Personal Data Protection Act enacted?
A. 2019 B. 2021 C. 2023 D. 2025
Answer: C. 2023
Explanation: The Digital Personal Data Protection Act is Act No. 22 of 2023.
Q3. Which ministry administers the DPDP framework?
A. Ministry of Home Affairs B. Ministry of Electronics and Information Technology C. Ministry of Finance D. Ministry of Corporate Affairs
Answer: B. Ministry of Electronics and Information Technology (MeitY)
Q4. What is the primary objective of the DPDP Act?
A. Regulating only social media platforms B. Prohibiting all collection of personal data C. Protecting digital personal data while permitting lawful processing D. Regulating only government databases
Answer: C. Protecting digital personal data while permitting lawful processing
Q5. Which type of data is principally covered by the DPDP Act?
A. All publicly available information, without exception B. Digital personal data C. Only paper records D. Only corporate financial statements
Answer: B. Digital personal data
Explanation: The Act concerns digital personal data, including certain data collected offline and subsequently digitised.
Q6. Which of the following is an example of personal data?
A. A person's identifiable mobile number B. A random number with no link to an individual C. A generic weather report D. A public mathematical formula
Answer: A. A person's identifiable mobile number
Q7. Who is called the “Data Principal” under the Act?
A. The organisation processing the data B. The individual to whom the personal data relates C. The cybersecurity auditor D. The Data Protection Board
Answer: B. The individual to whom the personal data relates
Q8. Who is a “Data Fiduciary”?
A. A person who determines the purpose and means of processing personal data B. Only a government department C. Only a cloud service provider D. A person who merely receives a privacy notice
Answer: A. A person who determines the purpose and means of processing personal data
Q9. What is a “Data Processor”?
A. An individual exercising privacy rights B. A person who processes personal data on behalf of a Data Fiduciary C. A judicial officer D. A member of Parliament
Answer: B. A person who processes personal data on behalf of a Data Fiduciary
Q10. Which of the following is generally outside the Act's scope under its specified exclusions?
A. Digital personal data processed in India B. Certain personal data processed outside India in connection with offering goods or services in India C. Personal data processed by an individual for a personal or domestic purpose D. Personal data collected by an online business
Answer: C. Personal data processed by an individual for a personal or domestic purpose
Explanation: Section 3 provides the scope and exclusions. The exact facts and statutory conditions matter.
Section B: Consent and Lawful Processing
Q11. Under the DPDP Act, what is the general basis for processing personal data?
A. Unrestricted commercial interest B. Consent or a specified legitimate use under the Act C. Verbal permission from any third party D. Automatic permission through website access
Answer: B. Consent or a specified legitimate use under the Act
Q12. What must valid consent generally be?
A. Implied through silence in every case B. Free, specific, informed, unconditional and unambiguous, with a clear affirmative action C. Permanent and irrevocable D. Obtained only through a signed paper document
Answer: B. Free, specific, informed, unconditional and unambiguous, with a clear affirmative action
Explanation: Section 6 sets out the requirements for valid consent.
Q13. Can a Data Principal withdraw consent?
A. No, consent cannot be withdrawn B. Yes, withdrawal is permitted C. Only with court approval D. Only after five years
Answer: B. Yes, withdrawal is permitted
Q14. What happens when consent is withdrawn?
A. All data must automatically be deleted immediately in every circumstance B. The Data Fiduciary must cease the consent-based processing, subject to applicable legal requirements C. The individual loses all rights under the Act D. The organisation may continue processing indefinitely
Answer: B. The Data Fiduciary must cease the consent-based processing, subject to applicable legal requirements
Q15. Who is responsible for demonstrating that valid consent was obtained when consent is relied upon?
A. The Data Principal B. The Data Fiduciary C. The internet service provider in every case D. The police in every case
Answer: B. The Data Fiduciary
Q16. What is the purpose of a notice given before or at the time of requesting consent?
A. To advertise unrelated products B. To explain the personal data and purpose of processing, among other required information C. To remove the individual's rights D. To guarantee that no data breach can occur
Answer: B. To explain the personal data and purpose of processing, among other required information
Q17. Under Section 7, which is an example of a specified legitimate use?
A. Any processing for any commercial purpose B. Certain voluntary provision of personal data for a specified purpose, subject to statutory conditions C. Selling every customer record without restriction D. Processing all data without any purpose
Answer: B. Certain voluntary provision of personal data for a specified purpose, subject to statutory conditions
Q18. Does the DPDP Act require consent for every instance of processing, without exception?
A. Yes B. No, the Act also specifies certain legitimate uses C. Only for government processing D. Only for processing by foreign companies
Answer: B. No, the Act also specifies certain legitimate uses
Q19. What should an organisation do if it processes personal data for a new purpose not covered by the existing consent?
A. Assume consent automatically extends to every new purpose B. Assess the legal basis and obtain fresh valid consent where required C. Never inform the individual D. Transfer responsibility to the individual
Answer: B. Assess the legal basis and obtain fresh valid consent where required
Q20. Which section of the Act primarily addresses consent?
A. Section 4 B. Section 6 C. Section 15 D. Section 35
Answer: B. Section 6
Section C: Rights and Duties of Data Principals
Q21. Which of the following is a right of a Data Principal?
A. Right to access information about personal data B. Right to impose any criminal sentence C. Right to demand another person's password D. Right to exempt every company from the Act
Answer: A. Right to access information about personal data
Q22. Which section addresses the right to access information about personal data?
A. Section 8 B. Section 11 C. Section 19 D. Section 28
Answer: B. Section 11
Q23. Which section deals with the right to correction and erasure of personal data?
A. Section 12 B. Section 20 C. Section 27 D. Section 37
Answer: A. Section 12
Q24. Can a Data Principal request erasure of personal data?
A. Yes, subject to the Act's provisions and applicable retention requirements B. No, personal data can never be erased C. Only if the data is stored outside India D. Only after criminal proceedings
Answer: A. Yes, subject to the Act's provisions and applicable retention requirements
Q25. Which right enables a Data Principal to use the prescribed grievance mechanism?
A. Right to grievance redressal B. Right to tax exemption C. Right to unlimited compensation in every case D. Right to appoint the Data Protection Board
Answer: A. Right to grievance redressal
Explanation: Section 13 concerns grievance redressal.
Q26. Which section provides for the right to nominate another individual?
A. Section 6 B. Section 14 C. Section 22 D. Section 38
Answer: B. Section 14
Q27. What is one duty of a Data Principal under Section 15?
A. Provide false information in every application B. Comply with applicable laws while exercising rights C. Prevent all organisations from processing any data D. Publish personal passwords online
Answer: B. Comply with applicable laws while exercising rights
Q28. Can a Data Principal complain directly to the Data Protection Board without first using the applicable grievance mechanism of the Data Fiduciary or Consent Manager?
A. Yes, in every case B. The statutory process requires the prescribed grievance-redressal step before approaching the Board C. No complaint can ever be made to the Board D. Only a foreign citizen can complain
Answer: B. The statutory process requires the prescribed grievance-redressal step before approaching the Board
Q29. What is the role of a Consent Manager?
A. To facilitate a Data Principal's management of consent through an accessible, transparent and interoperable platform B. To issue criminal warrants C. To replace the Data Protection Board D. To sell personal data without authorisation
Answer: A. To facilitate a Data Principal's management of consent through an accessible, transparent and interoperable platform
Q30. Which section deals with Consent Managers?
A. Section 7 B. Section 8 C. Section 10 D. Section 14
Answer: C. Section 10
Section D: Duties of Data Fiduciaries and Children's Data
Q31. Which section primarily deals with the general obligations of a Data Fiduciary?
A. Section 8 B. Section 12 C. Section 18 D. Section 30
Answer: A. Section 8
Q32. What must a Data Fiduciary do to protect personal data?
A. Publish all personal data publicly B. Take reasonable security safeguards to prevent personal data breaches C. Avoid maintaining any security controls D. Share data with every third party
Answer: B. Take reasonable security safeguards to prevent personal data breaches
Q33. What is the general obligation regarding personal data breaches under Section 8?
A. Never report a breach B. Notify the Board and affected Data Principals as prescribed C. Notify only the company's shareholders D. Notify only after a criminal conviction
Answer: B. Notify the Board and affected Data Principals as prescribed
Q34. Who is a Significant Data Fiduciary?
A. Every individual using a smartphone B. A Data Fiduciary notified as significant by the Central Government under the Act C. Every small business automatically D. Only a government ministry
Answer: B. A Data Fiduciary notified as significant by the Central Government under the Act
Q35. Which section addresses Significant Data Fiduciaries?
A. Section 10 B. Section 14 C. Section 17 D. Section 25
Answer: A. Section 10
Q36. Under the DPDP Act, what is the general age threshold for a child?
A. Under 12 years B. Under 16 years C. Under 18 years D. Under 21 years
Answer: C. Under 18 years
Q37. What is generally required before processing a child's personal data under Section 9?
A. Verifiable consent of the child's parent or lawful guardian, subject to applicable provisions and exemptions B. Consent of any social media user C. Permission from the child's school in every case D. No consent under any circumstances
Answer: A. Verifiable consent of the child's parent or lawful guardian, subject to applicable provisions and exemptions
Q38. What does Section 9 generally prohibit in relation to children's data, subject to statutory exceptions?
A. All educational services B. Processing likely to cause a detrimental effect on a child's well-being C. All parental involvement D. Every form of digital communication
Answer: B. Processing likely to cause a detrimental effect on a child's well-being
Q39. What is the general position regarding tracking or behavioural monitoring of children?
A. It is always mandatory B. It is generally prohibited, subject to prescribed exceptions C. It is unrestricted for all businesses D. It is permitted only for advertising agencies
Answer: B. It is generally prohibited, subject to prescribed exceptions
Q40. What is the purpose of appointing a Data Protection Officer where required for a Significant Data Fiduciary?
A. To oversee relevant data protection responsibilities and act as a contact for Data Principals B. To replace the company's board of directors C. To issue court judgments D. To grant automatic immunity from penalties
Answer: A. To oversee relevant data protection responsibilities and act as a contact for Data Principals
Section E: DPDP Rules, 2025 and Enforcement
Q41. In which year were the Digital Personal Data Protection Rules notified?
A. 2023 B. 2024 C. 2025 D. 2026
Answer: C. 2025
Explanation: The Rules were notified in November 2025.
Q42. Which rule deals with notice given by a Data Fiduciary to a Data Principal?
A. Rule 3 B. Rule 8 C. Rule 14 D. Rule 23
Answer: A. Rule 3
Q43. Under the DPDP Rules, 2025, what is the general requirement concerning the consent-request notice?
A. It must be hidden inside unrelated terms B. It must be clear and understandable, with the prescribed information and a means to withdraw consent C. It must be available only in printed form D. It must not mention the purpose of processing
Answer: B. It must be clear and understandable, with the prescribed information and a means to withdraw consent
Q44. Which rule addresses reasonable security safeguards?
A. Rule 5 B. Rule 6 C. Rule 8 D. Rule 20
Answer: C. Rule 6
Q45. Which rule addresses intimation of a personal data breach?
A. Rule 3 B. Rule 7 C. Rule 11 D. Rule 21
Answer: B. Rule 7
Q46. Which rule addresses the time period for specified Data Fiduciaries to erase personal data due to inactivity, subject to its conditions and exceptions?
A. Rule 8 B. Rule 12 C. Rule 16 D. Rule 22
Answer: A. Rule 8
Q47. Which rule addresses the additional obligations of Significant Data Fiduciaries?
A. Rule 5 B. Rule 9 C. Rule 14 D. Rule 20
Answer: B. Rule 9
Q48. Which body adjudicates matters under the DPDP Act, including determining penalties within its statutory powers?
A. Reserve Bank of India B. Data Protection Board of India C. Election Commission of India D. National Green Tribunal
Answer: B. Data Protection Board of India
Q49. What is the maximum penalty under the Act's Fourth Schedule for failure to take reasonable security safeguards to prevent a personal data breach?
A. ₹10 crore B. ₹100 crore C. ₹200 crore D. ₹250 crore
Answer: D. ₹250 crore
Explanation: The Fourth Schedule specifies a maximum penalty of ₹250 crore for this contravention.
Q50. What is the maximum penalty prescribed for a breach of the additional obligations of a Significant Data Fiduciary?
A. ₹5 crore B. ₹25 crore C. ₹150 crore D. ₹250 crore
Answer: D. ₹250 crore
Explanation: The Fourth Schedule prescribes a maximum penalty of ₹250 crore for breach of the additional obligations of a Significant Data Fiduciary. Actual penalties depend on the statutory framework and the circumstances of the contravention.
Official study resources
Exam note: These MCQs are for study and revision. For questions involving commencement dates, exemptions, and compliance deadlines, consult the Act, the notified Rules, relevant corrigenda and commencement notifications. The Rules have a phased commencement schedule, so notification does not mean every provision became operative immediately.