DPDPA Awareness Trainning – Quiz

DPDPA Employee Awareness Trainning - Quiz

DPDP Act 2023 and Rules 2025 Training & Quiz helps you to increase your knowledge and awareness

1 / 16

1. DPDP Act 2023 Awareness Training for Employees

DPDP Act 2023 Awareness Training Video-1 (9.01 min.)

Open DPDP Act 2023 Awareness Video in New Window/Tab by right-clicking and "Open Link in a New Tab/Window" and Watch Completely!

False

True

2 / 16

2. Under the Digital Personal Data Protection Act (DPDPA), 2023, which of the following best describes valid consent provided by a Data Principal?

Consent is not required if the company plans to use the data for marketing purposes.

Consent can only be given in writing on a physical document.

Consent must be implied through the user's continued use of the website without opting out.

It must be free, specific, informed, unconditional, and given with a clear affirmative action.

3 / 16

3. If a customer (Data Principal) decides to withdraw their consent for the processing of their personal data, what is your company's obligation under the DPDPA?

The company can continue processing the data for up to 60 days to complete internal audits.

The company can charge a processing fee to honor the withdrawal of consent.

The company can ignore the request if the customer previously agreed to a 1-year contract.

The company must cease processing the personal data as soon as possible, unless specified otherwise by law.

4 / 16

4. As a corporate employee, what is your primary duty regarding the personal data of customers or clients that you handle?

To monetize the data by sharing it with third-party vendors for extra company revenue.

To store the data on your personal cloud storage for easy access while working remotely.

To process it only for authorized business purposes and ensure its confidentiality and security.

To delete the data immediately after completing one task, regardless of project requirements.

5 / 16

5. You receive a suspicious email containing an attachment with employee Personally Identifiable Information (PII) that you are not authorized to access. What is the correct first step you should take?

Forward the email to your colleagues to warn them about the suspicious message.

Immediately report the incident to the company's internal Data Protection Officer (DPO) or IT security team.

Call the affected employees directly to complain about the HR or IT security failure.

Delete the email and ignore it, as it does not affect your direct team.

6 / 16

6. Under the DPDPA, Data Principals have the right to obtain from the Data Fiduciary (the company):

Copies of all emails ever sent internally discussing the Data Principal.

Unlimited access to the company’s internal server logs and databases.

A detailed breakdown of the company's financial profits and losses related to their data.

A summary of their personal data processed by the entity and the identities of other Data Fiduciaries it has been shared with.

7 / 16

7. What are the potential consequences for a corporate employee who breaches the provisions of the DPDPA, such as unauthorized sharing or selling of customer data?

A fixed fine of Rs. 10,000 paid by the employee, with no further action required.

Imprisonment for a minimum of 5 years for any data privacy mistake.

Both internal disciplinary action (like termination) by the employer and potential legal penalties for the individual.

Only a warning, as employees are shielded by the company's corporate identity.

8 / 16

8. According to the DPDPA, what are the primary duties of a Data Principal (such as an employee providing their own data to the employer)?

To furnish only genuine and verifiable information and not impersonate another person.

To pay a monthly fee for their data to be stored securely.

To waive their right to complain about data breaches.

To audit the company's data processing systems annually.

9 / 16

9. You are working on a project and have access to client data for a specific account. Can you use this data to contact clients about a new, unrelated service your company is launching?

Yes, as long as it is within the same calendar year.

Yes, because the clients already trust your company.

No, you can only use the data for the specific, lawful purpose for which it was originally collected and consented to.

No, unless the new service is offered at a discount.

10 / 16

10. Who is responsible for addressing the grievances of Data Principals regarding the processing of their personal data?

The Chief Executive Officer (CEO) directly.

The local police authorities.

The company’s external public relations (PR) team.

The designated Grievance Officer or Data Protection Officer (DPO).

11 / 16

11. A former customer sends a formal request to your company to completely erase their personal data from all your systems. Under the DPDPA, can they make this request?

No, once a customer gives consent, they can never ask for it to be deleted.

No, data deletion can only be initiated by the company, not the customer.

Yes, but only if they pay a data erasure fee.

Yes, they have the right to request erasure, and the company must erase it unless retention is necessary for legal or business purposes.

12 / 16

12. Riya, a customer support executive, is working from home. Her internet is slow, so she downloads an Excel sheet containing 500 customer names, phone numbers, and email IDs onto her personal laptop to complete her work faster.

This is acceptable if Riya password-protects the Excel sheet on her laptop.

This is acceptable because Riya is trying to maintain her productivity and finish her company tasks on time.

This is acceptable as long as Riya deletes the file from her personal laptop at the end of her shift.

This is a violation of the DPDPA and company policy because personal data must only be processed using approved, secure company systems.

13 / 16

13. Amit works in the procurement department and has access to the personal phone numbers of various vendor representatives. A friend of his is starting a logistics business and asks Amit for a list of these numbers to send them marketing pitches.

Amit can share the numbers because they belong to corporate vendors, not retail consumers.

Amit should refuse to share the numbers because the data was collected strictly for corporate procurement, not for third-party marketing.

Amit can share the numbers only if he charges his friend a standard consulting fee.

Amit can share the numbers if his friend promises to keep the source secret and not mention Amit's company.

14 / 16

14. Vikram accidentally sends an email containing the salary details, PAN cards, and bank account numbers of 50 employees to an external vendor instead of the internal HR team. He notices the mistake 5 minutes after sending it.

Vikram should immediately notify his company’s Data Protection Officer (DPO) or IT Security helpdesk so the breach management protocol can begin.

Vikram should wait until the end of the week to see if the vendor replies or notices the mistake.

Vikram should call the vendor and ask them to forward the email to 50 more people to check if the links work.

Vikram should delete the email from his "Sent" folder and pretend it never happened to save his job.

15 / 16

15. Sneha is designing an online registration form for customers who want to download a basic product brochure. Her manager tells her to make "Annual Household Income" and "Spouse's Name" mandatory fields to help the sales team later.

Sneha should include the fields but write them in a very tiny font so customers don't notice them.

Sneha should include these fields because more data always helps the sales team close deals faster.

Sneha should flag this to her manager, explaining that under the DPDPA, they should only collect data that is strictly necessary to provide the brochure.

Sneha should include the fields but label them as "Optional" while secretly blocking the download if they are left blank.

16 / 16

16. A customer calls Rahul and says, "I know you guys are holding my old address. I want you to update it to my new address immediately, and I want a written confirmation that my old address has been wiped from your system."

Rahul should tell the customer that data deletion costs a standard administrative fee of ₹500.

Rahul should manually write down the new address on a sticky note and stick it to his monitor.

Rahul should guide the customer through the company’s official, verified channel for data correction and erasure requests to process it legally.

Rahul should tell the customer that the company does not update records over a simple phone call and hang up.

reCAPTCHA field is required please complete!

Your score is

1.

DPDP Act 2023 Awareness Training for Employees

DPDP Act 2023 Awareness Training Video-1 (9.01 min.)

Open DPDP Act 2023 Awareness Video in New Window/Tab by right-clicking and "Open Link in a New Tab/Window" and Watch Completely!

Leave a Reply Cancel reply