Skip to main content

DPDP Act Quiz: 12 Questions With Answers

Twelve questions on India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It suits privacy teams, compliance staff and anyone preparing for DPDP training. Every answer quotes the Act or the Rules.

12 questions · every answer cites the law · last reviewed 19 October 2026

Where things stand: As of 19 October 2026, the Data Protection Board and Rules 1, 2 and 17 to 21 are in force; Consent Manager registration (Rule 4) starts in November 2026, and most other duties in the Rules apply from May 2027, 18 months after the Rules were published on 13 November 2025.
0/12 answered · 0 correct

  1. Question 1 of 12 · easy

    What penalty does the DPDP Act 2023 address?

  2. Question 2 of 12 · easy

    What is the maximum penalty under the DPDP Act?

  3. Question 3 of 12 · easy

    Which act in India imposes penalties of up to ₹250 crore for failing to secure personal data?

  4. Question 4 of 12 · medium

    A Data Fiduciary fails to tell the Data Protection Board and affected people about a personal data breach. What is the maximum penalty?

  5. Question 5 of 12 · easy

    Under the DPDP Act, who counts as a child?

  6. Question 6 of 12 · medium

    What is the penalty for a Data Principal who breaches their duties, for example by giving false information?

  7. Question 7 of 12 · medium

    Under section 2(g) of the DPDP Act, what is a Consent Manager?

  8. Question 8 of 12 · easy

    Who imposes penalties under the DPDP Act?

  9. Question 9 of 12 · medium

    A company based outside India processes personal data while offering services to people in India. Does the DPDP Act apply?

  10. Question 10 of 12 · hard

    Under the DPDP Rules 2025, by when must a Data Fiduciary send the Data Protection Board a detailed report on a personal data breach?

  11. Question 11 of 12 · hard

    Under the DPDP Rules 2025, what is the longest a Data Fiduciary can take to respond to a Data Principal's grievance?

  12. Question 12 of 12 · medium

    When do most obligations in the DPDP Rules 2025, such as notices, security safeguards, breach reporting and children's consent, come into force?

Answer key with sources

Each answer quotes the provision it comes from. Open a question to see it.

1. What penalty does the DPDP Act 2023 address?

Answer: Fines for data breaches

The DPDP Act only provides for monetary penalties, which the Data Protection Board imposes after an inquiry. The amounts are set in the Schedule, and the largest apply to failures that lead to personal data breaches. The Act has no imprisonment provision, so the second option is the trap.

“If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may ... impose such monetary penalty specified in the Schedule.”
DPDP Act 2023, section 33(1)
2. What is the maximum penalty under the DPDP Act?

Answer: ₹250 crore

The highest amount in the Schedule is up to ₹250 crore. It applies when a Data Fiduciary fails to take reasonable security safeguards to prevent a personal data breach. ₹200 crore is the cap for failing to notify a breach and for breaching the children's data duties.

“Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8. ... May extend to two hundred and fifty crore rupees.”
DPDP Act 2023, Schedule, item 1
3. Which act in India imposes penalties of up to ₹250 crore for failing to secure personal data?

Answer: Digital Personal Data Protection Act, 2023

The ₹250 crore cap comes from the Schedule to the Digital Personal Data Protection Act, 2023. It covers a Data Fiduciary's failure to take reasonable security safeguards. The IT Act is the tempting wrong answer: the DPDP Act provides for omitting its section 43A, the older rule on compensation for failing to protect data.

“Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach ... May extend to two hundred and fifty crore rupees.”
DPDP Act 2023, Schedule, item 1, and section 44(2)(a)
4. A Data Fiduciary fails to tell the Data Protection Board and affected people about a personal data breach. What is the maximum penalty?

Answer: ₹200 crore

Failing to give notice of a breach under section 8(6) can cost up to ₹200 crore. The ₹250 crore cap is for failing to take reasonable security safeguards in the first place, which is a separate breach. A company can face both.

“Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8. ... May extend to two hundred crore rupees.”
DPDP Act 2023, Schedule, item 2
5. Under the DPDP Act, who counts as a child?

Answer: Anyone under 18

The Act defines a child as anyone who has not turned 18. Before processing a child's personal data, the Data Fiduciary must get verifiable consent from a parent or lawful guardian. Lower ages such as 13 or 16 come from other privacy laws, not the DPDP Act.

““child” means an individual who has not completed the age of eighteen years”
DPDP Act 2023, section 2(f)
6. What is the penalty for a Data Principal who breaches their duties, for example by giving false information?

Answer: Up to ₹10,000

Section 15 gives individuals duties, such as not impersonating someone else and not filing false or frivolous complaints. Breaching them can lead to a penalty of up to ₹10,000. The duties are binding, and the penalty is monetary, not imprisonment.

“Breach in observance of the duties under section 15. ... May extend to ten thousand rupees.”
DPDP Act 2023, section 15 and Schedule, item 5
7. Under section 2(g) of the DPDP Act, what is a Consent Manager?

Answer: A person registered with the Board who acts as a single point of contact for people to give, manage, review and withdraw consent

A Consent Manager is registered with the Data Protection Board and gives people one place to give, manage, review and withdraw their consent. It must run an accessible, transparent and interoperable platform. A vendor that only stores consent records is not a Consent Manager unless it is registered.

““Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform”
DPDP Act 2023, section 2(g)
8. Who imposes penalties under the DPDP Act?

Answer: The Data Protection Board of India

The Data Protection Board of India holds inquiries and imposes the monetary penalties in the Schedule. MeitY makes the Rules but does not impose penalties. CERT-In handles cyber security incident reporting under a different law.

““Board” means the Data Protection Board of India established by the Central Government under section 18”
DPDP Act 2023, sections 2(c) and 33(1)
9. A company based outside India processes personal data while offering services to people in India. Does the DPDP Act apply?

Answer: Yes, because the processing is connected to offering goods or services to people in India

Section 3(b) extends the Act to processing outside India when it is connected to offering goods or services to Data Principals in India. The test is where the people are, not their citizenship or where the servers sit.

“also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India”
DPDP Act 2023, section 3(b)
10. Under the DPDP Rules 2025, by when must a Data Fiduciary send the Data Protection Board a detailed report on a personal data breach?

Answer: Within 72 hours of becoming aware of it, unless the Board allows longer

Rule 7 has two steps. The Data Fiduciary first tells the Board about the breach without delay, then sends detailed information within 72 hours, or a longer period the Board allows on a written request. Six hours is a different deadline, for reporting cyber incidents to CERT-In. Rule 7 applies from May 2027.

“within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing in this behalf”
DPDP Rules 2025, rule 7(2)(b)
11. Under the DPDP Rules 2025, what is the longest a Data Fiduciary can take to respond to a Data Principal's grievance?

Answer: 90 days

Rule 14(3) says a Data Fiduciary must publish its grievance response period, and that period cannot exceed 90 days. A person must use this grievance process before complaining to the Board. 30 and 45 days are deadlines under other laws, such as PIPEDA and the CCPA.

“within a reasonable period not exceeding ninety days under its grievance redressal system for responding to the grievances of Data Principals”
DPDP Rules 2025, rule 14(3), and DPDP Act 2023, section 13(3)
12. When do most obligations in the DPDP Rules 2025, such as notices, security safeguards, breach reporting and children's consent, come into force?

Answer: Eighteen months after publication, in May 2027

The Rules were published on 13 November 2025 and are phased in. Rules 1, 2 and 17 to 21, which cover the Board, applied straight away. Rule 4 on Consent Managers starts after one year, and Rules 3, 5 to 16, 22 and 23 start after 18 months.

“Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.”
DPDP Rules 2025, rule 1(4)

Read more

More quizzes

These quizzes are general information about the law, not legal advice. Check the linked source, or ask your counsel, before relying on an answer.