DPDP Act 2023 Professional Certification.
India's free citation-anchored certification on the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. Written for people who actually design consent flows, respond to DSRs, run breach notifications, and answer the DPB. Not summary. Practitioner training.
- Lifetime access
- 60-question exam with unlimited retakes
- LinkedIn-shareable verifiable certificate
- Free updates when the law changes
- Founding Cohort numbered certificate
DPDP is live. The Rules are notified. Enforcement has started.
The DPDP Act came into force in stages through 2025. The Rules (G.S.R. 843(E) to 846(E)) were notified on 13 November 2025. The Data Protection Board of India is constituted. The compliance clock is running. This course gets you certified across the full Act, the Rules, and the sectoral overlays practitioners actually face in 2026.
Consent + notice architecture
Sections 5 and 6 changed how every Indian business collects personal data. Notice in every listed language (22 Eighth Schedule + English). Purpose-specific consent. Withdrawal that must be as easy as grant. The course walks the design of a compliant consent flow end to end.
DSRs and the 90-day clock
Every Data Fiduciary owes Sections 11-15 rights to Data Principals. Access, correction, erasure, portability, grievance. Miss the 90-day response window and the DPB has jurisdiction. The course builds the DSR workflow that scales past pilot volumes.
Breach notification within 72 hours
Section 8(6) plus Rule 7 make personal data breach notification a hard 72-hour clock to the DPB and the affected Data Principals. Missing it is a Schedule offence. The course covers detection, classification, template notice drafting, and the post-notice remediation.
8 modules. 38 lessons. Every claim cited.
Each lesson combines a plain-English explanation with worked examples using real numbers and a Common mistakes callout at the end. Every Section, Rule, and Ministry position quoted in the course is recorded in the public legal citation register at /courses/dpdp-act-2023/trust.
DPDPA 101
Why India needed a data protection law; the pre-DPDP framework (Section 43A IT Act, SPDI Rules 2011, the RBI/SEBI/IRDAI overlays); the DPDP Act structure; how to read the Act, the Rules, and the DPB's notifications as one working text.
The Five Players
Every DPDP obligation attaches to one of five roles. Reliably identifying which role you are in on any transaction is the practitioner discipline. Includes the Significant Data Fiduciary determination and the Consent Manager registration regime.
Data Principal Rights
The five statutory rights: access, correction, erasure, portability, grievance. The 90-day response window. Fees and refusal grounds. The exception carve-outs. Building a DSR workflow that scales.
Data Fiduciary Obligations
Section 8 general obligations; Section 8(6) breach notification within 72 hours; children's data under Section 9 (Rule 11 verification); Section 10 SDF-specific obligations. The employer-side compliance stack for a Data Fiduciary.
Implementation Toolkit
The operational build. Data-flow mapping across systems. Records of Processing Activities (RoPA). Consent architecture and versioning. Notice drafting in Eighth Schedule languages. Breach response playbook.
SDF, DPIA and DPO
The Significant Data Fiduciary classification factors. DPIA methodology under Rule 12. DPO appointment, independence, and reporting line. The audit obligation for SDFs.
Enforcement and Penalties
How the DPB works: composition, powers, procedure. The Schedule penalty ladder from ₹10,000 to ₹250 crore. Investigations, notice, hearing, order, appeal. What a good defence looks like.
AI, sectoral overlays and DPDPA
The overlays practitioners cannot ignore: AI lifecycle mapped to DPDP; ML data minimisation techniques; GenAI-specific risks (prompt leakage, model memorisation); the RBI Data Governance Framework for BFSI. This is the module that makes the course current.
Not a summary. Practitioner training.
Citation-anchored content
Every claim links to a Section, Rule, or DPB notification. The public trust page quotes every source verbatim. Where we take an interpretive position, we say so. You can defend anything the course teaches in an audit.
20+ worked examples with real numbers
DSR turnaround-time modelling for a 10-lakh-customer database. A breach-classification decision tree with worked scenarios. A consent-versioning example across a 3-year retention. A DPB penalty computation on a hypothetical Section 8 breach.
30+ Common mistakes callouts
Every lesson ends with a Common mistakes box listing the specific errors practitioners make on that topic. Treating consent as one-time. Missing the 22-language notice obligation. Under-classifying breaches. Confusing DPIA with data-flow mapping. The traps are enumerated.
Verifiable certificate + Founding Cohort badge
Pass the 60-question exam at 75% or above (unlimited retakes) and receive a numbered certificate. First 1,000 learners get the Founding Cohort badge that shows on the certificate permanently. Public verify URL. LinkedIn-shareable.
Written for people who actually do the work
The most current DPDP course in India
Content is dated. As of 20 July 2026, the course incorporates:
- The bare text of the DPDP Act 2023 (Act No. 22 of 2023).
- The DPDP Rules 2025, notified via G.S.R. 843(E), 844(E), 845(E), and 846(E) on 13 November 2025.
- Every subsequent DPB notification, guidance, or clarification through the current date.
- Sectoral overlays that a practitioner cannot avoid: the RBI Data Governance Framework for BFSI, SEBI CSCRF privacy overlay, IRDAI Master Circular on cybersecurity, and CERT-In Directions 2022.
- AI-specific chapters covering the AI lifecycle mapped to DPDP, ML data minimisation, and GenAI risks (prompt leakage, model memorisation, output audit).
Every citation is on the public trust page with a source URL. When the DPB publishes a new order or when the Ministry issues a clarification, the affected modules are updated and the legal-basis version is bumped.
This course is for professional development. It is not legal advice on any specific data-processing activity, breach, or DPB matter. For decisions on a live compliance question or a pending DPB proceeding, consult a qualified privacy lawyer.
If you find a factual error or an outdated citation, email [email protected] with the lesson URL, the exact text, and the correct source. Verified issues are fixed in the next content update.
Ready to get certified?
4.5 hours of citation-anchored practitioner training. 60-question exam. Verifiable certificate. Free.
Enrol on dcomply Academy