Data Privacy Basics for Every Employee

Name, phone number, Aadhaar number: privacy teams file all of these under one tag, PII. What does it stand for?

• Private Internal Index
• Personally Identifiable Information
• Protected Internet Identity
• Personal Insurance Information

Answer: Personally Identifiable Information. Personally Identifiable Information is anything that can point to one specific person, on its own or combined with other details.

Your bank holds your data. Under India's DPDP Act 2023, the bank is the Data Fiduciary. What does the Act call you?

• Data Fiduciary
• Data Principal
• Data Processor
• Data Subject

Answer: Data Principal. You're the Data Principal. "Data subject" is the GDPR's word for the same person.

A European client's customer database leaks. Under the GDPR, the regulator must usually be told within how long?

• 24 hours
• 7 days
• 30 days
• 72 hours

Answer: 72 hours. Article 33 gives 72 hours from the moment the company becomes aware of the breach.

A kids' learning app in India needs a parent's consent under the DPDP Act for users below what age?

• 13
• 16
• 18
• 21

Answer: 18. The DPDP Act treats everyone under 18 as a child, and the 2025 Rules require verifiable parental consent. The GDPR's default line is 16.

A newsletter sign-up form asks for your date of birth, blood group and mother's name. Which privacy principle does it break?

• Data minimisation
• Data portability
• Right to erasure
• Data localisation

Answer: Data minimisation. Collect only what the job needs. A newsletter needs an email address, not a blood group.

You hit Send and realise the customer list went to the wrong outside address. What is your first move?

• Delete it from your Sent folder
• Tell your privacy or security team now
• Wait and see if anyone notices
• Ask the recipient to ignore it

Answer: Tell your privacy or security team now. Breaches can carry strict reporting deadlines. The sooner the privacy team knows, the more they can contain.

A colleague needs a file with everyone's salary data by tonight. What is the safest way to share it?

• A public link anyone can open
• Your personal Gmail account
• WhatsApp to their personal phone
• Company-approved share with restricted access

Answer: Company-approved share with restricted access. Approved tools let the company control, log and withdraw access. Personal Gmail and WhatsApp allow none of that.

Under the GDPR, a customer asks for a copy of all the personal data you hold on them. How long do you generally have to respond?

• One month
• One week
• Three months
• One year

Answer: One month. This is the right of access. The deadline can stretch by two more months for complex or repeated requests, but you must tell the person within the first month.

You swap each customer's name for a code number but keep the key that links them back. What does the GDPR call this?

• Anonymisation
• Encryption
• Pseudonymisation
• Tokenisation

Answer: Pseudonymisation. Because the key can re-identify people, pseudonymised data is still personal data. Only truly anonymised data falls outside the law.

Under the DPDP Act, which body hears complaints and can fine companies that mishandle personal data?

• TRAI
• Reserve Bank of India
• Data Protection Board of India
• CERT-In

Answer: Data Protection Board of India. The Act set up the Data Protection Board of India. Failing to keep reasonable security safeguards can draw a penalty of up to ₹250 crore.

Under India's DPDP Rules 2025, after a personal data breach a company must tell the Data Protection Board. Who else must it inform?

• Only its own board of directors
• The local police station
• Its insurance company
• Each affected person, without delay

Answer: Each affected person, without delay. People must hear what happened, the likely impact and what they can do to protect themselves, through their account or another channel they use.

Under the DPDP Act, what is a registered platform that lets you give, review and withdraw all your consents in one place?

• A Consent Manager
• A Data Fiduciary
• A Data Processor
• A Grievance Officer

Answer: A Consent Manager. Consent Managers must be Indian companies registered with the Data Protection Board, and they can't read the data they help you share.

Under the DPDP Act, how easy must it be for a customer to withdraw consent they gave you?

• As easy as it was to give it
• Possible only by letter
• Allowed once a year
• Possible only through a court

Answer: As easy as it was to give it. If ticking a box gave consent, unticking one should take it back. Withdrawal doesn't make the earlier processing illegal.

You find printed customer forms with phone numbers that are no longer needed. What should you do with them?

• Put them in the recycling bin
• Take them home as scrap paper
• Leave them in a desk drawer
• Shred them or use the secure disposal bin

Answer: Shred them or use the secure disposal bin. Paper leaks too. Check the retention period first, then destroy them securely, not in an ordinary bin.

A customer withdraws consent and the purpose is over. Unless a law requires keeping it, what must the company do with their data?

• Keep it forever, just in case
• Erase it
• Sell it to a partner
• Move it to a personal laptop

Answer: Erase it. Section 8(7) of the DPDP Act requires erasure, and the company must make its data processors erase their copies too.