DPDP Act Certification — Digital Personal Data Protection (India)"We already have the data, so consent is covered" — 18 items on whether your team knows why that is wrong.
Annual certification on the Digital Personal Data Protection Act, 2023. Ten workplace scenarios test judgement on consent, purpose limitation, breach response, children's data and data-principal rights; eight knowledge items test the Act's core provisions. Pass mark 70 percent; verifiable credential on success.
Scenarios from the teams that actually touch personal data
The ten scenarios come from marketing, product, finance and operations rather than from a privacy office. A bank's marketing team wants to reuse addresses collected during account-opening for a credit-card campaign because 'we already have the data'. A product team ships a signup flow with one mandatory checkbox bundling terms, privacy policy, marketing and partner sharing. A CFO at a Significant Data Fiduciary asks why the compliance budget has grown when consent is already taken properly. The eight knowledge items then test the statute directly: what makes consent valid, what a notice must contain, when children's data may be processed, what happens after a breach, and how cross-border transfer works under the Act.
Every scenario and item is original, written against the public text of the Digital Personal Data Protection Act, 2023; no third-party course content is reproduced. Knowledge items have a single answer drawn from the Act. Scenario options are all positions a real colleague might take — the unsubscribe link makes it fine, the agency running the campaign makes it fine — and the keyed response is the one the Act supports, with the statutory reasoning given in the review. Options are length-matched so wording gives nothing away. The pass mark is 70 percent, and the certification is designed for proctored administration while remaining available to individual candidates.
The report does more than record a number. On a pass, the candidate receives a DPDP certified digital credential with a public verification link that an employer, a client conducting vendor due diligence or an auditor can check directly. On any result, the item review explains the basis for every keyed answer — consent that is free, specific, informed, unconditional and unambiguous; purpose limitation; verifiable parental consent for children; the additional duties of a Significant Data Fiduciary; breach notification to the Board and affected individuals; the scale of penalties — so a shortfall is converted into the exact reading a retake needs. It tests knowledge of the law; it is not legal advice.
What you walk away with
Your score against the pass mark, split between scenario judgement and statutory knowledge, so the candidate and the data-protection owner can tell whether the gap is in recognising a consent or purpose problem in day-to-day work, or in knowing what the Act requires of a Data Fiduciary.
Candidates at or above the pass mark receive a digital credential with a public verification page. It can sit in a vendor due-diligence pack, an onboarding record or a professional profile, and anyone with the link can confirm it without asking the candidate or the employer for a copy.
The item review sets out why each keyed answer is right under the Act: consent tied to the specified purpose in the notice, withdrawal as easy as giving consent, no tracking or targeted advertising directed at children, the Data Protection Officer and independent audit duties of a Significant Data Fiduciary, breach notification, and transfer restrictions by government notification.
For anyone below or only just above the pass mark, the report ends with the specific provisions to revisit — the sections behind the items missed — so a second attempt or next year's renewal is focused on the gaps rather than a repeat of the full module.
Inside the result
Illustrative sample — your report is generated from your own responses.
Every item reviewed afterwards with its explanation, so a miss becomes a lesson rather than a lost mark.
Assembled from your lowest competencies, in order — not a generic checklist.
Built for
- Employees in marketing, product, sales, finance and support who handle customer data every day
- Engineering and analytics teams designing consent flows, data retention and access controls
- Data protection officers, compliance and legal operations staff who need a documented record across the organisation
- Vendors and outsourcing partners asked by Indian clients to evidence DPDP readiness
The next reuse of a customer list is a penalty waiting for a complaint.
Eighteen items in about twenty-two minutes. Pass at 70 percent and receive a verifiable DPDP certified credential.
Take free · full report ₹149 (incl. GST)
Frequently asked questions
It tests working knowledge of the Digital Personal Data Protection Act, 2023: valid consent and notice, purpose limitation, data-principal rights, children's data, the duties of Data Fiduciaries and Significant Data Fiduciaries, breach notification, cross-border transfer and penalties. It is for any employee who touches personal data — marketing, product, sales, finance, support, engineering — and for compliance owners and vendors who need a documented, verifiable record of that knowledge.
Eighteen items, one mark each, against a 70 percent pass mark. Eight knowledge items have a single statutory answer. In the ten scenarios all options are positions real colleagues take, options are length-matched, and the keyed response is the one the Act supports — which is not always the most restrictive; the Act permits transfers and legitimate uses that a reflexively cautious answer would wrongly forbid. Every key is explained.
Eighteen items within a twenty-two-minute limit. Everyone receives a score against the pass mark, a split between scenario judgement and statutory knowledge, an item-by-item review with the statutory basis for each answer, and a list of provisions to re-read. Candidates who pass also receive a DPDP certified digital credential with a public verification link. The price covers everything; there is nothing further to unlock.
Yes. The public verification page lets a client, auditor or employer confirm the result directly, which suits vendor questionnaires and annual records. Candidates below the pass mark can retake after working through the provisions the report lists. The certification evidences individual knowledge of the Act; it does not by itself make an organisation compliant, and it is not legal advice.
The Act governs digital personal data of individuals in India, so it matters to any organisation with Indian customers or users — including overseas companies, offshore centres and vendors serving Indian clients. Anyone familiar with other data-protection regimes will recognise the principles while needing the Act's specific rules on consent, children and fiduciaries. It is priced in INR and USD, with the live price shown on this page.
Certifications carry a pass mark and issue a verifiable digital credential on success. Each is an original item bank written against the statute or regulation itself — the definitions, duties, timelines and remedies an employee is actually expected to know — not a generic awareness quiz.
See the certifications →Methodology: Scenarios and items are original works authored for AssessAll against the public text of the Digital Personal Data Protection Act, 2023. No third-party course content is reproduced.