DPDP Act, 2023 — Awareness for Workplaces

Content changes frequently. Rules, commencement dates and guidance under the Digital Personal Data Protection Act, 2023 continue to be notified. Always check the official MeitY page for the current position. This is educational content, not legal advice.

Why it matters

Security and HR teams handle personal data daily — visitor logs, CCTV, access cards, ID copies. Knowing the principles helps you collect less, protect it better and respond properly.

Who it's for: Security, HR, admin and IT staff handling personal data in India.

Learning objectives — by the end you can:

Explain who a Data Principal and a Data Fiduciary are.
Apply purpose limitation and data minimisation to a visitor log.
List the data-principal rights described in the Act.
Describe basic breach readiness steps.

Key terms

Data Principal: The individual to whom personal data relates.
Data Fiduciary: The person or organisation that decides the purpose and means of processing.
Data Processor: Processes data on behalf of a Data Fiduciary, e.g. a vendor.
Consent: Free, specific, informed, unconditional and unambiguous agreement, given with a clear affirmative action.
Purpose limitation: Use data only for the purpose stated to the individual.

Lesson notes

Core ideas in plain language

1Give a clear notice describing what data you collect and why.
2Rely on consent or another basis permitted by the Act (check which applies).
3Collect only what you need (minimisation).
4Keep it accurate and secure with reasonable safeguards.
5Delete it when the purpose is served, unless law requires retention.
6Ensure processors/vendors follow your instructions and safeguards.
7Be ready to notify a personal data breach as required.

Data-principal rights (summary)

Right	What it means in practice
Access information	Know what data is processed and with whom it is shared
Correction and erasure	Ask for corrections, completion, updating and erasure
Grievance redressal	Have a route to raise complaints with the organisation
Nominate	Nominate someone to exercise rights in case of death or incapacity

Summary for awareness; refer to the Act and notified Rules for exact wording.

Security-team examples

Visitor logs: do you need a full ID number, or is verifying the ID enough? CCTV: is retention defined and signage clear? Access cards: are leaver records deleted when no longer needed? Vendor guards: does the contract cover data handling?

Video lesson

Video to be added

A verified video from an official or reputable channel has not yet been selected for this topic. The text lesson above covers the full content.

Search YouTube for related videos

Practical story: The photocopied ID cards

Fictional teaching example

Situation. An office reception photocopied every visitor's government ID and kept copies in an unlocked cabinet for years.

Known facts

The copies were not needed after the visit.
No notice explained why they were collected.

Decisions

Reception switched to viewing ID without copying.
A short notice was added at the desk.
Old copies were securely shredded with a record.

Outcome. Less data held, less risk, and a clearer process for staff.

Lessons

Minimisation is often the cheapest control.
Retention needs an end date.
Notices build trust.

Worked example

Worked example: data mapping a visitor log

Data item	Purpose	Needed?	Retention	Access
Name	Identify visitor, emergency roll call	Yes	90 days (example)	Reception, security
Phone	Contact host / emergencies	Yes	90 days	Reception
Full ID number	—	No — view only	Not stored	—
Photo	Badge	Optional	Delete at sign-out	Reception

Practice exercise

Data-map one form your team uses (visitor log, incident form, access request).

For each field: purpose, is it needed, retention, who can access.

References

LegislationMeitY — Digital Personal Data Protection Act, 2023

Verify current editions and applicability. Standards are copyrighted; consult licensed copies for exact requirements.

Report an issue with this content