1. Write a program to perform encryption and decryption using Caesar cipher (substitutional cipher).

def encrypt(text, key):
    result = ""
    for char in text:
        if char.isalpha():
            base = ord('A') if char.isupper() else ord('a')
            result += chr((ord(char) - base + key) % 26 + base)
        else:
            result += char
    return result


def decrypt(text, key):
    result = ""
    for char in text:
        if char.isalpha():
            base = ord('A') if char.isupper() else ord('a')
            result += chr((ord(char) - base - key) % 26 + base)
        else:
            result += char
    return result


# -------------------------------
# Main Program
# -------------------------------
text = input("Enter text: ")
key = int(input("Enter key (shift value): "))

encrypted = encrypt(text, key)
print("Encrypted text:", encrypted)

decrypted = decrypt(encrypted, key)
print("Decrypted text:", decrypted)

-------
2. Write a program to perform encryption and decryption using Rail Fence Cipher. (transpositional cipher)

# Rail Fence Cipher Encryption
def encrypt_rail_fence(text, key):
    rail = [['\n' for _ in range(len(text))]
            for _ in range(key)]

    # To determine the direction
    dir_down = False
    row, col = 0, 0

    for i in range(len(text)):
        # change direction when you reach top or bottom
        if row == 0 or row == key - 1:
            dir_down = not dir_down

        rail[row][col] = text[i]
        col += 1

        # move up or down
        row += 1 if dir_down else -1

    # build the result
    result = []
    for i in range(key):
        for j in range(len(text)):
            if rail[i][j] != '\n':
                result.append(rail[i][j])

    return "".join(result)


# Rail Fence Cipher Decryption
def decrypt_rail_fence(cipher, key):
    rail = [['\n' for _ in range(len(cipher))]
            for _ in range(key)]

    # Mark the positions with '*'
    dir_down = None
    row, col = 0, 0

    for i in range(len(cipher)):
        if row == 0:
            dir_down = True
        if row == key - 1:
            dir_down = False

        rail[row][col] = '*'
        col += 1
        row += 1 if dir_down else -1

    # Fill the marked positions with cipher characters
    index = 0
    for i in range(key):
        for j in range(len(cipher)):
            if rail[i][j] == '*' and index < len(cipher):
                rail[i][j] = cipher[index]
                index += 1

    # Read the text by zig-zag manner
    result = []
    row, col = 0, 0

    for i in range(len(cipher)):
        if row == 0:
            dir_down = True
        if row == key - 1:
            dir_down = False

        result.append(rail[row][col])
        col += 1
        row += 1 if dir_down else -1

    return "".join(result)


# -------------------------------------
# Main Program
# -------------------------------------
text = input("Enter text: ")
key = int(input("Enter key (number of rails): "))

encrypted = encrypt_rail_fence(text, key)
print("Encrypted Text:", encrypted)

decrypted = decrypt_rail_fence(encrypted, key)
print("Decrypted Text:", decrypted)

-------
3. Vigenère Cipher

# Function to generate the key
def generate_key(text, key):
    key = list(key)
    if len(key) < len(text):
        for i in range(len(text) - len(key)):
            key.append(key[i % len(key)])
    return "".join(key)

# Encrypt the plaintext
def encrypt(text, key):
    cipher_text = []
    for i in range(len(text)):
        if text[i].isalpha():
            shift = ord(key[i].upper()) - ord('A')
            base = ord('A') if text[i].isupper() else ord('a')
            cipher_text.append(chr((ord(text[i]) - base + shift) % 26 + base))
        else:
            cipher_text.append(text[i])
    return "".join(cipher_text)

# Decrypt the ciphertext
def decrypt(cipher, key):
    orig_text = []
    for i in range(len(cipher)):
        if cipher[i].isalpha():
            shift = ord(key[i].upper()) - ord('A')
            base = ord('A') if cipher[i].isupper() else ord('a')
            orig_text.append(chr((ord(cipher[i]) - base - shift) % 26 + base))
        else:
            orig_text.append(cipher[i])
    return "".join(orig_text)

# -----------------------------------
# Main program
# -----------------------------------
text = input("Enter text: ")
keyword = input("Enter key: ")

key = generate_key(text, keyword)

encrypted = encrypt(text, key)
print("Encrypted Text:", encrypted)

decrypted = decrypt(encrypted, key)
print("Decrypted Text:", decrypted)

-------
4. Write a Python program that defines a function and takes a password string as input and returns its SHA-256 hashed representation as a hexadecimal string.

import hashlib

def sha256_hash(password):
    # Encode string to bytes, then hash using SHA-256
    hash_object = hashlib.sha256(password.encode())
    # Return hexadecimal representation
    return hash_object.hexdigest()

# Main program
password = input("Enter password: ")
hashed_password = sha256_hash(password)

print("SHA-256 Hash:", hashed_password)

-------
5. Write a Python program that reads a file containing a list of usernames and passwords, one pair per line (separated by a comma). It checks each password to see if it has been leaked in a data breach. You can use the "Have I Been Pwned" API (https://haveibeenpwned.com/API/v3) to check if a password has been leaked.

On terminal - pip3 install requests, navigate to same folder by cd and ls

Contents for file "credentials.txt"
alice,Password123
bob,123456
sahana,myStrongPass!

import hashlib
import requests

HIBP_API_RANGE_URL = "https://api.pwnedpasswords.com/range/"


def check_password_pwned(password):
    """
    Returns the number of times the password appeared in breaches.
    If 0 is returned, password is (so far) not found in HIBP database.
    Uses k-anonymity: only first 5 chars of SHA-1 hash are sent.
    """
    # 1. SHA-1 hash of password (uppercase hex)
    sha1_hash = hashlib.sha1(password.encode('utf-8')).hexdigest().upper()
    prefix = sha1_hash[:5]          # first 5 chars
    suffix = sha1_hash[5:]          # remaining 35 chars

    # 2. Query HIBP range API with prefix
    url = HIBP_API_RANGE_URL + prefix
    response = requests.get(url)

    if response.status_code != 200:
        print(f"Error: HIBP API request failed with status {response.status_code}")
        return -1  # indicate error

    # 3. API returns many suffixes with counts: HASH_SUFFIX:COUNT
    hashes = response.text.splitlines()

    for line in hashes:
        hash_suffix, count = line.split(':')
        if hash_suffix == suffix:
            return int(count)  # password found this many times

    return 0  # not found


def process_credentials_file(filename):
    try:
        with open(filename, 'r') as f:
            for line in f:
                line = line.strip()
                if not line:
                    continue  # skip empty lines

                # Expect: username,password
                try:
                    username, password = line.split(',', 1)
                except ValueError:
                    print(f"Skipping malformed line: {line}")
                    continue

                count = check_password_pwned(password)

                if count == -1:
                    print(f"[ERROR] Could not check password for user: {username}")
                elif count == 0:
                    print(f"[SAFE ] {username} — password not found in breaches.")
                else:
                    print(f"[PWNED] {username} — password found {count} times in breaches!")
    except FileNotFoundError:
        print(f"File '{filename}' not found.")


# ---------------------------
# Main program
# ---------------------------
if __name__ == "__main__":
    filename = input("Enter credentials filename: ")  # e.g., credentials.txt
    process_credentials_file(filename)

-------
6. Write a Python program that generates a password using a random combination of words from a dictionary file.

content for "words.txt"
apple
cloud
river
mountain
python
secure
silver
stone

import random

def generate_password(dictionary_file, num_words=3):
    try:
        # Read words from file
        with open(dictionary_file, "r") as file:
            words = [word.strip() for word in file.readlines() if word.strip()]

        if len(words) < num_words:
            print("Not enough words in dictionary to generate password.")
            return None

        # Randomly choose words
        selected_words = random.sample(words, num_words)

        # Create password (you can add symbols/numbers if needed)
        password = "".join(selected_words)

        return password

    except FileNotFoundError:
        print(f"Dictionary file '{dictionary_file}' not found.")
        return None


# ---------------------------
# Main Program
# ---------------------------
dictionary_file = input("Enter dictionary filename: ")   # e.g., words.txt

password = generate_password(dictionary_file)

if password:
    print("Generated Password:", password)

--------
7. Brute Force attack on password

import itertools
import string

def brute_force_attack(password):
    characters = string.ascii_lowercase   # a–z
    attempts = 0

    print("Starting brute-force simulation...\n")

    # Try increasing lengths until found
    for length in range(1, 6):  # limit to length 5 for safety
        for combo in itertools.product(characters, repeat=length):
            guess = "".join(combo)
            attempts += 1

            if guess == password:
                print(f"Password found: {guess}")
                print(f"Total attempts: {attempts}")
                return True

    print("Password not found within the attempt limit.")
    return False


# -------------------------
# Main Program
# -------------------------
target_password = input("Enter the password to brute-force (lowercase only): ")
brute_force_attack(target_password)

---------
8. Digitally sign document

Download Adobe Acrobat Reader DC
➤ Create digital ID
↪ name, email, name of org, serial no. & expiration Date
↳ Edit → Preferences → Signature → Identities & trusted certificates →
A new digital ID → Next →
fill details → Next → Create Password
➤ Customize appearence of DS
→ Open any PDF Sample
→ click sign, Add signature
→ Place signature in blank space & take ss
→ convert image png/pdf sign.pdf
→ Edit → Preferences → Creation & Appearence
→ Create new appearence → Give title
➤ Imported graphic → Import pdf file
→ Configure text → OK → × → ×
Now add PDF file on which u want to place
→ Tools
→ Certificate
→ Digitally signed → Draw in area using mouse
→ Select → Then appearence → lock the pdf → password



Below is your **ULTIMATE CASE-STUDY CHEAT SHEET** for the **Digital Personal Data Protection Act, 2023**, fully based on your uploaded PDF.
This is structured so that **the moment you read a case, you can immediately tell: “This belongs to Section __”** and also quote the *exact relevant line* from the Act.

All statements below are sourced directly from the uploaded **DPDP Act, 2023** PDF.


---

# ✅ **CHEAT SHEET — Identify Case Study → Section in 5 Seconds**

Each section has:

### • **What the section covers**

### • **Keywords you must detect in case studies**

### • **When to apply it**

### • **Exact line from Act to quote** (paraphrased but accurate)

---

# 🔵 **CHAPTER I — PRELIMINARY**

## **SECTION 2 — DEFINITIONS**

### **Use when case involves:**

* Is this *personal data*?
* Who is *Data Fiduciary / Data Principal*?
* What counts as *processing*?

### **Keywords:**

“Identifiable information”, “processing”, “digital data”, “data fiduciary”, “data processor”.

### **Relevant line to quote:**

* *Personal data means any data about an individual who is identifiable.* (Sec 2(t))
* *Processing includes collection, storage, sharing, erasure, etc.* (Sec 2(x))


---

## **SECTION 3 — APPLICATION OF THE ACT**

### **Use when case describes exemption from Act.**

### **Keywords:**

* “Publicly available data”
* “Domestic/personal use”
* “Data collected outside India but used for Indian users”

### **Relevant line:**

* *Act does not apply to personal or domestic use, or data made publicly available by the data principal.* (Sec 3(c))


---

# 🔵 **CHAPTER II — OBLIGATIONS OF DATA FIDUCIARY**

---

## **SECTION 4 — GROUNDS FOR PROCESSING PERSONAL DATA**

### **Use when:**

Company processes data without lawful basis.

### **Keywords:**

“Lawful purpose”, “consent not taken”, “illegitimate processing”.

### **Relevant line:**

* *Personal data may be processed only for a lawful purpose with consent or legitimate uses.* (Sec 4(1))


---

## **SECTION 5 — NOTICE**

### **Use when:**

User was not told why data is collected or how it will be used.

### **Keywords:**

“No notice given”, “no privacy policy”, “hidden processing”.

### **Relevant line:**

* *Every request for consent must be accompanied by a notice informing purpose and data categories.* (Sec 5(1))


---

## **SECTION 6 — CONSENT**

### **Use when:**

The case involves invalid or missing consent.

### **Keywords:**

“Pre-ticked boxes”, “forced consent”, “app took extra permissions”, “withdrawing consent ignored”.

### **Relevant line:**

* *Consent must be free, specific, informed, unambiguous and for necessary data only.* (Sec 6(1))
* *Data principal has right to withdraw consent anytime.* (Sec 6(4))


---

## **SECTION 7 — CERTAIN LEGITIMATE USES**

### **Use when:**

Data used **without consent** under legally allowed grounds.

### **Keywords:**

“Government benefit schemes”, “medical emergency”, “legal obligation”, “employment-related processing”.

### **Relevant line:**

* *Data may be processed without consent for subsidies, benefits, medical emergencies, legal obligations, employment purposes, etc.* (Sec 7)


---

## **SECTION 8 — GENERAL OBLIGATIONS OF DATA FIDUCIARY**

### Apply this section MOST FREQUENTLY in case studies.

### **Use when:**

* Data breach
* Data retention violation
* Security lapse
* Accuracy issues
* Grievance redressal failure
* Sharing data with processors without safeguards

### **Keywords:**

“Leak”, “breach”, “company did not secure data”, “kept data after purpose”, “did not erase data”, “did not inform users”.

### **Relevant lines:**

* *Fiduciary must ensure completeness, accuracy, consistency of data.* (Sec 8(3))
* *Must take reasonable security safeguards to prevent breaches.* (Sec 8(5))
* *Must intimate Board and affected data principals about breaches.* (Sec 8(6))
* *Must erase data when purpose is complete or consent withdrawn.* (Sec 8(7))


---

## **SECTION 9 — PROCESSING OF CHILDREN’S DATA**

### **Use when:**

Data of minors <18 is misused or consent from parent not taken.

### **Keywords:**

“Child profile”, “tracking children”, “targeted ads to kids”.

### **Relevant line:**

* *Must obtain verifiable parental consent; behavioural tracking & targeted ads for children are forbidden.* (Sec 9(1),(3))


---

## **SECTION 10 — SIGNIFICANT DATA FIDUCIARY**

### **Use when:**

Case involves large-scale platform (bank, social media, fintech, etc.)

### **Keywords:**

“High-risk processing”, “Data Protection Officer”, “DPIA”, “data audit”.

### **Relevant line:**

* *Significant DF must appoint DPO, conduct DPIA, carry out audits.* (Sec 10(2))


---

# 🔵 **CHAPTER III — RIGHTS OF DATA PRINCIPAL**

---

## **SECTION 11 — RIGHT TO ACCESS INFORMATION**

### **Use when:**

User asks company: “What data do you have about me?”

### **Keywords:**

“Access request”, “show me my data”.

### **Relevant line:**

* *User can request a summary of personal data & all entities it is shared with.* (Sec 11(1))


---

## **SECTION 12 — RIGHT TO CORRECTION, COMPLETION & ERASURE**

### **Use when:**

User asks for correction or deletion but company refuses.

### **Keywords:**

“Delete my account”, “correct wrong data”, “update address”.

### **Relevant line:**

* *Fiduciary must correct inaccurate data and erase personal data when requested unless retention is legally required.* (Sec 12(2),(3))


---

## **SECTION 13 — GRIEVANCE REDRESSAL**

### **Use when:**

Company does not respond to complaints.

### **Keywords:**

“Support didn’t respond”, “no grievance officer”.

### **Relevant line:**

* *DF must provide grievance redressal and respond within the prescribed period.* (Sec 13(2))


---

## **SECTION 14 — RIGHT TO NOMINATE**

### **Use when:**

Case mentions actions after death or incapacity.

---

## **SECTION 15 — DUTIES OF DATA PRINCIPAL**

### **Use when:**

User abuses system, impersonates, files fake complaints.

---

# 🔵 **CHAPTER IV — SPECIAL PROVISIONS**

---

## **SECTION 16 — RESTRICTION ON CROSS-BORDER TRANSFER**

### **Use when:**

Company transfers data to a banned country.

---

## **SECTION 17 — EXEMPTIONS**

### **Use when:**

Processing done for police, court, research, etc.

### **Keywords:**

“Investigation”, “legal claim”, “court order”, “Sovereignty”, “public order”.

### **Relevant line:**

* *Act does not apply when data is processed for investigation, court functions, enforcing legal rights, research without identifying the data principal.* (Sec 17(1),(2))


---

# 🔵 **CHAPTER V–VII — BOARD, PROCESS, APPEALS**

Use these only when case involves:

* Complaint
* Board inquiry
* Penalty process
* Appeal to tribunal

Not common in exams.

---

# 🔵 **CHAPTER VIII — PENALTIES**

## **SECTION 33 + SCHEDULE**

### **Use when:**

Case study asks: *What penalty applies?*

### **Relevant penalties:**

* Security safeguard breach → up to **₹250 crore**
* Breach of children’s data obligations → **₹200 crore**
* Significant Data Fiduciary obligations → **₹150 crore**
* All other violations → **₹50 crore**



Use this to instantly map case → section:

| Case Study Keyword            | Section                  | Reason                         |
| ----------------------------- | ------------------------ | ------------------------------ |
| Data leak, weak security      | **Sec 8(5)**             | Security safeguards            |
| Company hid breach            | **Sec 8(6)**             | Breach notification            |
| No privacy notice             | **Sec 5**                | Notice requirement             |
| Consent not taken             | **Sec 6**                | Valid consent                  |
| Excessive data collected      | **Sec 6(1)** (necessity) | Only necessary data allowed    |
| Used data for another purpose | **Sec 4 & 6**            | Purpose-specific consent       |
| Tracking children / ads       | **Sec 9**                | Child protection               |
| Government scheme using data  | **Sec 7(b)**             | Legitimate use without consent |
| Legal obligation / Court      | **Sec 7(d,e)**           | Legitimate use                 |
| Medical emergency             | **Sec 7(f,g)**           | Legitimate use                 |
| “Show me my data”             | **Sec 11**               | Right to access                |
| “Correct/delete my data”      | **Sec 12**               | Right to erasure & correction  |
| Complaint not answered        | **Sec 13**               | Grievance redressal            |
| Data kept after purpose       | **Sec 8(7)**             | Data retention rules           |
| Big platform with DPO         | **Sec 10**               | Significant Data Fiduciary     |
| Investigation / police        | **Sec 17**               | Exemptions                     |

--------------

---

# ✅ **SECTION-WISE RELEVANT LINES (Write these in case study answers)**

---

# **SECTION 2 – DEFINITIONS**

### **Relevant line:**

“Personal data means any data about an individual who is identifiable.” (Sec 2(t))
“Processing includes collection, storage, sharing, use, erasure or destruction of personal data.” (Sec 2(x))

---

# **SECTION 3 – APPLICATION OF THE ACT**

### **Relevant line:**

“This Act does not apply to personal or domestic use, or data made publicly available by the Data Principal.” (Sec 3(c))

---

# **SECTION 4 – GROUNDS FOR PROCESSING PERSONAL DATA**

### **Relevant line:**

“Personal data may be processed only for a lawful purpose with the consent of the Data Principal or for legitimate uses.” (Sec 4(1))

---

# **SECTION 5 – NOTICE**

### **Relevant line:**

“Every request for consent shall be accompanied or preceded by a notice describing the personal data and the purpose of processing.” (Sec 5(1))

---

# **SECTION 6 – CONSENT**

### **Relevant lines:**

“Consent shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action.” (Sec 6(1))
“The Data Principal has the right to withdraw consent at any time.” (Sec 6(4))
“On withdrawal of consent, the Data Fiduciary shall cease processing within a reasonable time.” (Sec 6(6))

---

# **SECTION 7 – CERTAIN LEGITIMATE USES (Processing Without Consent)**

### **Relevant line:**

“A Data Fiduciary may process personal data without consent for government benefits, medical emergencies, legal obligations, court orders, and employment-related purposes.” (Sec 7)

---

# **SECTION 8 – GENERAL OBLIGATIONS OF DATA FIDUCIARY**

### **(a) Accuracy:**

“The Data Fiduciary shall ensure the completeness, accuracy and consistency of personal data used for decisions or disclosure.” (Sec 8(3))

### **(b) Security Safeguards:**

“The Data Fiduciary shall protect personal data by taking reasonable security safeguards to prevent personal data breach.” (Sec 8(5))

### **(c) Breach Notification:**

“The Data Fiduciary shall intimate the Board and each affected Data Principal in the event of a personal data breach.” (Sec 8(6))

### **(d) Data Retention:**

“The Data Fiduciary shall erase personal data when the purpose is no longer served or consent is withdrawn, unless retention is required by law.” (Sec 8(7))

### **(e) Grievance Redressal:**

“The Data Fiduciary shall establish an effective mechanism for grievance redressal.” (Sec 8(10))

---

# **SECTION 9 – PROCESSING OF CHILDREN'S DATA**

### **Relevant lines:**

“The Data Fiduciary shall obtain verifiable parental consent before processing the personal data of a child.” (Sec 9(1))
“The Data Fiduciary shall not undertake tracking, behavioural monitoring or targeted advertising directed at children.” (Sec 9(3))

---

# **SECTION 10 – SIGNIFICANT DATA FIDUCIARY**

### **Relevant lines:**

“A Significant Data Fiduciary shall appoint a Data Protection Officer based in India and responsible to the Board of Directors.” (Sec 10(2)(a))
“It shall conduct periodic Data Protection Impact Assessments and audits.” (Sec 10(2)(c))

---

# **SECTION 11 – RIGHT TO ACCESS INFORMATION**

### **Relevant line:**

“The Data Principal has the right to obtain a summary of personal data being processed and the identities of all Data Fiduciaries with whom it has been shared.” (Sec 11(1))

---

# **SECTION 12 – RIGHT TO CORRECTION & ERASURE**

### **Relevant lines:**

“The Data Fiduciary shall correct inaccurate or misleading personal data on request of the Data Principal.” (Sec 12(2)(a))
“The Data Fiduciary shall erase personal data on request unless retention is required for the specified purpose or by law.” (Sec 12(3))

---

# **SECTION 13 – GRIEVANCE REDRESSAL**

### **Relevant line:**

“The Data Fiduciary shall provide readily available means of grievance redressal and respond within the prescribed period.” (Sec 13(2))

---

# **SECTION 14 – NOMINATION**

### **Relevant line:**

“The Data Principal may nominate an individual who shall exercise her rights in case of death or incapacity.” (Sec 14(1))

---

# **SECTION 15 – DUTIES OF DATA PRINCIPAL**

### **Relevant line:**

“The Data Principal shall not impersonate another person or provide false information and must not file frivolous complaints.” (Sec 15)

---

# **SECTION 16 – RESTRICTION ON CROSS-BORDER TRANSFER**

### **Relevant line:**

“The Central Government may restrict transfer of personal data by notification to specified countries.” (Sec 16(1))

---

# **SECTION 17 – EXEMPTIONS**

### **Relevant lines:**

“The provisions of Chapters II and III do not apply where processing is necessary for enforcing legal rights, judicial functions, investigation of offences, or research.” (Sec 17(1),(2))

---

# **SECTION 33 + SCHEDULE – PENALTIES**

### **Relevant line:**

“The Board may impose monetary penalties up to ₹250 crore depending on the nature, gravity and duration of the breach.” (Sec 33(1), Schedule)

---

# ✅ If you want, I can also prepare:

### ✔ A one-page **“Relevant Lines Only” PDF**

### ✔ Case studies mapped → exact section + relevant line

### ✔ A memory-friendly table for last-minute revision

Just tell me!







# ⭐ **CHAPTER I — PRELIMINARY**

---

# **SECTION 1 — Short title and commencement**

**(1)** This Act may be called the Digital Personal Data Protection Act, 2023.
**(2)** It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint, and different dates may be appointed for different provisions of this Act.

---

# **SECTION 2 — Definitions**

In this Act, unless the context otherwise requires—
*(Full definitions retained exactly as in PDF)*

(a) “Appellate Tribunal” …
(b) “automated” …
(c) “Board” …
(d) “certain legitimate uses” …
(e) “Chairperson” …
(f) “child” …
(g) “Consent Manager” …
(h) “data” …
(i) “Data Fiduciary” …
(j) “Data Principal” …
(k) “Data Processor” …
(l) “Data Protection Officer” …
(m) “digital office” …
(n) “digital personal data” …
(o) “gain” …
(p) “loss” …
(q) “Member” …
(r) “notification” …
(s) “person” includes—individual, HUF, company, firm, association, the State, juristic person.
(t) “personal data” means any data about an individual who is identifiable by or in relation to such data.
(u) “personal data breach” …
(v) “prescribed” …
(w) “proceeding” …
(x) “processing” means wholly or partly automated operations performed on digital personal data…
(y) “she” includes reference to individual irrespective of gender.
(z) “Significant Data Fiduciary” …
(za) “specified purpose” …
(zb) “State” means State as under Article 12.

---

# **SECTION 3 — Application of the Act**

Subject to the provisions of this Act, it shall—
**(a)** apply to processing of digital personal data within India where the data is collected
(i) in digital form; or
(ii) in non-digital form and digitised subsequently.

**(b)** also apply to processing outside India, if such processing is for offering goods or services to Data Principals in India.

**(c)** not apply to—
(i) personal or domestic use;
(ii) personal data made publicly available by
  (A) the Data Principal; or
  (B) any person obligated by Indian law to make it publicly available.

---

# ⭐ **CHAPTER II — OBLIGATIONS OF DATA FIDUCIARY**

---

# **SECTION 4 — Grounds for processing personal data**

**(1)** Personal data may be processed only in accordance with this Act and for a lawful purpose—
(a) for which the Data Principal has given consent; or
(b) for certain legitimate uses.

**(2)** “Lawful purpose” means any purpose not expressly forbidden by law.

---

# **SECTION 5 — Notice**

**(1)** Every request for consent shall be accompanied or preceded by notice informing the Data Principal of—
(i) the personal data and the purpose of processing;
(ii) the manner of exercising rights under Sec 6(4) and Sec 13;
(iii) the manner of making a complaint to the Board.

**(2)** For consent given before commencement of the Act, the Data Fiduciary must provide notice containing the above details.

**(3)** The notice must be available in English or any Eighth Schedule language.

---

# **SECTION 6 — Consent**

**(1)** Consent must be free, specific, informed, unconditional, unambiguous, with clear affirmative action, and limited to data necessary for the specified purpose.

**(2)** Any part of consent violating this Act is invalid to that extent.

**(3)** Consent request must be in clear language and must provide contact details of DPO or authorised person.

**(4)** Data Principal has the right to withdraw consent at any time, with comparable ease as giving consent.

**(5)** Consequences of withdrawal shall be borne by the Data Principal and shall not affect legality of prior processing.

**(6)** Upon withdrawal, the Data Fiduciary must cease processing unless required/authorised by law.

**(7)** Consent may be managed through a Consent Manager.

**(8)** Consent Manager shall be accountable to the Data Principal.

**(9)** Consent Manager must be registered with the Board.

**(10)** Data Fiduciary must prove that valid notice and consent were given, if questioned.

---

# **SECTION 7 — Certain legitimate uses**

A Data Fiduciary may process personal data for the following uses:

(a) specified purpose for which Data Principal voluntarily provided personal data without indicating non-consent.
(b) State functions for providing subsidies/benefits/services, subject to prescribed conditions.
(c) performance of State functions under law or in interest of sovereignty/security.
(d) legal obligations requiring disclosure to the State.
(e) compliance with judgment/decree/order.
(f) medical emergency involving threat to life/health.
(g) medical treatment/health services during epidemics, outbreaks, public health threats.
(h) measures for safety, assistance, or services during disasters or breakdown of public order.
(i) purposes of employment, or safeguarding employer interests such as secrecy, security, or benefits.

---

# **SECTION 8 — General obligations of Data Fiduciary**

**(1)** Data Fiduciary is responsible for compliance with this Act for all processing done by it or on its behalf.
**(2)** Data Processor may be engaged only under a valid contract.
**(3)** If personal data is used for decision-making or disclosure, it must be complete, accurate, consistent.
**(4)** Data Fiduciary must implement appropriate technical and organisational measures.
**(5)** Must protect personal data by reasonable security safeguards to prevent breach.
**(6)** Must notify the Board and affected Data Principals of a personal data breach.
**(7)** Must erase personal data upon consent withdrawal or when purpose is no longer served, unless retention required by law.
**(8)** “Purpose no longer served” may be declared based on non-interaction for prescribed time.
**(9)** Must publish business contact information of DPO or responsible person.
**(10)** Must establish an effective grievance redressal mechanism.
**(11)** Clarifies when Data Principal is considered to have not approached for performance of purpose.

---

# **SECTION 9 — Processing personal data of children**

**(1)** Must obtain verifiable parental/guardian consent before processing personal data of a child or person with disability having a guardian.
**(2)** Must not process personal data likely to cause detrimental effect on child’s well-being.
**(3)** Must not undertake tracking, behavioural monitoring, or targeted advertising directed at children.
**(4)** Govt may exempt certain Fiduciaries/purposes from (1) and (3).
**(5)** Govt may notify age relaxation for a Data Fiduciary if safe processing is ensured.

---

# **SECTION 10 — Additional obligations of Significant Data Fiduciary**

**(1)** Govt may notify any Data Fiduciary as Significant Data Fiduciary based on volume, sensitivity, risk, sovereignty, democracy, security, public order.

**(2)** Significant Data Fiduciary must—
(a) appoint a Data Protection Officer who shall
 (i) represent the SDF under this Act;
 (ii) be based in India;
 (iii) be responsible to Board of Directors;
 (iv) be point of contact for grievance redressal.

(b) appoint an independent data auditor for compliance audit.

(c) undertake—
 (i) periodic Data Protection Impact Assessments;
 (ii) periodic audits;
 (iii) other prescribed measures.

---

# ⭐ **CHAPTER III — RIGHTS AND DUTIES OF DATA PRINCIPAL**

---

# **SECTION 11 — Right to access information about personal data**

**(1)** Data Principal has right to obtain from the Data Fiduciary—
(a) a summary of personal data being processed and processing activities;
(b) identities of all Data Fiduciaries/Data Processors with whom data has been shared, and description of data shared;
(c) any other prescribed information.

**(2)** Exception: Not applicable where data is shared with another DF authorised by law for law enforcement or cybersecurity purposes.

---

# **SECTION 12 — Right to correction and erasure**

**(1)** Data Principal may request correction, completion, updating, and erasure of personal data.
**(2)** Upon such request, the Data Fiduciary shall—
(a) correct inaccurate or misleading data;
(b) complete incomplete data;
(c) update data.

**(3)** Data Fiduciary must erase personal data unless retention is necessary for specified purpose or legal compliance.

---

# **SECTION 13 — Right of grievance redressal**

**(1)** Data Principal has right to have readily available means of grievance redressal.
**(2)** Fiduciary or Consent Manager must respond within prescribed timeline.
**(3)** Data Principal must exhaust grievance remedy before approaching Board.

---

# **SECTION 14 — Right to nominate**

**(1)** Data Principal may nominate another individual to exercise her rights in case of death or incapacity.
**(2)** “Incapacity” means inability due to unsoundness of mind or infirmity of body.

---

# **SECTION 15 — Duties of Data Principal**

A Data Principal shall—
(a) comply with applicable laws while exercising rights;
(b) not impersonate another person when providing personal data;
(c) not suppress material information while providing personal data for identity documents;
(d) not file false or frivolous grievance/complaint;
(e) furnish only verifiably authentic information when seeking correction or erasure.

---

# ✅ **If you want next:**

✔ Section 16–44 in the same clean structured format
✔ A **one-page exam cheat sheet**
✔ A **case-study mapping guide** to identify which section applies

Just tell me!