Lexfolio

Certificate Course in Data Protection Law: DPDP Act 2023 and DPDP Rules 2025

Uncategorized
Wishlist Share

About Course

Certificate Course in Data Protection Law: DPDP Act 2023 and DPDP Rules 2025 is a self-paced online course by Lexfolio that takes you through India’s new data protection regime, from the constitutional foundations laid in Puttaswamy (2017) to the detailed obligations in the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025 and coming into force in phases up to 13 May 2027. Every lesson is written in plain language, cites the relevant section or rule, and ends with worked examples and key takeaways. The law is stated as on 18 October 2026.

What you will learn

  • The background to the law: the right to privacy, the Srikrishna Committee and the legislative history of the DPDP Act, 2023.
  • The phased commencement of the Act and the DPDP Rules, 2025, and what applies today, from 13 November 2026 and from 13 May 2027.
  • Scope and applicability, including extra-territorial reach, exclusions and the exemptions in section 17.
  • Key definitions: Data Principal, Data Fiduciary, Data Processor, Consent Manager, personal data breach.
  • Grounds for processing: notice, valid consent and its withdrawal, and the nine legitimate uses.
  • Consent Managers, children’s data and verifiable parental consent, and persons with disability.
  • Rights and duties of Data Principals and how to handle rights requests within the 90 day limit.
  • Obligations of Data Fiduciaries: security safeguards, 72 hour breach reporting, retention and erasure.
  • Significant Data Fiduciaries (DPO, DPIA, audit) and cross-border transfers.
  • The Data Protection Board, appeals to TDSAT, the penalty Schedule, and the interplay with IT Act section 43A and RTI Act section 8(1)(j).
  • A practical compliance checklist, model privacy notice clauses and a DPDP versus GDPR comparison.

Who this course is for

  • Law students preparing for internships, moots, electives and examinations in technology and privacy law.
  • Young lawyers advising startups, businesses and institutions on data protection.
  • Compliance, HR, IT and information security professionals responsible for implementing the DPDP Act.
  • Startup founders and managers who handle customer or employee data.

How the course and certificate work

  • The course has 9 modules and 25 text lessons. Each module ends with a short quiz to check your understanding.
  • After completing the lessons, you take an online final assessment of 30 multiple choice questions, many based on practical scenarios, with a time limit of 45 minutes. The pass mark is 60%.
  • On passing, you receive a certificate of completion issued by Lexfolio, bearing a unique certificate ID that can be verified online, which you can add to your CV and LinkedIn profile.
  • The certificate records completion of a Lexfolio online course. It is not a degree, diploma or regulatory qualification, and does not confer any right to practise law.

This course is for educational purposes only and is not legal advice. For advice on a specific situation, consult a qualified professional.

Show More

What Will You Learn?

  • Explain the constitutional basis of data protection in India after Puttaswamy (2017) and the legislative history of the DPDP Act, 2023
  • Identify which provisions of the DPDP Act and Rules are in force and which commence on 13 November 2026 and 13 May 2027
  • Determine whether the Act applies to a given organisation or activity, including foreign entities, and identify applicable exemptions
  • Draft an itemised privacy notice and valid, unbundled consent text that meet section 5, section 6 and rule 3
  • Distinguish processing on consent from processing for the legitimate uses in section 7
  • Advise on verifiable parental consent, the ban on tracking and targeted advertising for children, and Fourth Schedule exemptions
  • Design a process for handling Data Principal rights requests and grievances within the 90 day limit
  • Apply the rule 6 security safeguards and the two stage rule 7 breach intimation, alongside CERT-In reporting
  • Prepare a retention schedule reflecting section 8(7), rule 8 and the Third Schedule
  • Explain the additional obligations of Significant Data Fiduciaries and the rules on cross-border transfers
  • Describe Data Protection Board procedure, appeals to TDSAT and the penalty Schedule, and the impact on IT Act section 43A and RTI Act section 8(1)(j)
  • Compare the DPDP Act with the EU GDPR and build a practical compliance checklist

Course Content

Module 1: Foundations of Data Protection Law in India
How privacy became a fundamental right, how India moved from the IT Act regime to a dedicated data protection statute, and when each part of the DPDP Act and Rules comes into force.

  • Privacy as a fundamental right: the Puttaswamy judgment
  • From the Srikrishna Committee to the DPDP Act, 2023
  • The DPDP Rules, 2025 and the phased commencement
  • Module 1 quiz: Foundations

Module 2: Scope, Applicability and Key Definitions
Which data and which entities the DPDP Act covers, inside and outside India, the vocabulary of the Act, and the exemptions for legal claims, the State, research and startups.

Module 3: Grounds for Processing: Notice, Consent, Legitimate Uses and Consent Managers
The two lawful grounds for processing, what a valid notice and a valid consent look like, when consent is not needed, and how registered Consent Managers will work from November 2026.

Module 4: Children’s Data and Persons with Disability
The additional duties for processing data of anyone under 18 and of persons with disability who have lawful guardians: verifiable consent, the ban on tracking and targeted advertising, and the exemptions in the Fourth Schedule.

Module 5: Rights and Duties of Data Principals
The rights to access, correction, erasure, grievance redressal and nomination, how a business should handle rights requests under rule 14, and the duties the Act places on individuals.

Module 6: Obligations of Data Fiduciaries
Accountability for processors, accuracy, reasonable security safeguards under rule 6, the two stage breach intimation under rule 7, retention and erasure under rule 8 and the Third Schedule, contact details and grievance redressal.

Module 7: Significant Data Fiduciaries and Cross-Border Transfers
How the Central Government will designate Significant Data Fiduciaries and what extra duties follow (DPO, independent data auditor, DPIA, annual audit, algorithmic due diligence, localisation of specified data), and the negative list approach to transfers outside India.

Module 8: Enforcement: the Data Protection Board, Appeals, Penalties and Other Laws
How the Data Protection Board is constituted and conducts inquiries as a digital office, mediation and voluntary undertakings, appeals to TDSAT, the penalty Schedule, blocking, and how the Act interacts with IT Act section 43A and the RTI Act.

Module 9: Practical Compliance and Comparative Perspective
A step by step DPDP compliance roadmap and checklist for the period up to May 2027, model privacy notice and consent clauses you can adapt, and a structured comparison of the DPDP Act with the EU GDPR.

Final Assessment and Certificate
Pass the final assessment with 60% or more to receive your certificate of completion. You have 3 attempts.

Student Ratings & Reviews

No Review Yet
No Review Yet