Data Protection Law MCQs

Sample Data Protection Law MCQs with answers

10 of the 100 questions, with the answer and explanation. Open a question to try it yourself first.

1. Q1. Which three Vs did the industry analyst Doug Laney use in 2001 to describe the growth of data?

   1. (A) Volume, Veracity and Value
   2. (B) Volume, Velocity and Variety
   3. (C) Velocity, Variety and Veracity
   4. (D) Volume, Value and Variety
   Show answer and explanation

   Answer: (B) Volume, Velocity and Variety

   In 2001, Doug Laney described data growth in terms of three Vs: Volume, Velocity and Variety. Veracity and Value were added later by other writers, which is why the options that include them are wrong as a statement of Laney's original three Vs.

2. Q2. Under Section 2(f) of the DPDP Act, 2023, who is a child?

   1. (A) An individual who has not completed 18 years of age
   2. (B) An individual who has not completed 16 years of age
   3. (C) An individual who has not completed 13 years of age
   4. (D) An individual who has not completed 21 years of age
   Show answer and explanation

   Answer: (A) An individual who has not completed 18 years of age

   Section 2(f) defines a child as an individual who has not completed 18 years of age, the highest age among the DPDP Act, the GDPR and the CCPA. The age of 16 is tempting because it is the GDPR's default age for a child's own consent to online services and the CCPA's age for opt-in before selling or sharing, but it is not the Indian rule.

   Provision: Section 2(f), Digital Personal Data Protection Act, 2023

3. Q3. Under Section 2(a) of the DPDP Act, 2023, which body is the Appellate Tribunal that hears appeals against the Data Protection Board?

   1. (A) National Company Law Appellate Tribunal
   2. (B) Telecom Disputes Settlement and Appellate Tribunal
   3. (C) Securities Appellate Tribunal
   4. (D) Cyber Appellate Tribunal
   Show answer and explanation

   Answer: (B) Telecom Disputes Settlement and Appellate Tribunal

   Section 2(a) names the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) as the Appellate Tribunal that hears appeals against the Board. The Cyber Appellate Tribunal sounds right for a data law, but the DPDP Act does not give it this role.

   Provision: Section 2(a), Digital Personal Data Protection Act, 2023

4. Q4. Under Section 13(3) of the DPDP Act, 2023, what must a Data Principal do before approaching the Data Protection Board?

   1. (A) Exhaust the grievance redressal mechanism of the Data Fiduciary or Consent Manager
   2. (B) File a civil suit for damages against the Data Fiduciary
   3. (C) Obtain the permission of the Appellate Tribunal
   4. (D) Send a complaint to the Central Government
   Show answer and explanation

   Answer: (A) Exhaust the grievance redressal mechanism of the Data Fiduciary or Consent Manager

   Section 13(3) requires the Data Principal to exhaust the grievance mechanism provided by the Data Fiduciary or Consent Manager before approaching the Board, so the first door is always the organisation itself. The Appellate Tribunal is wrong because it hears appeals against the Board, so it comes after the Board, not before it.

   Provision: Section 13(3), Digital Personal Data Protection Act, 2023

5. Q5. What is the maximum penalty that a Data Principal can face for breaching her duties under Section 15 of the DPDP Act, 2023?

   1. (A) 1,000 rupees
   2. (B) 50,000 rupees
   3. (C) 1 lakh rupees
   4. (D) 10,000 rupees
   Show answer and explanation

   Answer: (D) 10,000 rupees

   Section 15 lists five duties of the Data Principal, such as not impersonating another person and not filing false or frivolous complaints, and a breach can attract a penalty of up to 10,000 rupees. The other amounts are not the limit set by the Act; separately, Section 28(12) lets the Board warn or impose costs on a person who files a false or frivolous complaint.

   Provision: Section 15 read with Section 33 and the Schedule (item 5), Digital Personal Data Protection Act, 2023

6. Q6. In 'The Age of Surveillance Capitalism' (2019), what term does Professor Shoshana Zuboff use for the behavioural data that digital companies collect beyond what is needed to improve their services?

   1. (A) Data exhaust
   2. (B) Behavioural surplus
   3. (C) Prediction product
   4. (D) Big data dividend
   Show answer and explanation

   Answer: (B) Behavioural surplus

   Zuboff calls the extra behavioural data, collected beyond what is needed to improve a service, behavioural surplus. Prediction products are what is made from that surplus and sold to businesses that want to influence behaviour, so that option names the output, not the raw material.

7. Q7. Interface tricks such as a hidden unsubscribe button, a fake countdown timer or a pre-ticked box are called dark patterns. Which Indian authority issued guidelines in 2023 to prevent and regulate dark patterns in online commerce?

   1. (A) Data Protection Board of India
   2. (B) Telecom Regulatory Authority of India
   3. (C) Central Consumer Protection Authority
   4. (D) Competition Commission of India
   Show answer and explanation

   Answer: (C) Central Consumer Protection Authority

   The Central Consumer Protection Authority issued the 2023 guidelines on dark patterns in online commerce, which makes manipulation a concern of consumer law as well as data protection law. The Data Protection Board of India is tempting because dark patterns also affect consent, but the 2023 guidelines came from the consumer protection regulator.

8. Q8. Which historian popularised the term 'Dataism' in Homo Deus, describing a worldview in which the free flow of information becomes the highest value?

   1. (A) David Brooks
   2. (B) Yuval Noah Harari
   3. (C) Shoshana Zuboff
   4. (D) Frederick Winslow Taylor
   Show answer and explanation

   Answer: (B) Yuval Noah Harari

   Yuval Noah Harari popularised Dataism in Homo Deus as a worldview in which the universe consists of data flows. David Brooks is the tempting option because he used the term 'data-ism' in 2013, but he is a writer who used it in a 2013 column, not the historian who popularised it in Homo Deus.

9. Q9. In a dispute under the DPDP Act, 2023, on whom does the burden lie to prove that a proper notice was given and valid consent was obtained?

   1. (A) The Data Fiduciary
   2. (B) The Data Principal
   3. (C) The Data Protection Board of India
   4. (D) The Consent Manager
   Show answer and explanation

   Answer: (A) The Data Fiduciary

   Section 6(10) places the burden on the Data Fiduciary to prove that it gave a proper notice and obtained valid consent. It is tempting to think the complaining Data Principal must prove her case, but the Act shifts this burden to the party that collected the data, much like Article 7 of the GDPR.

   Provision: Section 6(10), Digital Personal Data Protection Act, 2023

10. Q10. Under the DPDP Act, 2023, which Section allows a nominee to act for a Data Principal after her death or incapacity?

    1. (A) Section 12
    2. (B) Section 13
    3. (C) Section 14
    4. (D) Section 9
    Show answer and explanation

    Answer: (C) Section 14

    A nominee can act after the death or incapacity of the Data Principal under Section 14. Section 12 is tempting because it deals with a right (erasure), but it does not cover nomination. Section 9 contains duties on processing children's data.

    Provision: Section 14, Digital Personal Data Protection Act, 2023