GNU Legal · DPDP PractitionerA learning initiative from GNU IT Solutions & Services
Public Beta RCEngine: checking…Local progressGNU Legal HomeFeedback
Free practice-based privacy learning

Understand privacy law.
Build compliance. Handle incidents.

Turn the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 into decisions, documents, investigations and professional simulations.

Choose your practice depth
Practitioner mode focuses on applicability, compliance architecture, incidents, drafting and operational advice.

Real matters, not chapter reading

Investigate facts, identify operative law, draft, challenge, respond and defend the advice.

Diagnostic feedback

Track issue spotting, legal accuracy, fact discipline, authority use, judgment, drafting and advocacy.

Court-ready habits

Learn to ask: what proves this, where is it in the record, what will the other side say, and what is the fallback?

Current-law guard: calculating commencement status…
v0.5.1 legal audit status: DPDP Act / commencement / final Rules / Rules corrigendum framework and core statutory propositions have been checked against official sources on 18 September 2026. Appellate case metadata and official judgment links have been checked. Pinpoint paragraph propositions and comprehensive later-treatment research are not yet pre-curated; perform those checks before filing or advising in a live matter.
3simulated matters
72hbreach readiness war room
EN / हिंदीprivacy counsel coach
Freeno login required

Learn

Scope, roles, commencement, obligations and official sources.

Build

Notices, safeguard evidence, processor clauses and rights workflows.

Defend

Incidents, adverse facts and simulated Board questions.

Training principle

Ask: What data? What purpose? Which actor? Which system? Which provision? Is it in force? What evidence proves compliance?

The most important DPDP screen

Commencement Clock

The Act and Rules are phased. This workbench calculates status from your device date so future obligations are not taught as present obligations.

Professional caution: other statutes, contracts, sectoral regulation or cybersecurity directions may separately apply. “DPDP provision not yet commenced” does not mean “no legal obligation exists.”

Scope & Applicability Lab

Decide whether the DPDP framework reaches the processing before jumping to consent, breach or penalty analysis.

Core map

  • Digital personal data processed in India where collected digitally or later digitised.
  • Processing outside India can be reached when connected with offering goods/services to Data Principals in India.
  • Section 3(c) excludes (i) personal data processed by an individual for a personal or domestic purpose, and (ii) personal data made publicly available by the Data Principal, or by another person who is under a legal obligation in India to make it publicly available.
Status: §3 is in the eighteen-month phase; treat this as readiness analysis until the scheduled commencement date.

Triage

Role Mapping

Role labels follow what an actor actually does for a processing activity, not just what the contract calls them.

Exercise

RetailCo decides why customer data is used. CloudHost stores it under RetailCo's instructions. Priya is the customer.

RetailCo

CloudHost

Priya

Notice & Consent Workbench

Convert abstract compliance into information a real person can understand. This remains readiness practice until the relevant substantive provisions and Rule 3 commence.

Bad notice

By continuing, you agree that we may process information for business purposes, analytics, partners, offers and other functions as necessary. See our policies.

Reconstruct

Security Safeguards — Legal ↔ Technical Bridge

Rule 6 specifies a minimum safeguard architecture in the eighteen-month phase. Translate it into evidence counsel, DPOs and security teams can inspect.

Protect

Encryption, obfuscation, masking or virtual-token techniques as appropriate.

Control & Observe

Access controls, logs, monitoring and review for unauthorised access.

Recover & Contract

Backups/continuity, processor-contract safeguards and technical/organisational measures.

RiskControl familyEvidence to ask for
Privileged credential theftIAM/MFA/least privilegeAccount inventory, MFA policy, auth logs, role assignments
Database exfiltrationEncryption/masking + monitoringKMS/access/export logs, alerts, query records
RansomwareBackups/recoveryBackup policy, restore test, RPO/RTO evidence
Processor compromiseContract + oversightSecurity clauses, escalation, assurance, subprocessor map
Precision: Rule 6 includes a one-year retention element for specified logs/personal data used for detection, investigation, remediation and continuity, unless another law requires otherwise. Do not turn that into “retain all personal data for one year.”
Separate Rule 8(3) retention rule: when Rule 8 becomes operative, it separately requires a Data Fiduciary, for processing undertaken by it or on its behalf, to retain personal data, associated traffic data and other processing logs for a minimum of one year for the purposes specified in the Seventh Schedule, followed by erasure unless further retention is required by another law or notified by Government. Do not conflate Rule 6(1)(e), Rule 8(3), and ordinary purpose-limitation/erasure analysis.

DPDP Quick Reference

A practice-oriented index: status → statutory function → application → common trap → counsel question. Open the official text before relying on the exact words of a provision.

Reference discipline: summaries below are learning aids. The Act, Rules, Gazette notifications and current judicial authorities remain the source of law.

Practice Skills Dashboard

Feedback across the workbench is grouped into seven professional habits. Scores are local training diagnostics—not certification, ranking or proof of professional competence.

Senior's recurring notes

Complete drafting and matter exercises to build a pattern of feedback.

How to improve

The dashboard will identify the lowest current dimension and suggest the next practice station.

72-Hour Breach War Room

Readiness simulation built around Rule 7. Before scheduled commencement it is preparation, not a claim that Rule 7 is already operative.

Mode: calculating…

Incident

09:10 SOC detects bulk customer-data export from a privileged cloud account.
09:23 Credential disabled. Scope uncertain.
09:41 Processor says detailed logs remain available for 30 days.
10:05 CEO asks: “Can we wait until we know everything?”

What do you do first?

Training clock

72:00:00

Rule 7, when operative, requires initial Board intimation without delay and a detailed update within 72 hours of awareness, unless a longer period is allowed on written request.

Data Principal Rights Workbench

“Tell me what personal data you hold about me, correct my phone number, and delete everything immediately.”

Children's Data Decision Lab

StudySpark proposal

School-student app profiles study behaviour, recommends exercises, measures engagement and lets ad partners target “high-interest learners.”

Product counsel questions

  • Age/child definition and commencement status?
  • Verifiable parental consent when operative?
  • Tracking/behavioural monitoring?
  • Targeted advertising?
  • Prescribed exemptions/conditions?
  • Safer product redesign?

Processor Contract Lab

CloudHost will maintain industry-standard security and notify RetailCo of incidents where appropriate. CloudHost may use affiliates.

DPDP-001 — E-commerce Consent & Retention

RetailCo mixes account, delivery, analytics and marketing processing. Withdrawal arrives while the account remains active.

Open documents before advising.

DPDP-002 — Cloud Breach & Response

Bulk export through a privileged account; processor log retention is short; facts are incomplete.

Open incident materials.

DPDP-003 — EdTech Children's Data

StudySpark uses identity, class level, performance, device identifiers and behavioural engagement data.

Open product materials.

Constitutional Privacy Chamber

DPDP litigation can raise statutory questions, but a High Court or Supreme Court matter may also engage constitutional privacy, proportionality, legality, safeguards, procedural fairness and judicial review. Do not collapse those into a single “privacy” label.

Analytical ladder

1 · State / private action?Identify the actor and the legal route. Constitutional review questions differ from private compliance disputes.
2 · Protected interest?Identify the privacy/autonomy/data interest actually affected rather than invoking privacy at a high level.
3 · Legal basisWhat law or statutory power authorises the interference or decision?
4 · Legitimate purposeState the purpose precisely.
5 · Proportionality / safeguardsTest rational connection, necessity/less restrictive alternatives and balancing as relevant to the pleaded challenge.
6 · RemedyWhat exactly should the Court quash, stay, declare, remit or direct?

Constitutional issue-spotting drill

A statutory authority directs a platform to provide a broad class of user data. The platform challenges the direction.

Appellate discipline: Puttaswamy is foundational, but “privacy is a fundamental right” is only the start of analysis. The pleading must identify the precise interference, legal basis, standard of review, relevant safeguards and remedy.

Authority Workbench

The appellate standard is proposition → authority → bench strength → procedural posture → exact passage → later treatment → application/distinction. A case name alone is not research.

Doctrinal context map

Puttaswamy (2017)

Nine-judge constitutional foundation for privacy.

→
Aadhaar (2018)

Applies privacy/proportionality principles in a major data-identity statutory context.

→
Anuradha Bhasin (2020)

Important proportionality / reasonableness context in digital-rights restrictions.

This is a doctrinal-context map only. The arrows do not mean that one case formally follows, approves or applies every proposition in the previous case. Verify the exact proposition and later treatment before filing.

Pin the proposition

Authority quality checklist

Record & Citation Discipline

Senior appellate preparation repeatedly asks two questions: Where is that in the record? and Where is that proposition in the authority?

Fictional writ record

Record itemPagesWhat it may prove
Annexure P-4 · Data direction112–118Exact scope, statutory basis invoked and compliance deadline.
Annexure P-7 · Petitioner's response164–179Objections raised before the authority and proposed narrower alternative.
Annexure P-11 · Impugned order241–268Reasons actually recorded, treatment of objections and operative directions.
Annexure P-13 · Technical architecture note301–323Data categories, system separation and claimed feasibility of narrower production.

“Where is that in the record?”

Proposition: “The authority never considered the petitioner's narrower technical alternative.”

Record traps

  • Citing a pleading for a fact when the primary document is in the record.
  • Giving a page range so broad that senior cannot find the passage quickly.
  • Stating a fact that appears only in oral instructions, not the filed record.
  • Confusing what the authority could have considered with what the order records it did consider.

High Court Litigation Lab

Fictional DPDP-HC-001 trains maintainability, jurisdiction, record, statutory interpretation, judicial review, interim relief and respondent-side attack.

DPDP-HC-001 · Challenge to data direction

A company challenges a statutory authority's direction requiring production of a broad class of user data. The authority argues alternative remedy, statutory power and urgency. The company alleges overbreadth, inadequate reasons and disproportionate interference.

First conference: do not begin by drafting grounds. Decide whether the petition is maintainable and what immediate relief is realistically required.

Your writ strategy

Switch sides — Respondent's Counsel

Supreme Court Appellate Lab

This is not “High Court mode with harder questions.” The exercise forces question formulation, procedural history, precedent hierarchy, national significance, narrower fallback propositions and record discipline.

DPDP-SC-001 · Fictional appellate posture

A High Court has rejected a challenge involving the breadth of a statutory data-production power. The proposed Supreme Court challenge says the judgment applies privacy doctrine too abstractly and fails to test statutory safeguards and narrower alternatives.

Procedural historyBoard/statutory stage → High Court → proposed Supreme Court challenge.
Do not assumethat a broad constitutional question automatically makes a matter suitable for Supreme Court intervention.

Question presented

Why this matter?

Fallback proposition

Precedent hierarchy exercise

Order these research tasks before relying on a precedent:

Senior Conference — Five Minutes Before Court

Senior should be able to enter Court after your brief. If the answer requires reading the whole file again, the conference has failed.

1 · Matter in one sentence

2 · Issue today

3 · What happened below

4 · Strongest authority

5 · Bad fact / weakness

6 · Opponent's best point

7 · Exact relief

8 · Fallback

90

Final Chambers Assessment — DPDP-FINAL-001

An unfamiliar matter. No model answer is shown while assessment mode is active. Analyse commencement, facts, legal issues, evidence, client action and litigation posture.

Assessment not started
Coach remains available until you start. Suggested time: 35 minutes.
35:00

Matter: AsterLearn Technologies Pvt Ltd

AsterLearn operates a learning platform used by adults and school students. A cloud administrator account was compromised. An export appears to contain account details, study activity and marketing segments. Some student accounts are under 18. A parent complains that advertising continued after an opt-out. Management wants to notify nobody until forensics is complete.

Open the matter documents. Some facts are deliberately incomplete.

1 · Commencement & legal map

2 · Fact discipline

3 · Top issues

4 · First 24 hours

5 · Evidence & record plan

6 · Counsel advice & fallback

Data Protection Board & Enforcement

Institutional status

The Data Protection Board of India was established by G.S.R. 844(E) dated 13 November 2025, with its head office in the National Capital Region. G.S.R. 845(E) was issued under §19(1), and MeitY's 6 May 2026 recruitment notice invited applications for 1 Chairperson and 4 Member posts.

Currency guard: this build deliberately does not state that appointments have or have not subsequently been made. The latest official status material actually relied upon here is identified in Sources; search for later appointment/procedure notifications before live reliance.

Board conference drill

“Counsel, show me awareness chronology, preservation, what you knew at each reporting point, and the evidence for mitigation.”

Official Sources & Currency

Primary law is separated from explanatory material. The coach is commentary, not authority.

Primary law

Digital Personal Data Protection Act, 2023

Official Act PDF
Primary notification

G.S.R. 843(E) — phased commencement

Official commencement notification
Primary rules

DPDP Rules, 2025 — G.S.R. 846(E)

Official Rules PDF
Official collection

MeitY DPDP Rules 2025 materials

Rules, enforcement timeline, Board notifications and corrigendum.

MeitY collection
Primary corrigendum

G.S.R. 892(E) — Corrigendum to DPDP Rules, 2025

Corrigendum dated 10 December 2025 / Gazette publication 11 December 2025. It corrects textual references in the Rules, including the commencement wording and several schedule/rule typographical points.

Official India Code item
Primary notification

G.S.R. 845(E) — DPBI membership notification

Notification issued under §19(1). Read together with the Act and the later recruitment notice when describing Board composition.

Official notification
Primary notification

G.S.R. 844(E) — Establishment of DPBI

Official notification
Official 2026 status source

MeitY recruitment notice — DPBI Chairperson and Members

Official 6 May 2026 notice
Binding constitutional authority · 9 judges

Justice K.S. Puttaswamy (Retd.) v. Union of India — (2017) 10 SCC 1

Foundational constitutional privacy authority. Because the judgment contains multiple opinions, pin the exact opinion/paragraph for the proposition relied upon rather than citing the case generically.

Official Supreme Court judgment PDF
Binding constitutional authority · 5 judges

Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar) — (2019) 1 SCC 1

Major application of privacy and proportionality principles in a statutory identity/data context. Check majority/dissent and exact proposition before use.

Official Supreme Court PDF
Binding Supreme Court context · 3 judges

Anuradha Bhasin v. Union of India — (2020) 3 SCC 637

Important digital-rights and proportionality/reasonableness authority. Use only for the proposition actually supported by the judgment.

Official Supreme Court PDF
Binding Supreme Court privacy context · 2 judges

People's Union for Civil Liberties (PUCL) v. Union of India — (1997) 1 SCC 301

Pre-DPDP privacy/surveillance authority. Treat as constitutional/contextual precedent, not as interpretation of the DPDP Act.

Official Supreme Court PDF
Research tool

Supreme Court Verdict Finder

Use official Supreme Court research tools to verify exact judgment text and current/later treatment.

Open Verdict Finder
Law/source audit date: 18 September 2026. Primary-law propositions in this build were checked against the Act, G.S.R. 843(E), G.S.R. 846(E), the corrigendum framework, and DPBI notifications. Supreme Court case metadata/links were checked against official Supreme Court materials. This is not a substitute for proposition-level paragraph verification and later-treatment research before a live filing.

System QA & Release Gate

Legal gate

  • Independent privacy/litigation practitioner review
  • Commencement refresh
  • Rules corrigendum checked
  • Sectoral-law caveats reviewed
  • Board status refreshed

Learning gate

  • Decision before answer
  • Ambiguity/adverse facts
  • No commentary presented as authority
  • Transfer across three matters
  • Hindi reviewed for legal precision