DCPLA Practice Questions

Privacy-enhancing technologies (PETs) are critical for operationalizing privacy principles. According to

the DPF©:

Data minimization (I): Collect only necessary data

Data scrambling (III), Obfuscation (VI), and Encryption (VII): Techniques to protect identity and data

content

Data loss prevention (IV): Prevent unauthorized sharing or leakage

Data mirroring and intrusion prevention systems are primarily security mechanisms and not

specifically privacy-focused. Data portability, while a right, is not a technology per se for “upholding”

privacy but for enabling user control.

Thus, C includes the most appropriate privacy technologies.

The concept of "Privacy by Design" is a core principle emphasized in the DSCI Privacy Framework

(DPF©) and DSCI Assessment Framework for Privacy (DAF-P©). This principle requires that privacy

be integrated into the design specifications and architecture of IT systems and business processes,

right from the start of the development process rather than being added later as an afterthought.

The DSCI Privacy Framework states:

"Privacy by Design is a proactive approach that embeds privacy into the design and operation of IT

systems, networked infrastructure, and business practices. It aims to ensure that privacy is built into

the system by default, thereby preventing privacy-invasive events before they happen."

This ensures data protection is foundational to system architecture and not merely a compliance

requirement added later. This proactive method mitigates risks and enhances user trust by

safeguarding personal information through preventive measures rather than reactive ones.

The landmark judgment in “Justice K. S. Puttaswamy (Retd.) and Anr. vs. Union of India And Ors” delivered on August 24, 2017, reaffirmed that: "The Right to Privacy is protected as an intrinsic part of the Right to Life and Personal Liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution." This case is foundational to the development of privacy jurisprudence in India and has guided the formulation of the Indian Data Protection law.

The Information Technology (Amendment) Act, 2008 introduced critical provisions for data

protection:

Section 43A: Mandates compensation for failure to protect personal data by a body corporate

handling sensitive personal data or information (SPDI).

Section 72A: Imposes penalties for disclosure of information in breach of lawful contracts.

These two sections form the legal basis for protection of personal data under the IT Act in India.

According to the DSCI Privacy Framework and aligned international frameworks such as GDPR and

APEC, a “Data Subject” refers to:

"An identified or identifiable natural person to whom the personal data relates."

This includes individuals whose data is being collected, held, or processed by any entity. Thus:

A (an individual providing their data to avail a service) is a data subject because the data is about

them.

C (an individual whose data/information is processed) directly matches the definition.

Options B, D, and E refer to entities or persons involved in processing or handling the data, not the

individuals to whom the data belongs.

According to the DSCI Assessment Framework for Privacy (DAF P©), the total duration for completing

the assessment, from the initial kickoff to the final report submission to DSCI, must be concluded

within a two-week period. This timeline ensures the assessment stays current and reflects the

organization's real-time privacy status during certification.

According to the DAF P©, the assessment process begins only after the assessee provides required

pre-requisites. These may include:

Completed self-assessment checklist

Documentation on privacy policy, data flows, training records, etc.

This ensures the assessor can effectively plan the assessment and identify areas for further

investigation.

The DAF P© clearly mandates that only assessors affiliated with DSCI Accredited Organizations are

authorized to conduct certification assessments. Even if an individual holds a DSCI Certified Lead

Assessor credential, they must be employed with or contracted through an accredited organization

to carry out official DSCI certification assessments.

The DAF P© explicitly states that only DSCI has the authority to issue privacy certification. The

assessor organization conducts the assessment and submits the findings and recommendation, but

the final certification decision rests solely with DSCI based on its review process.

below.

Explanation:

The information security function of XYZ needs to realign the company’s security initiatives to

include privacy protection and make sure that it meets its client’s requirements. The Information

Security team must understand the legal and regulatory requirements for data privacy for each

region in which XYZ operates, as well as industry standards such as ISO 27001/2 or NIST 800-53. This

will help ensure that the organization is complying with applicable laws and regulations, while also

helping build trust with clients by demonstrating that they take privacy seriously.

The Information Security team should also identify the most important risks associated with data

privacy in order to determine what additional measures need to be taken in order to protect

sensitive data from misuse or loss. The team should then assess the appropriate risk management

and privacy controls to ensure that the data is being managed in a secure manner. This could include

encryption of sensitive data, access control measures such as role-based permissions, and regular

reviews of user access rights to ensure proper security protocols are being followed.

In addition, XYZ should create an internal privacy policy which outlines its commitment to protecting

the privacy of customers and employees. The policy should be reviewed periodically to ensure it

meets changing regulatory requirements and industry standards. The policy must also be

communicated to all staff members so they know what their responsibilities are with regards to

protecting personal data.

Finally, XYZ should have a robust incident response plan in place for when breaches or unauthorized

access occur. This should cover procedures for detecting, investigating, and responding to potential

data breaches. It should also include measures to prevent future incidents and ensure that customer

data is protected going forward.

By taking these measures, XYZ will be able to meet its client’s security requirements while also

demonstrating its commitment to protecting the privacy of their customers. This can help build trust

with existing clients as well as new ones, making it easier for them to do business with the company.

In addition, a comprehensive privacy protection program can help protect XYZ from costly legal or

regulatory penalties in case of a data breach. Therefore, it is crucial for XYZ to invest in robust privacy

protection initiatives in order to realize the full potential of the market.