Module 79: Privacy and Data Protection

Why each option is right or wrong

• “No, it identifies a device, not a person” (Incorrect): Devices belong to people, and combined with other records an IP can point to one.
• “Only if it's stored next to the person's name” (Incorrect): Data can identify someone through other sources too, not just a name beside it.
• “No, because IP addresses change from time to time” (Incorrect): Even a changing IP can identify someone at a given moment, with provider records.
• “Yes, it can help identify a person” is correct.

  Personal data is any information about a person who can be identified, directly or by combining it with other data. An IP address, together with records an internet provider holds, can point to a household or person, so it's usually treated as personal data.

  • Similar: device IDs, cookie IDs and precise location.
  • Practical step: keep IP logs only as long as you need them.

📖 Revise: Lesson 1: Data classes

Why each option is right or wrong

• “Logs and backups are the only places where personal data is stored” (Incorrect): The main database holds most of it; logs and backups are extra copies that are easy to forget.
• “Inventories must list every file on the server, whatever it holds” (Incorrect): The inventory is about personal data, wherever it lives, not every file.
• “Backups are deleted automatically, so they need listing to keep them” (Incorrect): Backups often linger for months; listing them is how you control and delete them.
• “Personal data copied there needs the same protection and deletion” is correct.

  Names, emails and IPs often end up in logs, backups, exports and test copies. If the inventory lists only the main database, those copies are forgotten: unprotected, kept too long, and missed when someone asks for deletion.

  • Map every place: database, logs, backups, analytics, email tools, spreadsheets.
  • Reduce copies: mask personal data in logs where you can.

📖 Revise: Lesson 1: Data classes

Why each option is right or wrong

• “Yes, as long as the person can untick it before submitting” (Incorrect): Not unticking isn't an active choice; many people don't notice the box.
• “Yes, if the privacy policy mentions marketing emails” (Incorrect): Mentioning it in a policy isn't the same as the person clearly agreeing.
• “Only for customers who have bought something before” (Incorrect): Past purchases don't turn a pre-ticked box into an active choice.
• “No, consent must be an active, clear choice” is correct.

  Valid consent means the person did something to agree, such as ticking a box themselves, after being told clearly what for. A box ticked in advance shows only that they didn't notice or untick it, which isn't a clear choice.

  • Also needed: an easy way to withdraw consent later.
  • Separate purposes: marketing consent shouldn't be bundled with the terms.

📖 Revise: Lesson 2: Purpose and consent

Why each option is right or wrong

• “So the site can show the newest version to returning visitors” (Incorrect): Showing the latest notice doesn't need a record of past consent.
• “Because the notice text must be stored inside each user's profile” (Incorrect): Only a reference to the version is needed, not the full text per user.
• “To decide how long each person's password should stay valid” (Incorrect): Consent records are about privacy notices, not password expiry.
• “To prove what they were told and agreed to” is correct.

  Privacy notices change over time. If a question or complaint comes up, you need to show exactly what the person saw when they agreed: which version, when, and for which purposes. A simple record lets you answer confidently.

  • Store: user, notice version, date and time, purposes chosen.
  • On a big change: ask again where the law or fairness requires it.

📖 Revise: Lesson 2: Purpose and consent

Why each option is right or wrong

• “Smaller databases are faster, which blocks most attacks” (Incorrect): Speed doesn't stop attacks; having less to steal limits the harm.
• “Laws only apply to sites that hold large amounts of data” (Incorrect): Data protection laws can apply however much you hold.
• “Attackers ignore sites that store only a small amount of data” (Incorrect): Attackers often target small sites because they're easier; less data simply means less harm.
• “Data not collected can't be leaked or misused” is correct.

  Each piece of personal data you store must be protected, backed up and eventually deleted, and it's at risk if there's a breach. If you don't need someone's date of birth or address, not asking for it removes that risk entirely.

  • Ask: what will we use this for? If there's no answer, don't collect it.
  • Also: smaller breaches and simpler deletion requests.

📖 Revise: Lesson 3: Minimisation and retention

Why each option is right or wrong

• “Move it to a separate archive so it can still be found later” (Incorrect): Archiving still keeps the personal data; the retention period says it should go.
• “Keep it, since storage is cheap and the data might be useful” (Incorrect): Low cost doesn't justify keeping personal data past its purpose.
• “Encrypt it and keep it indefinitely as a safe backup” (Incorrect): Encryption protects data you need; it doesn't replace deleting data you don't.
• “Delete or anonymise it, including in exports and backups over time” is correct.

  When data is no longer needed for its purpose, it should be removed or made anonymous so it can't point back to a person. That includes the copies: exports, spreadsheets, and backups, which can age out on their normal schedule.

  • Automate: a scheduled job to delete expired records.
  • Anonymise: keep useful totals without names, emails or IPs.

📖 Revise: Lesson 3: Minimisation and retention

Why each option is right or wrong

• “Users must find and switch on privacy settings themselves” (Incorrect): That's the opposite: default means protective without any effort.
• “Every site has a privacy policy page in its footer” (Incorrect): A policy page is a notice, not a protective default setting.
• “All data is encrypted, so settings no longer matter” (Incorrect): Encryption is one protection; defaults are about what's collected and shared.
• “The most protective settings apply automatically” is correct.

  A new user gets the privacy-friendly settings without having to find them: profiles not public, optional tracking off, only necessary data collected. People can choose to share more, but they don't have to work to share less.

  • Example: analytics cookies off until the visitor agrees.
  • Related: privacy by design, building privacy in from the start.

📖 Revise: Lesson 4: Privacy by design

Why each option is right or wrong

• “Third parties must be listed so they can send marketing to your users” (Incorrect): The list is for accountability and openness, not to help them market.
• “Search engines rank sites higher when they name their partners” (Incorrect): Search ranking isn't the reason; responsibility for the data is.
• “Once data reaches a third party, your responsibility for it ends” (Incorrect): You stay responsible for choosing and instructing the services you share data with.
• “They're part of where data goes, so they must be trusted and disclosed” is correct.

  Email tools, analytics, payment providers and hosting all receive some personal data. You're responsible for choosing them carefully, having agreements with them, and telling people in your notice where their data goes.

  • Check: what data each receives, and whether it needs all of it.
  • Review: when you add or drop a service, update the list and notice.

📖 Revise: Lesson 4: Privacy by design

Why each option is right or wrong

• “The person whose personal data is being collected and used” (Incorrect): That person is the data principal, not the fiduciary.
• “A hosting company that stores data on the organisation's behalf” (Incorrect): A service acting on instructions is a data processor.
• “The government office that hears complaints about data misuse” (Incorrect): That's the Data Protection Board, not a fiduciary.
• “The organisation that decides why and how personal data is processed” is correct.

  India's Digital Personal Data Protection Act, 2023 calls the organisation that decides the purpose and means of processing a data fiduciary. It carries the main duties: notice, consent, security, and responding to people's requests.

  • Data principal: the person the data is about.
  • Data processor: a service that processes data for the fiduciary.

📖 Revise: Lesson 5: The law

Why each option is right or wrong

• “Free access to any company's internal business records” (Incorrect): Rights cover a person's own personal data, not a company's other records.
• “A payment from every company that has collected their data” (Incorrect): The Act doesn't give a general right to be paid for data collected.
• “Choosing which country a company must store its servers in” (Incorrect): People don't get to choose server locations; that's the company's decision, within the rules.
• “Correction and erasure of their personal data” is correct.

  The DPDP Act gives data principals rights including access to information about their data, correction, completion, updating and erasure, grievance redress, and nominating someone to act for them. Your app needs a simple way to handle these requests.

  • Practical: a contact route and a process to verify and act on requests.
  • Limits: some data must be kept for legal reasons; explain when that applies.

📖 Revise: Lesson 5: The law