Workplace & institutional
The DPDP Act is mostly about ordinary people in HR, admin and sales, not the legal team
The people who collect Aadhaar copies at onboarding, keep ex-employee files for a decade, forward candidate CVs on WhatsApp and run the customer mailing list are the ones the Act is about. This session translates the law into what they do on Monday, with the legal sections kept to one page.
- Duration
- Half day
- Format
- Online / Onsite
- Language
- English / Hindi
- Level
- Intermediate
- Group size
- 8 to 60
- Certificate
- Completion certificate
- For
- HR, admin, anyone handling employee or customer data
What participants can do afterwards
- Know what counts as personal data, who the data fiduciary and data principal are, and what "lawful purpose" and "consent" mean in practice
- Rewrite your onboarding, candidate and customer data collection so the notice and consent are real, not a tick box
- Apply retention rules: what to keep, for how long, and how to delete securely when the purpose ends
- Handle a data-principal request (access, correction, erasure, grievance) within a defined process
- Know what a personal data breach is, who must be told, and how the DPDP and CERT-In reporting duties fit together
- Recognise the everyday leaks: CVs on WhatsApp, shared drives, vendor spreadsheets, old laptops
Modules
The Act in one page
Fiduciary, principal, processor, consent, legitimate uses, the Data Protection Board, penalties. Only what a non-lawyer needs.
Employee data from hire to exit
Candidate data, background checks, Aadhaar and PAN copies, payroll, health records, monitoring, and what happens to the file after exit.
Customer and vendor data
Mailing lists, CRM, forms, WhatsApp groups, the vendor who processes your data, and the contract clause you need.
Requests and grievances
A simple process for access, correction and erasure requests, with a register and response times.
Breaches
What counts, how it usually happens in HR and admin, the internal escalation, and the DPDP and CERT-In reporting duties.
Workshop
Participants map their own data flows and leave with a list of changes ranked by effort.
Who should attend
- HR heads, HR business partners and recruitment teams
- Admin, facilities and office managers who handle visitor, vendor and employee records
- Sales and marketing staff who run customer lists and campaigns
- Compliance officers and company secretaries building a DPDP programme
- Schools, hospitals, NBFCs and startups with a small or no legal team
Included
- Trainer with worked examples from HR and admin
- A data-mapping worksheet and a retention schedule template
- A model privacy notice and consent wording for onboarding and candidate data
- A data-principal request register and a breach escalation checklist
- A one-page summary of the Act for staff who did not attend
Frequently asked questions
The DPDP rules are still being phased in. Is training premature?
No. The obligations that need the most change, such as collecting only what you need, telling people why, keeping data for a defined time and being able to find and delete it, take months to build and are good practice under the IT Act rules already. The session is updated as rules are notified, and the handout flags which items depend on timelines still being set.
Is this a legal compliance course?
It is a practical course for the people who handle the data, not a legal analysis. The Act is covered in enough depth to act on, with references so your counsel can check. For a legal and compliance audience, the cyber law course in the professional track covers the DPDP Act alongside the IT Act, BNS 2023 and BSA 2023 in far more detail.
Can you look at our actual forms and policies during the session?
Yes. Send your onboarding form, candidate consent, employee handbook extract and privacy notice a week in advance, and the workshop segment uses them. Most organisations discover they collect documents they never use, keep ex-employee files indefinitely and have no process for an erasure request. You leave with marked-up versions and a ranked list of changes.
What about vendors who process our data, such as payroll and background-check firms?
The Act makes you responsible for what your processors do with the data you give them. The session covers the questions to ask a vendor, the clauses a contract should contain, and how to handle a breach that happens at a vendor. The handout includes a short vendor checklist you can send to your payroll, recruitment and IT providers.
Request this program
Tell us the audience, headcount, city and preferred dates. We reply with an outline and quote.