THE TOPIC READER
One question.
A clearer reading.
Choose a topic. Read the explanation alongside its source, then look at what remains to be decided.
6 topics available.
01Who is responsible for the data?Data Fiduciary
Data Fiduciary
The person who decides why and how personal data is processed is called a Data Fiduciary. A service provider processing it on that person’s behalf is a Data Processor. The individual the data relates to is the Data Principal.
A situation to think through
A shop decides to keep customer numbers for delivery. Its software provider may process those records for the shop. The actual arrangement determines the roles.
The question still to ask
Who decides the purpose, and who follows their instructions? Contracts and the facts both matter.
Explore the team workspace →02Which information does the Act cover?Personal data
Personal data
Personal data means data about an individual who is identifiable by or in relation to it. The Act’s application provision covers digital personal data, including non-digital records that are later digitised, with conditions and exclusions.
A situation to think through
A customer list on paper and a spreadsheet made from it are different processing situations. Start by recording what your team holds and how it is used.
The question still to ask
Territorial scope and exclusions need a separate assessment; a label on a file does not settle whether the Act applies.
Read the wider DPDP overview →03What should people know before sharing details?Notice
Notice
The Act links a request for consent to a notice explaining the personal data and purpose, the way to exercise specified rights, and the way to complain to the Board. The final Rules add detail to the notice requirements.
A situation to think through
A delivery checkout should explain why it asks for a phone number. Separate that purpose from any proposed marketing use. This is an example to discuss, not a finished legal notice.
The question still to ask
The right wording depends on the actual collection and the applicable provisions. Check the official Rules and corrections before using a notice.
Explore notice resources →04What happens when someone withdraws consent?Withdrawal
Withdrawal
Section 6 provides for withdrawal of consent and addresses stopping processing that relied on it, subject to what the Act or another law requires or authorises. Withdrawal does not undo the lawfulness of earlier processing.
A situation to think through
A customer stops marketing messages. Follow the choice through the systems using that permission; do not assume every invoice must also be deleted.
The question still to ask
Consent is not the only basis described by the Act. Identify the purpose, applicable basis and any retention requirement before deciding what stops.
See the SWARN design preview →05How do access and deletion requests fit together?Data Principal rights
Data Principal rights
The Act sets out rights concerning information about processing, correction and erasure, grievance redressal, and nomination. Each has its own conditions. A deletion request is not an instruction to erase every record regardless of other legal requirements.
A situation to think through
A former customer asks what information you hold and wants it removed. First establish which records relate to them and which requirements may still apply.
The question still to ask
Identity checks, exceptions and retention rules need care. This learning example cannot decide a real request.
Try a guided practice lesson →06Why are there several start dates?Commencement
Commencement
Enactment puts a law on the statute book. Commencement brings specified provisions into force. The November 2025 notification divides the Act into three groups; the Rules have their own commencement provision.
A situation to think through
A section can appear in the Act while its commencement is still scheduled. Read the section together with the notification before calling it a current obligation.
The question still to ask
Dates shown here are a reading of the listed instruments, not a guarantee that no later instrument exists. Check the official record for your decision.
Open the commencement guide →Filters change the reading list only. They do not assess your organisation or determine which law applies.