Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →grcengclub/ind-dpdpa-expert
India DPDPA expert for the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. Covers Data Fiduciary obligations, Data Principal rights, Significant Data Fiduciary regime, Consent Manager, breach notification (72-hour), cross-border transfer regime, children's data, sectoral overlap with RBI / SEBI / IRDAI / TRAI / CERT-In / ABDM, and Data Protection Board enforcement.
Passed 11 of 22 test cases with the skill, and 11 of 22 without it.
2 fixed16 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our Indian mobile banking app recently suffered a database exposure involving user profiles and transaction logs. Please construct a structured incident response playbook and reporting clock matrix that maps out all mandatory regulatory notifications, reporting deadlines, required disclosure details, and follow-up evidence needed for Indian regulatory authorities.
| Checked | Without skill | With skill |
|---|---|---|
| Specifies a 72-hour reporting timeline for notifying the Data Protection Board of India under DPDPA. | Passed | Passed |
| Specifies a 6-hour reporting timeline for notifying CERT-In regarding cyber security incidents. | Passed | Passed |
| Specifies a 6-hour reporting timeline for notifying the Reserve Bank of India regarding bank cyber incidents. | Missed | Passed |
The instructions your model reads when the skill loads.
Deep working knowledge of the Digital Personal Data Protection Act, 2023 (DPDPA) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), as enforced by the Data Protection Board of India (DPB) under the Ministry of Electronics and Information Technology (MeitY).
This skill is engineering and assessment guidance for CISOs, DPOs, GRC engineers, and platform teams. It is not legal advice. Binding interpretations come from DPB orders, MeitY notifications, and the courts.
Invoke when the user is:
| Field | Value |
|---|---|
| Statute | Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) |
| Operational rules | Digital Personal Data Protection Rules, 2025 (notified November 2025) |
| Regulator | Data Protection Board of India (DPB) under MeitY |
| Territorial scope | Processing within India; processing outside India in connection with offering goods or services to Data Principals located in India |
| Material scope | Digital personal data — personal data in digital form, or in non-digital form digitised subsequently |
| SCF framework ID | apac-ind-dpdpa-2023 |
| SCF coverage | 41 SCF controls map to 96 DPDPA control identifiers |
| Status (as of 2026) | Act in force; Rules notified November 2025 with phased operational dates |
The Act and the Rules must be read together. The Act sets substantive obligations; the Rules set the operational detail — timelines, formats, registration mechanisms, and procedures. Gaps in either side are gaps in compliance.
| DPDPA term | Meaning | GDPR analogue |
|---|---|---|
| Data Fiduciary | Determines the purpose and means of processing personal data. The controller-equivalent. | Controller |
| Data Processor | Processes personal data on behalf of a Fiduciary under contract. | Processor |
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.