Under which of the following conditions can a company in India may transfer sensitive personal information (SPI) to any other company or a person in India, or located in any other country?

• A.The transfer of information is allowed only after taking approval of Chief Information Commissioner of India
• B.The transfer of information is allowed only after taking approval of DeitY (Department of Electronics & Information Technology) in India
• C.Transfer of information is allowed to those who ensure the same level of data protection that is adhered to by the company as provided for under the Indian laws
• D.The transfer may be allowed only if it is necessary for the performance of the lawful contract or where the data subject has consented to data transfer

Comment: *

Name: *

Email: *

Verification: *

You are part of a team that has been created by Indian government to create India's privacy law based on
recommendations in Justice AP Shah's Report. Which of the following provisions should be addressed in the
law?

• A.Privacy as an explicit fundamental constitutional right
• B.Setup of a national data controller registry
• C.National privacy principles
• D.Offences, penalties and remedies

Comment: *

Name: *

Email: *

Verification: *

Which of the following activities form part of an organization's Visibility over Personal Information (VPI) initiative, according to DSCI Privacy Framework (DPF)?

• A.'Data processing environment' analysis of the organization only
• B.'Data processing environment' analysis of the organization and associated third parties
• C.'Data processing environment' analysis of the country
• D.'Data processing environment' analysis of industry peers

Comment: *

Name: *

Email: *

Verification: *

What are the roles an organization can play from privacy perspective?
i. Data Controller - determines the means and purpose of processing of data which is collected from its end
customers
ii. Data Controller - determines the means and purpose of processing of data which is collected from its
employees
iii. Data Sub-Processor - processes personal data on behalf of data processor
iv. Joint Controller - determines the means and purpose of data processing along with other data controller
Please select correct option:

• A.i, iii and iv
• B.i, ii, iii and iv
• C.i, ii and iii
• D.ii, iii and iv

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements is true in respect of the India specific government projects such as Aadhaar, National Population Register (NPR), etc. that can have privacy implications?

• A.Citizens are being given the choice to opt out from submitting their biometric details and are allowed to complete the environment without submitting their biometrics
• B.Collection of biometrics in India is a statutory requirement
• C.Data subjects are not limited in their ability to exercise control over the ways their personal information is being used, once it has been shared by them as part of the projects
• D.Proper and adequate notification is not provided to data subjects before and during the collection of their personal information

Comment: *

Name: *

Email: *

Verification: *