DPDP Basics: 10-Minute Micro-Module
A short, interactive learning module for HR and managers on handling personal data under India's DPDP rules.
Everyday HR work involves personal data, and small mistakes can put people at risk.
I designed an eight-scene learning module, a five-question quiz and an evaluation plan.
I start with a practical incident, explain the core terms and principles, and finish with scenario-based questions.
1 min
Hook
An HR executive sends the full employee list to the wrong email address. What happens next?
Full storyboard
Hook · 1 min
An HR executive sends the full employee list to the wrong email address. What happens next?
What counts as personal data · 1 min
Names, phone numbers, bank details, ID numbers, performance ratings, medical certificates.
Who is who · 1 min
The employer is the Data Fiduciary, the employee or candidate is the Data Principal.
Core principles · 2 min
Notice, purpose limitation, minimisation, accuracy, storage limitation, security.
HR and employment purposes · 1 min
Routine HR processing tied to employment is allowed, but only for what employment needs.
Rights and grievances · 1 min
People can ask for access and correction and raise grievances. HR must know the channel.
Breaches · 1 min
Report at once to the designated contact. Do not delete evidence.
Do and don't recap · 2 min
Five dos, five don’ts.
- Collect only needed fields.
- Check the stated purpose.
- Verify recipients before sharing.
- Use approved, secure systems.
- Report incidents immediately.
- Do not send full spreadsheets by default.
- Do not reuse payroll data for promotions.
- Do not use personal messaging apps for sensitive files.
- Do not delete incident evidence.
- Do not paste personal data into public AI tools.
The DPDP Rules were notified on 13 November 2025. The Data Protection Board was set up first. Main obligations apply from 13 May 2027.
Knowledge check
Quiz score: 0/5 · 0%
Evaluation plan
| Level | What | Method | Target |
|---|---|---|---|
| 1 Reaction | Was it useful? | 3-question smiley poll | ≥ 4 out of 5 |
| 2 Learning | Did they learn? | Pre and post quiz | ≥ 80% post score |
| 3 Behaviour | Do they apply it? | 30-day checklist audit | ≥ 90% emails with personal data go to the right recipients |
| 4 Results | Did risk fall? | Incident count | Downward trend |
This is a designed learning module, not evidence of delivery to a live audience. These are design targets.
This is a designed learning module, not evidence of delivery to a live audience. These are design targets.
In a live setting I would pilot the module with volunteers and review the learning and behaviour measures.