UPSC Prelims Practice Questions — International Data Privacy Day

Q1. International Data Privacy Day is observed on 28 January to commemorate the opening for signature of Convention 108, the first legally binding international treaty on data protection. Under the auspices of which one of the following organisations was this Convention adopted?

  • A. Council of Europe
  • B. European Union
  • C. Organisation for Economic Co-operation and Development (OECD)
  • D. United Nations

Q2. Which one of the following correctly describes the strength of the Supreme Court Bench that declared the right to privacy a fundamental right in the Puttaswamy case (2017)?

  • A. A five-judge Constitution Bench
  • B. A seven-judge Bench
  • C. A nine-judge Bench
  • D. An eleven-judge Bench

Q3. Under the Digital Personal Data Protection Act, 2023, which one of the following is empowered to establish the Data Protection Board of India?

  • A. The Central Government
  • B. The Reserve Bank of India
  • C. The Telecom Regulatory Authority of India
  • D. The Supreme Court of India

Q4. Under the Digital Personal Data Protection Act, 2023, which one of the following is the primary lawful basis on which a Data Fiduciary may process the personal data of a Data Principal?

  • A. Consent of the Data Principal
  • B. The commercial legitimate interest of the Data Fiduciary
  • C. A standing court order
  • D. Contractual convenience of a third party

Q5. In the context of the cybersecurity allocation announced to safeguard India's 'DPI', the abbreviation 'DPI' refers to which one of the following?

  • A. Digital Public Infrastructure
  • B. Data Privacy Index
  • C. Digital Payments Interface
  • D. Directorate of Personal Information

Q6. As highlighted in the official backgrounder ahead of Data Privacy Day 2026, approximately how much did the Union Budget 2025-26 earmark for cybersecurity to safeguard Digital Public Infrastructure?

  • A. ₹482 crore
  • B. ₹782 crore
  • C. ₹1,782 crore
  • D. ₹7,820 crore

Q7. Unlike the EU GDPR's turnover-linked fines, the Digital Personal Data Protection Act, 2023 prescribes fixed monetary penalties in its Schedule. What is the maximum penalty specified for failure to take reasonable security safeguards to prevent a personal data breach?

  • A. ₹100 crore
  • B. ₹150 crore
  • C. ₹200 crore
  • D. ₹250 crore

Q8. Which one of the following is the nodal ministry that notified the DPDP Rules, 2025 and anchors India's statutory data-protection framework?

  • A. Ministry of Electronics and Information Technology
  • B. Ministry of Home Affairs
  • C. Ministry of Communications
  • D. Ministry of Information and Broadcasting