UPSC Prelims Practice Questions — Consent Manager Registration Framework Comes into Effect; MeitY Secretary Launches Online Registration Portal

Q1. With reference to Consent Managers under India's Digital Personal Data Protection framework, consider the following statements: Which of the statements given above is/are correct?

  1. A registered Consent Manager may itself decide the purposes for which a Data Principal's personal data is processed.
  2. A Data Principal can use a Consent Manager to review and withdraw consents, not merely to give them.
  3. An entity must be registered with the Data Protection Board of India before it can operate as a Consent Manager.
  • A. 1 and 3 only
  • B. 1, 2 and 3
  • C. 1 and 2 only
  • D. 2 and 3 only

Q2. Under India's data protection framework, Consent Manager platforms are required to be interoperable. Which one of the following best explains the purpose of this requirement?

  • A. So that a Data Fiduciary can move a person's data across platforms without seeking fresh consent
  • B. So that a Data Principal can manage consents given to many Data Fiduciaries through one platform
  • C. So that consent given to one Data Fiduciary automatically extends to every other Data Fiduciary
  • D. So that the Data Protection Board can verify each consent before any processing of data begins

Q3. With reference to the roles defined under the Digital Personal Data Protection Act, 2023, consider the following statements: Which of the statements given above is/are correct?

  1. A Data Fiduciary is the entity that determines the purpose and means of processing personal data, whether alone or together with others.
  2. Duties such as maintaining reasonable security safeguards and erasing data once its purpose is served fall on the Data Fiduciary, not on the Data Principal.
  3. An entity that only processes personal data on behalf of another, without deciding why it is processed, is itself the Data Fiduciary for that data.
  • A. 1 and 2 only
  • B. 1, 2 and 3
  • C. 2 and 3 only
  • D. 1 and 3 only

Q4. With reference to the Data Protection Board of India, consider the following statements: Which of the statements given above is/are correct?

  1. It is a statutory body established by the central government under the Digital Personal Data Protection Act, 2023, and not a body created by the Constitution.
  2. Since it registers Consent Managers, it is also the authority that framed the Digital Personal Data Protection Rules, 2025, which lay down their eligibility conditions.
  3. Appeals against its decisions go to an appellate tribunal that already existed, instead of to a new tribunal created under the Digital Personal Data Protection Act.
  • A. 2 and 3 only
  • B. 1, 2 and 3
  • C. 1 and 3 only
  • D. 1 and 2 only

Q5. Consider the following statements: Which of the following is correct in respect of the above statements?

  1. Concerns have been raised that the Data Protection Board of India may not be sufficiently independent of the executive.
  2. The central government prescribes the Board's size and selection process, and it appoints members for short terms with eligibility for re-appointment.
  • A. Both Statement-I and Statement-II are correct and Statement-II explains Statement-I
  • B. Both Statement-I and Statement-II are correct, but Statement-II does not explain Statement-I
  • C. Statement-I is correct, but Statement-II is incorrect
  • D. Statement-I is incorrect, but Statement-II is correct

Q6. Consider the following statements: Which of the following is correct in respect of the above statements?

  1. Under India's data protection framework, a Consent Manager is accountable to the Data Principal, even though it routes consents to Data Fiduciaries.
  2. Only companies incorporated in India with adequate technical, operational and financial capacity can register as Consent Managers.
  • A. Both Statement-I and Statement-II are correct and Statement-II explains Statement-I
  • B. Both Statement-I and Statement-II are correct, but Statement-II does not explain Statement-I
  • C. Statement-I is correct, but Statement-II is incorrect
  • D. Statement-I is incorrect, but Statement-II is correct

Q7. Consider the following facts: The Digital Personal Data Protection Bill received Presidential assent in August 2023. Rules under the Act were notified in November 2025. Consent Manager registration began in November 2026, while provisions on Data Principals' rights, Data Fiduciaries' obligations and the Board's inquiry and penalty processes are to take effect in May 2027. Which of the following inferences can be drawn from the above?

  1. Penalties can be imposed in 2027 for failures to meet Data Fiduciary obligations that occurred in 2026.
  2. Presidential assent to a Bill does not, by itself, bring all the provisions of the resulting Act into operation.
  3. Different provisions of a single Act may come into operation on different dates.
  • A. 1 and 2 only
  • B. 1 and 3 only
  • C. 2 and 3 only
  • D. 1, 2 and 3

Q8. With reference to the Supreme Court's judgment in Justice K.S. Puttaswamy v. Union of India (2017), consider the following statements: Which of the statements given above is/are NOT correct?

  1. Informational privacy is one facet of the right to privacy that the Court recognised as a fundamental right.
  2. A law that intrudes on privacy must, among other things, prescribe a procedure that is fair, just and reasonable.
  3. The judgment reaffirmed the M.P. Sharma and Kharak Singh rulings to the extent that they denied privacy constitutional protection.
  4. Since privacy is a fundamental right, Parliament cannot enact any law that restricts it.
  • A. 3 and 4 only
  • B. 1, 3 and 4 only
  • C. 2 and 3 only
  • D. 1 and 2 only