$ cat curriculum.md
Session 1: DPDP Foundations and Consent Operations
Module 1: DPDP, Privacy by Design, and the Compliance Gap
Overview of the DPDP Act and its 2025 Rules; DAMA-DMBOK Data Governance (Ch. 3) and Data Architecture (Ch. 4) fundamentals; Privacy by checklist vs. Privacy by Design; prohibition of bundled consent under Sec. 4; why demonstrable compliance matters; difference between privacy and security; privacy as lawful, proportionate, and purpose-bound processing; privacy controls across the data lifecycle.
Lab: Explore the eight portal module areas (Dashboard Overview, Platform Integration, Consent Management, DPDP Compliance, PII Management, Anonymization, Reports, and Settings) for both the E- Commerce Demo Website and Finance Demo Website, toggle light/dark modes, and identify where consent, PII, DPDP score, and ROPA/DPIA evidence appear.
Module 2: Consent Lifecycle and Consent-Based Access Thinking
Consent collection, validation, and purpose-specific tracking; DAMA Master Data Management (Ch. 10) for single golden consent state; consent withdrawal and revocation timestamps; downstream processing impact of revocation; Consent-Based Access Control (CBAC) via API validation (GET /api/consent/validate) as an enforceable operational signal.
Lab: Connect test consent API keys for the E-Commerce and Finance demo platforms, review granted and revoked users, filter by purpose (Marketing, Analytics, KYC, Credit Check), and export CSV consent records.
Case study (E-Commerce Demo Website): A customer revokes marketing consent on the E- Commerce portal. Participants locate the customer record, confirm revocation status, evaluate downstream CBAC impact (halting promotional emails and retargeting ads), and prepare an auditor- facing evidence package.
Case study (Finance Demo Website): Account onboarding on the Finance portal requires separating mandatory KYC/credit checks from optional marketing/analytics. When marketing consent is declined, an API query (GET /api/consent/validate) returns INVALID, blocking marketing jobs and generating an immutable audit log entry.
Session 2: Data Discovery, Classification, and Compliance Scoring
Module 3: Data Discovery and PII Classification
What counts as PII; direct identifiers vs. quasi-identifiers; DAMA Metadata Management (Ch. 12) for data cataloging; contact, location, financial, and pseudonymous data; sensitivity classification; purpose mapping; data owner assignment; cookie category tagging (Essential, Analytics, Advertising, Personalisation); protection and retention posture; data minimisation at the schema level.
Lab: Search for PII fields across connected stores in the PII Intelligence portal, run an automated structural scan (/api/pull-and-classify), review sensitivity levels, identify field owners, and evaluate protection and retention entries without exposing raw cell values.
Case study (E-Commerce Demo Website): Classify a customer dataset containing full name, email, phone, shipping address, order history, and user ID to identify high-sensitivity fields, assign field owners, map to approved purposes, and flag excessive data collection.
Case study (Finance Demo Website): Classify a portal dataset containing PAN, Aadhaar, bank statements, credit scores, and investment preferences. Tag cookie categories, block non-essential ad pixels by default, and enforce field-level data minimisation.
Module 4: DPDP Compliance Score and Rule-Based Readiness
How compliance readiness can be measured; DAMA Data Quality (Ch. 13) dimensions (Completeness, Consistency, Timeliness); weighted rule-based scoring across 10 statutory rules (consent completeness, notice, data principal rights, minimisation, security safeguards, breach readiness, children's consent checks, cross-border flows, retention); sector-aware scoring (E-Commerce vs. Finance); limitations of automated scoring.
Lab: Test low, medium, and stronger readiness API keys; compare score differences across E-Commerce and Finance configurations; review rule categories that reduce the score; discuss remediation steps.
Case study (E-Commerce Demo Website): E-Commerce consent records missing explicit purpose labels and ISO timestamps — participants identify affected DPDP rules, explain audit risk under Sec. 5/6/12, and assign field remediation.
Case study (Finance Demo Website): Finance portal consent records missing verifiable minor consent for loan accounts — participants calculate rule penalties under Sec. 9 & 13, evaluate regulatory risk, and draft a DPO remediation plan.
Session 3: ROPA, DPIA, PETs, and Revocation Integrity
Module 5: ROPA, DPIA, and Privacy Threat Modelling
What is ROPA, and what is DPIA? Processing activities, lawful basis, data categories, risk levels; DPIA required vs. not required; DPIA as a living risk document; AI Privacy Assistant integration; privacy threat modelling (linkability, identifiability, purpose drift, and misuse risks).
Lab: Search the ROPA and DPIA module by purpose, owner, and risk; identify high-risk activities; launch the interactive AI Privacy Assistant, pass active PII schema context to Llama-3, complete a guided DPIA risk assessment, and download a compliance report.
Case study (E-Commerce Demo Website): A new product recommendation feature uses customer browsing history and location indicators. Participants evaluate DPIA requirement, assess re-identification exposure, and document mitigations.
Case study (Finance Demo Website): An automated credit eligibility scoring feature uses credit trends and bank statement data. Participants conduct a DPIA, evaluate privacy threat risks (purpose drift, identifiability), and document mitigations via the AI Privacy Assistant.
Module 6: PET-Aware Privacy Controls
What are Privacy-Enhancing Technologies under DAMA Data Security (Ch. 7)? The difference between PMTs and PETs; pseudonymisation and anonymisation; differential privacy; synthetic data; federated learning; confidential computing; dynamic masking; automated Autopilot PET enforcement; input PETs vs. output PETs; third-party sharing authorization and cryptographic hash audit trails.
Lab: Select high-sensitivity PII fields in the Anonymization module (/anonymization), preview Raw vs. Anonymized data side-by-side, enable Autopilot Mode for automatic rule enforcement, authorize third- party sharing, and verify the resulting Hash Audit Trail.
Case study (E-Commerce Demo Website): The analytics team wants to share user purchase metrics with third-party logistics partners for research. Participants select identifier transformations (masking customer addresses, pseudonymising user IDs) and evaluate synthetic data generation.
Case study (Finance Demo Website): The Finance portal shares applicant data with third-party credit processors and insurance partners. Upon loan closure, consent withdrawal triggers automated webhook alerts (POST /api/alerts/notify), halting processor outreach, and generating a hash audit log.
Session 4: Audit Integrity and Continuous Privacy Governance
Module 7: Revocation Workflow, Timelines, and Audit Integrity
End-to-end revocation workflow; revocation timestamp integrity; purpose-specific withdrawal; stopping downstream processing; DAMA Data Storage Operations (Ch. 6); data fingerprinting and leak traceability; audit trail expectations; evidence packages for auditors; workflow integrity and accountability.
Lab: Load a revocation-heavy API key scenario, identify recently revoked users, review affected purposes, check timestamps, run the Leak Traceability / Fingerprinting tool to identify unauthorized exposure sources, export evidence, and prepare an auditor-facing explanation.
Case study (E-Commerce Demo Website): Full lifecycle audit of an E-Commerce customer from initial registration through consent grant, marketing revocation, and residual data retention mapped under GST/Tax and audit obligations.
Case study (Finance Demo Website): Full lifecycle audit of a loan applicant from KYC collection to consent withdrawal for insurance offers. Participants log and resolve a DPO grievance ticket under a 48- hour SLA and map residual data retained under RBI, KYC/AML, and tax mandates.
Module 8: Governance, Reporting, and Continuous Privacy Operations
Cross-functional privacy governance under DAMA Data Governance Committees (Ch. 3); privacy governance committees; ownership and decision rights; management reporting; open issue tracking; DPO grievance resolution tracking; automated scheduled report delivery (SFTP exports, Email audit digests); remediation planning; continuous improvement.
Lab: Export consent evidence, review DPDP score, identify low-scoring rules, review PII and DPIA gaps, configure automated scheduled report jobs (Daily CSV to SFTP, Weekly PDF DPDP Audit), and prepare a governance update.
Case study (E-Commerce Demo Website): Management requests a monthly privacy readiness update for the E-Commerce store — participants compile consent status, revocation summary, compliance score, PII classification status, and scheduled exports into a governance report.
Case study (Finance Demo Website): Executive board requests a quarterly privacy update for the Finance portal — participants synthesize unbundled consent compliance, DPIA pending reviews, SEBI audit trails, and RBI data residency verification (Section 16) into an executive update.
Final Workshop Exercise
Participants complete an end-to-end privacy operations workflow through the portal across both demo websites (E-Commerce Demo Website and Finance Demo Website):
• Connect consent datasets for both demo platforms using test API keys and review live consent statistics.
• Separate unbundled consent preferences (Mandatory KYC/Credit vs. Optional Marketing/Analytics) and check DPDP rule-level compliance scores.
• Review PII fields, sensitivity levels, cookie category tags (Essential vs Advertising), and field owners.
• Check processing activities, lawful basis, and DPIA gaps using the AI Privacy Assistant.
• Identify and configure suitable PET controls (Masking, Pseudonymisation, Synthetic Data) using Autopilot Mode.
• Authorize third-party disclosures, trigger processor revocation alerts (POST /api/alerts/notify), and run the Leak Traceability scanner.
• Map residual data to regulator-specific retention requirements (RBI, KYC/AML, SEBI, GST/Tax).
• Set up automated scheduled report exports (SFTP/Email) and prepare an auditor-facing privacy operations summary.
Key Message
DPDP compliance must not be a static checklist. It must be operationalised across both E-Commerce and Financial platforms through data discovery, unbundled consent state tracking, PII classification, ROPA and DPIA workflows, PET-aware controls, dynamic leak traceability, and audit-ready evidence across the full privacy lifecycle embedded into systems and workflows from the point of data collection onwards.