Mock paper 9 — The Administrator's Paper

The order follows from the structure of the Act and from the condition in the stem. The school must first know what it is processing and why, because personal data may be processed only for a lawful purpose, and neither the platform nor the notice can be settled until the purpose and the data fields are — step 1. Next the platform is vetted against what Section 9 forbids outright: a Data Fiduciary shall not process a child's data in a manner likely to cause any detrimental effect on the child's well-being (s.9(2)), and shall not direct targeted advertising at children (s.9(3)). These are prohibitions that parental consent cannot cure, so an offending platform must be rejected before parents are approached; and because the stem requires the notice to describe the chosen platform's actual processing, the notice cannot be written until the platform is settled — step 2. Only then is the notice given and the verifiable consent of the parent or lawful guardian obtained — step 3. Processing begins last, with withdrawal of consent kept as easy as its giving — step 4. The order is 1 – 2 – 3 – 4.

Step 2 deliberately leaves out tracking and behavioural monitoring. Section 9(3) bars them too, but the bar is not absolute: the DPDP Rules, 2025, Fourth Schedule, exempt an educational institution from Section 9(1) and 9(3) where its processing is restricted to tracking and behavioural monitoring for its educational activities or for the safety of the children enrolled with it. The exemption does not reach targeted advertising or processing harmful to the child. On 1 November 2026 these duties are enacted but not yet in force: under the commencement notification of 13 November 2025, Sections 3–17 of the Act (notice, consent, Section 9 on children's data) and the Rules that operate them (Rules 3 and 5–16, including Rule 10 on verifiable parental consent and Rule 12 on exemptions) come into force in May 2027. That is why the stem says "once its provisions … are in force".

(a) is wrong because consent cannot come first. A notice cannot be written before the purpose and data fields are known, and consent given in ignorance of them is not informed consent.

(b) is wrong because it takes consent before vetting the platform. The stem requires the notice to describe the chosen platform's actual processing, and the Section 9 bars cannot be cured by consent, so the platform must be screened and settled before parents are approached.

(c) is wrong because it chooses the product before defining the purpose and seeks consent only after processing has begun. Consent obtained after processing starts is no consent, and the purpose must drive the choice of platform.

The Act allocates the roles by who decides, not by who holds the data. A Data Fiduciary is the person who, alone or with others, determines the purpose and the means of the processing — here the school, which settles what is captured and why. A Data Processor is one who processes personal data on behalf of a Data Fiduciary — here the vendor, acting on the school's instructions and for no purpose of its own. A child is an individual below eighteen (s.2(f)), and the Data Principal is the individual to whom the personal data relates — where that individual is a child the term includes the parent or lawful guardian, so it is the parent who exercises the pupil's rights. Hence (c). Keep the definitions apart from the duties. Under the commencement notification of 13 November 2025, the definitions (Section 2) and the Board provisions are in force, but Sections 3–17 of the Act — Section 9 on children's data among them — and the DPDP Rules, 2025 that operate them (Rule 10 on verifiable parental consent, Rule 12 on exemptions) come into force only in May 2027. On 1 November 2026, therefore, Section 9 is enacted but not in force. And the Fourth Schedule exempts an educational institution from Section 9(1) and 9(3) where its processing is restricted to tracking and behavioural monitoring for its educational activities or for the safety of the children enrolled with it. That is why option (c) states only the definitions, which are settled.

(a) is wrong because the Data Fiduciary is whoever decides the purpose and means of processing, not whoever physically holds the data. The company holds the records only on the school's instructions, so it is the Processor; a school that outsources its system does not outsource its responsibility.

(b) is wrong because processing children's data does not by itself make anyone a Significant Data Fiduciary. That status is notified by the Central Government under Section 10 on factors such as volume, sensitivity and risk, and the India-based Data Protection Officer and independent audit follow only on that notification.

(d) is wrong because a Consent Manager is not the parent. It is a person registered with the Data Protection Board that runs an accessible, interoperable platform through which a Data Principal gives, manages, reviews and withdraws consent. The parent is part of the Data Principal, not the Consent Manager.

Statement 1 is correct. Since the Seventh Central Pay Commission there are only two increment dates, 1 January and 1 July, and a Government servant must have completed six months of qualifying service as on the date on which the increment is claimed. On 1 January 2026 this officer had four months of service and so could not qualify; on 1 July 2026 he had ten months and did. Statement 2 is correct. The X classification covers cities of fifty lakh and above, Delhi is an X city, and the X-city rate of house rent allowance is thirty per cent of basic pay. Statement 3 is correct. The revised rates of 24, 16 and 8 per cent approved in 2017 were raised to 27, 18 and 9 per cent when dearness allowance crossed twenty-five per cent and to 30, 20 and 10 per cent when it crossed fifty per cent; the Government fixed the two triggers at those points, and no further trigger exists above fifty per cent. House rent allowance has therefore stood still through every subsequent instalment of dearness allowance. All three statements are correct. The HRA rates of 30/20/10 per cent and the absence of any trigger above fifty per cent dearness allowance hold under the Seventh CPC scheme as on 1 September 2026; they will change when the Eighth CPC's recommendations are implemented. Re-verify in October 2026.

(a) is wrong because it rejects statement 3. HRA rose only at the two triggers the Government fixed — DA crossing 25 per cent and 50 per cent — and has not moved with later DA instalments.

(b) is wrong because it rejects statement 1. Under the Seventh CPC increments fall only on 1 January or 1 July, not on the anniversary of appointment; with four months' service on 1 January 2026 the officer's first increment is 1 July 2026.

(c) is wrong because it rejects statement 2. Delhi is an X city and, since DA crossed 50 per cent on 1 January 2024, the X-city HRA rate has been 30 per cent; the 24 per cent figure of 2017 is out of date.