Lesson 1 of 8 · 9 min read · last verified 2026-10-15
Where the data goes
In this lesson you will:
- Draw the path personal data takes through a workflow, including the places people forget
- Say who holds the data at each point and whether you control what they do with it
This module is about personal data in the workflows you build in P5 and P6, and what two laws in particular, India’s Digital Personal Data Protection Act and the EU’s General Data Protection Regulation, ask of whoever builds them.
Read this first, because it shapes everything after.
This is general information and not legal advice. Whether a law applies to you, and what it requires, depends on facts about your situation that a lesson cannot know. For a real obligation, ask someone qualified, and read the primary text.
What this was checked against
This site’s rule is that claims are sourced and dated, and the honest account for this module is a limited one. On 15 October 2026:
- The DPDP Act’s sections 8, 9 and 16 and its penalties Schedule were read from a reproduction of the Act on a third-party website, not from the official gazette.
- The DPDP Rules’ timetable comes from law-firm summaries, which disagree with each other by a day on dates and on exactly which sections fall in which phase. On 15 October 2026 the government’s own press release was also read; it confirms an eighteen-month phased timeline but not the day-by-day dates.
- The GDPR articles quoted were read from text mirrors, not from EUR-Lex.
- Google’s data terms for its model API were read on 15 October 2026 from Google’s own terms page, which showed a last-updated date of 28 April 2026.
Only the press release and Google’s terms page are official sources; the rest is not. Where a figure or a date matters to a decision of yours, read the official version. Laws are also amended and interpreted, and this will age.
Start with the picture
Obligations attach to data you hold or send. So before any law, draw the path.
For a workflow, mark every place the data enters, travels, and rests:
Enters. A form, an inbox, an upload, an API, a person typing a question.
Travels. Each step of the chain, each connection, each call to the model.
Rests. The database, the logs, the backups, the exports, the cache, the error reports, the analytics tool, and the copy someone saved to their own drive.
Then add the column that matters: who holds it here, and do I control what they do with it?
Personal data is wider than a name
It means information relating to an identifiable person. Identifiable includes being named, and also being picked out: an email, a phone number, an account number, a handle, a face, and often a free-text description that only one person fits.
Two consequences catch people.
The question itself can be personal data. Someone asking an assistant “I have chest pain and I’m 14, what should I do” has just supplied health information and an age. You asked for neither. Free-text boxes collect what people volunteer, and what they volunteer is rarely what you planned for.
“Anonymous” is a claim to test. Removing a name does not make a record anonymous if the remaining details still point at one person. A record with an age, a town and a rare condition may be as identifying as one with a name.
The roles
Both laws sort the parties by what they decide.
| DPDP Act (India) | GDPR (EU) | |
|---|---|---|
| Decides why and how data is used | Data Fiduciary | Controller |
| Handles it on their behalf | Data Processor | Processor |
| The person it is about | Data Principal | Data Subject |
That sorting decides who is answerable. Under the DPDP Act, section 8(1) makes the Data Fiduciary responsible for compliance, including for processing done on its behalf by a processor, irrespective of any agreement to the contrary. Hiring someone to handle the data does not hand over the responsibility.
When you build a workflow that sends customer data to a model provider, you are usually the fiduciary or controller, and the provider is a processor. L4 is about what that makes you responsible for.
A path with a gap in it
Lrnon’s assistant is a useful picture because it is small enough to draw.
A learner types a question. → It crosses a basic redaction step (L3). → It is sent, with four lesson passages, to an outside model provider. → An answer returns and is shown. → A row is written recording tokens, time, success and failure reason.
What rests where is worth stating. The row records no question and no learner identity. The passages are public lessons. The question text exists in the request and at the provider, and the provider’s handling of it is governed by the provider’s terms, which L4 covers.
The point of drawing it is that the sensitive link in this chain is the one that leaves Lrnon’s control: the call to the provider. It does not appear in the database, and it would be easy to leave off a diagram that began and ended at the project’s own systems.
Try it now (15 minutes)
Pick one workflow. Draw it on paper with three columns: enters, travels, rests.
For every box, write who holds the data at that point and whether you control what they do with it. Then circle every box that is outside your systems: a provider, an analytics tool, a mailbox, someone’s laptop.
The circled boxes are where L4 to L8 will apply. If you have none, check again. There is nearly always at least one.
Check your understanding
Recap
This is general information, not legal advice, and it was checked on 15 October 2026 against reproductions and summaries rather than the official texts, so read those before relying on a figure. Draw the path personal data takes: where it enters, where it travels and where it rests, including the model provider, logs and backups. Personal data is wider than a name, and the question a person types can itself be personal. Both laws sort parties into the one who decides, the one who processes for them, and the person concerned, and hiring a processor does not move the responsibility.
🗂 3 flashcards from this lesson join your daily review.
Sources for this lesson
No vendor pays to be described here, and Lrnon favours none. If one advertises with Lrnon, it says so beside its description. Each description below is drawn from the vendor's own published material or from openly reported use, on the date shown. Follow the link for the current position — it is the authority, not us.