Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment

Free DPDP Act resources

Free DPDP Act Starter Kit for Indian Organisations

Start your DPDP Act implementation with three practical resources: a readiness checklist with a starter data list, a privacy-notice template, and a 12-month DPDP calendar. Built for Indian organisations preparing for the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.

Get the Free Starter Kit

Browse all DPDP Act templates & downloads ›

What is a DPDP Act Starter Kit?

A DPDP Act Starter Kit is a small set of practical resources that helps an Indian organisation begin structuring its Digital Personal Data Protection Act implementation. It can include an implementation checklist, a privacy-notice starter and a month-by-month calendar. These resources help organise implementation but do not by themselves establish DPDP Act compliance.

Cost Free Contents 3 starter resources Formats .docx + .xlsx Mapped to DPDP Act + Rules

In the kit

What’s included in the free DPDP Act Starter Kit?

Three editable resources to get an implementation moving, each written for India with its practical context.

DPDP Act Implementation Starter Checklist

Work through the first 25 steps for notice, consent, rights, security, breach response, retention and children’s data, each with the provision it comes from, plus a starter list of the personal data you hold.

Implementation roadmap.xlsx

Privacy Notice Starter Template

A fill-in notice built on the DPDP Act notice rules, with drafting notes and a pre-publish checklist. A starting point for adaptation, not a Government form.

Implementation templateSection 5 · Rule 3.docx

12-Month DPDP Calendar

A month-by-month plan built around the dates in the Gazette, including 13 May 2027 when the main duties begin. Set your start month and it updates.

Implementation roadmap.xlsx

Free download

Get the free DPDP Act Starter Kit

Tell us where to send it. We’ll email the download link. No account required.

I am
We use your email to send the kit. See our Privacy Policy.

Your Starter Kit is on its way

Thanks — we’ve received your details and will email your DPDP Act Starter Kit shortly. In the meantime:

Check your DPDP Act readiness ›

Why templates are only the start

Where the Starter Kit fits

A few templates help you begin, but a working implementation follows a sequence. The Starter Kit covers the first steps.

  1. Map personal data Starter Kit

    Identify what you process, why, where it sits and who it is shared with.

  2. Identify applicable obligations

    Work out which duties apply to your activities, and to you as a Data Fiduciary.

  3. Address notice and consent where relevant Starter Kit

    Prepare a notice, and handle consent where the activity relies on it.

  4. Implement operational controls

    Processor terms, breach response, retention, rights handling and governance.

  5. Check remaining gaps

    Review what is left with a readiness assessment.

Five steps from mapping personal data to checking remaining gaps A rising staircase of five steps. Steps 1 and 3 are covered by the Starter Kit. Steps 2, 4 and 5 are your implementation work, ending with a readiness assessment. Your path to DPDP readiness The Starter Kit covers the first steps. 1 Mappersonal data Starter Kit 2 Identifyobligations 3 Notice andconsent Starter Kit 4 Operationalcontrols 5 Checkgaps Assessment Start here Operational compliance In the Starter Kit Your implementation work

Audience

Who is the DPDP Act Starter Kit for?

Built for organisations at the beginning of DPDP Act implementation.

StartupsSMEsFoundersOperations teamsCompliance & privacy ownersIn-house legal teamsOrganisations beginning DPDP Act implementation

Consultants are welcome to evaluate the resources, but the free kit does not grant unrestricted commercial client-reuse rights. Client-use licensing sits with the Consultant Edition on the downloads hub.

Beyond the basics

Need more than the first steps?

The Starter Kit is intentionally a starting point. It does not cover processor and vendor controls, detailed breach response, retention, rights-handling workflows or DPO and Significant Data Fiduciary governance.

See the DPDP Compliance Toolkit ›

Individual resources

Looking for a specific DPDP Act template?

Dedicated resources for the most-requested documents are part of the resource family. Each is included in the Starter Kit or the Toolkit today.

DPDP Act Privacy Notice Template

Structuring the notice given to Data Principals when personal data is collected.

Section 5 · notice

DPDP Act Consent Template

Consent capture and withdrawal, for processing activities that rely on consent.

Section 6 · consent

DPDP Act Data Inventory Template

Mapping personal data across the organisation to support accountability.

Implementation control

Beyond templates

Need implementation support rather than templates?

Some organisations need help with gap assessment, consent implementation, data mapping, vendor controls, breach readiness, rights workflows or sector-specific requirements.

FAQ

Frequently asked questions

What is a DPDP Act Starter Kit?
A small set of practical resources that helps an Indian organisation begin structuring its DPDP Act implementation: an implementation checklist, a privacy-notice starter and a 12-month calendar.
Is the DPDP Act Starter Kit free?
Yes. The Starter Kit is free. We email the download link after you tell us where to send it. No account or payment is required.
What does the Starter Kit include?
Three editable resources: a DPDP Act Implementation Starter Checklist, a Privacy Notice Starter Template and a 12-Month DPDP Calendar.
Does downloading the Starter Kit make an organisation DPDP Act compliant?
No. The resources help you begin organising an implementation. Compliance depends on how you actually process personal data, your systems and contracts, and the obligations that apply to you. A readiness assessment is a better guide to where you stand.
Does every organisation need consent under the DPDP Act?
No. Consent under Section 6 is one basis for processing; the Act also provides for certain legitimate uses under Section 7. Whether consent applies depends on the specific processing activity, so the consent items in the checklist apply only to activities that rely on consent.
Is a RoPA mandatory under the DPDP Act?
The DPDP Act does not impose the same universal record-of-processing duty that Article 30 of the GDPR does. A personal-data inventory is an implementation control that supports accountability. A Significant Data Fiduciary carries additional obligations.
What is a personal-data inventory?
A record of what personal data your organisation processes, why, where it resides and which third parties are involved. It is the practical starting point for most implementation decisions, which is why the checklist includes a starter tab for it.
Are the Starter Kit files editable?
Yes. They are Word (.docx) and spreadsheet (.xlsx) files, editable for adaptation within the downloading organisation, subject to the applicable licence.
Can consultants reuse these resources for clients?
The free kit is for the downloading organisation’s own use and does not grant unrestricted commercial client reuse. Client-use licensing sits with the Consultant Edition on the downloads hub.
What is the difference between the Starter Kit and the ₹4,999 Toolkit?
The Starter Kit covers the first steps: checklist, notice template and calendar. The Compliance Toolkit adds processor and vendor controls, breach response, retention, rights handling, governance and expanded legal-context mapping.
Where can I get a DPDP Act privacy notice template?
A Privacy Notice Starter Template is included in this free Starter Kit, and a fuller version is part of the Compliance Toolkit.
Where can I get a DPDP Act consent template?
The checklist in this free Starter Kit includes consent and withdrawal checks, with expanded consent resources in the Compliance Toolkit. See also our consent management guide.
Last updated: 6 October 2026 Mapped against: DPDP Act, 2023 + DPDP Rules, 2025

These are editable templates, not legal advice, and are not affiliated with, or approved by, the Government of India. Confirm against the enacted Act and the DPDP Rules, or take professional advice.