Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment

Templates & downloads

DPDP Act compliance templates and downloads

Editable DPDP Act resources for Indian organisations: implementation templates, starter resources and sector-specific compliance packs, aligned to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.

Get the DPDP Compliance Toolkit — ₹4,999

Free Starter Kit · Essentials to begin

Not sure what you need? Check your DPDP Act readiness ›

What DPDP Act compliance templates are available here?

DPDPActIndia provides editable resources for Indian organisations covering notice, consent, processor management, breach response, retention, data-principal rights and governance. The ₹4,999 DPDP Compliance Toolkit contains nine editable Word resources, alongside starter, professional and sector-specific options presented on this hub. Templates support implementation but do not by themselves establish DPDP Act compliance.

Toolkit 9 editable resources · ₹4,999 Starter Essentials Format Editable .docx Mapped to DPDP Act + Rules

Start here

Find the right DPDP Act resource in seconds

Choose the route that best matches where you are in your DPDP Act implementation journey.

01

Just beginning

Get oriented and start structuring

Understand the essentials and begin structuring your DPDP Act implementation with a small set of starter resources.

Free Starter KitStarter resources on this hub
02

Actively implementing

Use the full documentation set

Use editable documentation and implementation guidance across the major DPDP Act operational areas.

DPDP Compliance Toolkit — ₹4,999 ›
03

Privacy professional

Resources for client work

Professional implementation resources designed for practitioners working across client organisations.

Consultant EditionPractitioner resources on this hub

Choose your resource

Choose the DPDP Act resource that fits your stage

From a free start to practitioner licensing and sector-specific packs, matched to where you are in implementation.

Free

Starter

Free Starter Kit

For organisations starting DPDP Act implementation.

  • Basic privacy notice resource
  • Basic consent wording
  • Implementation checklist

Organisation

DPDP Compliance Toolkit

₹4,999one-time · nine editable Word resources

For organisations actively implementing DPDP.

  • Notice, consent & RoPA
  • Processor / vendor clauses
  • Breach response & retention
  • Data-principal rights & DPO/governance
  • Legal-context mapping & implementation guidance
View DPDP Compliance Toolkit — ₹4,999

Practitioner

Consultant Edition

For privacy practitioners and consulting teams.

  • Professional implementation resources
  • Commercial client-use licensing
  • Expanded practitioner material

By sector

Industry Implementation Packs

For sector-specific implementation needs.

  • NBFC / Fintech
  • SaaS / GCC
  • Schools / EdTech, Healthcare
Explore your sector

Individual resources

Most-used DPDP Act templates

The documents organisations reach for first. Each is written for India and carries its legal context: the underlying obligation it relates to, and the role the document plays.

Statutory obligation Conditional / SDF-specific Implementation control Recommended evidence

DPDP Act duties are being brought into force in phases, with core obligations due by 13 May 2027. Not every obligation below is fully enforceable yet; these resources help organisations prepare ahead of the applicable dates.

Legal status describes the underlying obligation and the document’s role. It does not mean the template itself is a form prescribed by law. Whether an obligation applies depends on how your organisation processes personal data. A Significant Data Fiduciary carries additional duties, including appointing a Data Protection Officer. A DPDP Act data inventory / RoPA supports accountability; it is not the universal Article 30 record-keeping duty that applies under the GDPR.

Data mapping worksheets

Free DPDP Act data mapping worksheets (Excel)

Six Excel worksheets that build on each other, from the personal data inventory to breach readiness. Each is free: you enter your details and the download link appears on the next page. They are practical tools, not forms prescribed by law. Start with the DPDP Act data mapping guide.

Compare

Compare your options

The licensing distinction matters. The Organisation Toolkit is editable for adaptation within the purchasing organisation, subject to its licence. It is not a licence for unrestricted client reuse; those rights sit with the Consultant Edition.

 Starter KitOrganisation ToolkitConsultant Edition
PriceFree₹4,999 one-timeBy licence
Editable resourcesEssentialsNine resourcesExpanded set
Legal-context mappingBasic✓✓
Implementation guidance—IncludedEnhanced
Internal organisation use✓✓✓
Client reuse rights——✓ licensed
Update terms—See product termsSee licence terms
View Toolkit

Why these resources

Why these resources are different

Mapped to the DPDP Act and Rules

Each resource names its legal context rather than handing you a context-free document.

Legal requirement vs implementation control

We distinguish what the law requires from what is an operational control or recommended evidence.

Statutory obligationConditional / SDFImplementation controlRecommended evidence

Editable, practical formats

Word (.docx) files built for organisational adaptation within the purchasing organisation, subject to licence.

Built specifically for India

Written for the DPDP Act, 2023 and the DPDP Rules, 2025, using Indian terminology and legal references.

Maintained and versioned

Version and update information travels with the resources as DPDP Act requirements settle.

Connected to implementation guidance

Documents link back to our consent, breach and readiness material.

Templates support implementation. They do not by themselves establish compliance.

Whether an organisation meets its DPDP Act obligations depends on how it processes personal data, the systems and vendors involved, its operational controls and the obligations that apply to it as a Data Fiduciary. Documents are a starting point, not a determination.

Check your DPDP Act readiness

Need more than templates?

Some organisations need support beyond documentation: gap assessment, implementation, consent, vendor controls, data mapping, breach readiness, rights workflows or sector-specific issues. We can route you to the appropriate implementation support when internal resources or templates are not enough.

Request implementation helpFind the right implementation route Check your DPDP Act readinessSee where the gaps are first

FAQ

Frequently asked questions

What are DPDP Act compliance templates?
Editable documents, such as a privacy notice, consent text, data inventory / RoPA and breach-response records, that help an organisation produce the documentation the DPDP Act and DPDP Rules expect instead of drafting from a blank page.
Does the DPDP Act prescribe specific document templates?
No. The Act sets obligations such as notice under Section 5 and consent under Section 6, but does not prescribe a particular template or form. Templates are a practical way to meet those obligations, not a format mandated by law.
Can templates make an organisation DPDP Act compliant?
No. Templates support implementation. Compliance depends on how you actually process personal data, your systems and contracts, and the obligations that apply to you. A readiness assessment is a better guide to where you stand.
What is included in the DPDP Compliance Toolkit?
Nine editable Word resources covering notice, consent, data inventory / RoPA, processor and vendor clauses, breach response, retention, data-principal rights and DPO / governance, with legal-context mapping. See the Toolkit page for the full list.
Are the templates editable?
Yes. They are Word (.docx) files, editable for adaptation within the purchasing organisation, subject to the applicable licence.
Can consultants use the Organisation Toolkit for clients?
The Organisation Toolkit is for the purchasing organisation’s own internal use and is not a licence for unrestricted client reuse. Commercial client-use rights sit with the Consultant Edition.
Are these GDPR templates renamed for India?
No. They are written for the DPDP Act, 2023 and the DPDP Rules, 2025, using Indian terminology and legal references, not GDPR documents with the labels changed.
What is a DPDP Act data inventory or RoPA?
A record of what personal data your organisation processes, why, and with whom it is shared. Under the DPDP Act it functions as an implementation control that supports accountability. It is not the same universal record-keeping duty that Article 30 imposes under the GDPR.
Do all organisations need a DPO?
No. Appointing a Data Protection Officer is a conditional obligation that applies principally to a Significant Data Fiduciary once notified as such. Other organisations may still designate someone to handle data-protection queries and grievances.
Which DPDP Act resource should an organisation start with?
The right starting point depends on your processing activities. Most implementations first identify processing activities and applicable obligations, then address notice, consent where applicable, processor relationships, rights, retention and other controls. The readiness assessment helps prioritise.
Are sector-specific DPDP Act resources available?
Sector context is covered across our Industries material, and sector implementation packs are part of the resource family shown on this hub.
Last updated: 5 September 2026 Mapped against: DPDP Act, 2023 + DPDP Rules, 2025

These are editable templates, not legal advice, and are not affiliated with, or approved by, the Government of India. Confirm against the enacted Act and the DPDP Rules, or take professional advice.