Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment

Free Excel worksheet

DPDP Act Data Flow and Processor Worksheet (Free Excel)

An Excel template for following personal data hop by hop, from the point of collection to erasure, and for keeping one register of every third party that handles it. Fill in one processing activity at a time. It is built to sit beside our guide to data flow and processor mapping.

  • 6 sheets
  • 60 flow rows and 30 processor rows
  • Gap flags are formulas
FREE XLSX

Get the free worksheet

Free XLSX, about 23 KB. Link appears on the next page.

Free. Internal self-assessment aid, not certification or legal advice. If you do not get your download link, write to hi@dpdpactindia.in.

How to use the worksheet in five steps

  1. Read the Example sheet. It follows one fictional order from checkout to erasure.
  2. Pick one processing activity. On the Flow map sheet, add one row for each hop, across the eight stages from collection point to erasure.
  3. On the Processors sheet, add one row for each third party. Classify each as Data Processor, Other Data Fiduciary or To confirm.
  4. Read the gap flag column and the Summary sheet. Give each gap an owner and a date.
  5. Trace one real record through the real systems, fill Last verified, and redraw the map when a vendor, tool, form or data field changes.

Who it is for, and what it does not do

It suits privacy leads, IT and security owners, and the people who manage vendors in companies that share personal data with third parties. It works best when you already have a personal data inventory, because it uses the same activity IDs.

It does not decide whether a vendor is a Data Processor, review a contract or certify anything. A gap flag is a prompt to check, not a finding of non-compliance. Example data is fictional.

What the law says. We found no provision in the Digital Personal Data Protection Act, 2023 or the DPDP Rules, 2025 that requires a data flow map or a processor register. They are practical tools that help you meet duties the Act does contain, such as a valid contract with each Data Processor (Section 8(2)) and security safeguards (Section 8(5), Rule 6).

Frequently asked questions

Do I need a personal data inventory before I use the worksheet?

It helps but is not required. The worksheet uses the same activity IDs as our Data Inventory Workbook (PA-001, PA-002 and so on), so the two fit together. Without an inventory, give each activity a short ID of your own and keep it consistent.

Does the worksheet decide whether a vendor is a Data Processor?

No. The Processors sheet has a role check column where you record your own conclusion: Data Processor, Other Data Fiduciary or To confirm. If the answer is unclear, take legal advice.

Does the DPDP Act require a data flow map or a processor register?

We found no provision in the Act or the Rules that requires either one. They are practical tools that support duties the Act does contain, including the contract with each Data Processor under Section 8(2).

Is the worksheet free?

Yes. It costs nothing. You enter your name, work email, organisation and role (phone is optional) and tick the consent box. The next page gives you a download link that works for one hour. If it expires, submit the form again.

What happens to my details?

We use them to send you the worksheet and to contact you about it. We send DPDP updates only if you tick the second box. You can withdraw your consent at any time by writing to hi@dpdpactindia.in. The Privacy Policy has the detail.