Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment

Free Excel worksheet

DPDP Act Data Principal Request Worksheet (Free Excel)

An Excel worksheet with two jobs. A Systems sheet records where a person's data can be found and how to search, correct and erase it. A Requests sheet tracks each request from receipt to evidence. It is built to sit beside our guide to data mapping for Data Principal requests.

  • 7 sheets
  • 60 requests and 40 systems
  • Optional internal target in days
FREE XLSX

Get the free worksheet

Free XLSX, about 26 KB. Link appears on the next page.

Free. Internal self-assessment aid, not certification or legal advice. If you do not get your download link, write to hi@dpdpactindia.in.

How to use the worksheet in five steps

  1. Fill the Systems sheet first, one row for each system that holds personal data. Record the identifier, how to search, how to correct, how to erase, and where copies and backups sit.
  2. When a request arrives, add a row on the Requests sheet. Record the type, whether identity was checked, the activities in scope, every system searched and every processor asked.
  3. Record what you did. If you keep any data, write the reason, such as the retention reason or the law that requires it, and check it with a legal adviser.
  4. Keep the evidence: the ticket, the reply and the processor confirmations. Record the date the outcome reached the person.
  5. Read the gap flags and the Summary sheet. Fix gaps in the Systems sheet, because they slow every later request.

Who it is for, and what it does not do

It suits privacy leads, customer support and operations managers, and IT owners who will have to find, correct or erase one person's data across several systems. It works best beside a personal data inventory, a flow map and a retention register.

It does not set a deadline, decide whether a request must be granted or check anyone's identity for you. Keep the log lean: record categories of data found, not the personal data itself, and limit who can open the file.

What the law says. Section 11 of the Act gives a right to a summary of personal data and processing activities, and to the identities of those the data was shared with. Section 12 covers correction, completion, updating and erasure. Sections 13 and 14 cover grievance redressal and nomination. We found no provision requiring a request log or a systems lookup. This worksheet is a practical tool.

Frequently asked questions

Does the DPDP Act set a deadline for answering a request?

We found no provision that sets a response time for access, correction or erasure requests. Rule 14(3) sets a published grievance timeframe not exceeding ninety days. The optional internal target on the Summary sheet is your own number, not a legal deadline.

Should I paste the person's data into the log?

No. Record the categories of data found, not the personal data itself, and limit who can open the file.

Why fill the Systems sheet before the Requests sheet?

The Systems sheet tells you where a person's data can be found, corrected and erased. Gaps there, such as a system with no way to erase, slow every later request, so it pays to fix them first.

Is the worksheet free?

Yes. It costs nothing. You enter your name, work email, organisation and role (phone is optional) and tick the consent box. The next page gives you a download link that works for one hour. If it expires, submit the form again.

What happens to my details?

We use them to send you the worksheet and to contact you about it. We send DPDP updates only if you tick the second box. You can withdraw your consent at any time by writing to hi@dpdpactindia.in. The Privacy Policy has the detail.