DPDPA Supportby Cynor Sense
Free sample
DPDP Act 2023 · Rules 2025 · 8 sectors

DPDPA Toolkit. Ready for Website & SaaS.

Prefilled sector RoPA, 12 editable Word & Excel templates, live scoring formulas, and 13 walkthrough videos (26 min).

Buy toolkit · ₹2,999 Free sample (.xlsx)

Not sure if DPDPA applies? 2-minute check → · Document rubrics →

The toolkit in one minuteOverview

₹2,999 incl. GSTper sector · one-time payment · free updates till May 2027

  • Prefilled sector RoPA, Policy & Children’s Parental ConsentIndustry activities, S.6/S.7 bases, CGST s.36 72-month invoice retention & Rule 10 parental verification
  • Live Excel scoring rubrics & SLA formulasAuto-calculates DPIA risk scores, 38-question vendor tiers, 72-hour breach & 90-day grievance SLAs
  • 13 walkthrough videos (26 min) + Free updates till May 2027Watch in your dpdpa.support LMS portal · licensed for your business or 1 named CA/CS client
  • 256-Bit Encrypted Checkout on dpdpa.support
  • Official Gazette G.S.R. 846(E) Citations
  • Instant Word & Excel ZIP + GST Invoice

Key dates

  1. 13 Nov 2025DPDP Rules notified
  2. 13 Nov 2026Consent Manager registration rule in force
  3. 13 May 2027Data Fiduciary duties and penalties apply
The law
Until DPDP duties and penalties apply (13 May 2027)Data Fiduciary duties and penalties apply from 13 May 2027.
Built for Indian businesses

Built for founders, IT leads and compliance teams

  • A woman in a navy blazer holding a laptop in an office

    Founders and owners who decide what data the business collects and why.

  • A woman and a man walking through a glass-walled office, talking

    IT and operations leads who run the systems and the vendors.

  • Two colleagues reviewing printed documents together at a table

    Compliance and support leads who answer people’s requests about their data.

Stock photographs for illustration. They are not our team or our customers.

Step 1 of 3 · 8 sector toolkits

1. Pick your sector

Tap your industry below. Your RoPA, Policy, Notice, Retention, DPIA, Vendor & Transfer files arrive pre-populated with built-in Excel formulas and 13 videos.

  1. 1
    Tap your sectorPrefilled RoPA & 12 templates
  2. 2
    Pay ₹2,999One-time incl. GST on Razorpay
  3. 3
    Swift startZIP, Excel rubrics & 13 videos

Website & SaaS toolkit ₹2,999 incl. GST per sector · one time · free updates till May 2027

Prefilled for B2B websites, SaaS apps, cloud software, and service businesses: enquiry forms, user accounts, billing, support tickets, and employee HR.

Buy toolkit · ₹2,999 Free sample
Tick to add to your sector toolkit (or buy all 8 sectors):

All 8 Sectors Master Pack (Multi-Client Licence + 1-on-1 DPO Call) — ₹29,999 incl. GST →

Prefilled activities included in your Website & SaaS RoPA, Policy, Retention, DPIA & Vendor pack (plus Children’s Verifiable Parental Consent Procedure & Record):

  • ACT-01 Website enquiry & demo request forms Legitimate Use - S.7
  • ACT-02 SaaS account registration, login & product telemetry Consent
  • ACT-03 Subscription billing, GST invoicing & payment records Legitimate Use - S.7
  • ACT-04 Product newsletter, webinar & marketing updates Consent
  • ACT-05 Employee onboarding, payroll & HR administration Legitimate Use - S.7
Inspect all 5 prefilled Step 03 RoPA activity cards
ACT-01Legitimate Use - S.7(a) (voluntary provision)

Website enquiry & demo request forms

Personal dataName, business email, phone, company, IP & form logs
Retention & erasure (Step 06)Erase on closure + 1-year minimum log retention (Rule 8(3))
ACT-02Consent (S.6)

SaaS account registration, login & product telemetry

Personal dataName, email, role, auth logs, session & audit logs
Retention & erasure (Step 06)Erase on account closure unless required by law + 1-year log floor
ACT-03Legitimate Use - S.7(a) (voluntary provision)

Subscription billing, GST invoicing & payment records

Personal dataBilling contact, GSTIN, invoice history, gateway reference
Retention & erasure (Step 06)72 months (6 years) from annual return due date for GST invoices (CGST Act s.36); 8 years for corporate books of account (Companies Act s.128)
ACT-04Consent (S.6)

Product newsletter, webinar & marketing updates

Personal dataName, email, subscription preferences, consent timestamp
Retention & erasure (Step 06)Until consent withdrawal + 1-year log floor (Rule 8(3))
ACT-05Legitimate Use - S.7(i) (employment)

Employee onboarding, payroll & HR administration

Personal dataEmployee ID, PAN, bank account, attendance, emergency contact
Retention & erasure (Step 06)Duration of employment + statutory labour/tax period

Owned by CynorSense Solutions Pvt. Ltd. · single-sector licence for your business or 1 named CA/CS client (₹2,999 incl. GST per sector · includes free updates till 13 May 2027).

Why pay ₹2,999 when free templates exist?

Built for Indian law. Prefilled for your sector.

Free privacy templates hand you blank tables and European GDPR rules. Every sector pack arrives pre-populated with Indian statutory numbers, Excel formulas, and walkthrough videos.

CGST Act s.36 · Rule 8(3)

1. Sector-Prefilled Rows & Indian Tax Rules

Pre-populated for your sector — including 72 months (6 years) under CGST Act s.36 for tax invoices and the 1-year log floor under Rule 8(3).

8 Live Dashboards · Rule 7(2) & 14(3)

2. Live Excel Scoring & SLA Countdowns

8 workbooks auto-calculate DPIA risk scores, 38-question vendor tiers, 72-hour breach deadlines, and 90-day Rule 14(3) grievance SLAs.

13 Videos · 26 Min LMS

3. 13 Step-by-Step Walkthrough Videos

Watch 13 short screen recordings inside your dpdpa.support LMS portal showing every workbook tab and bracket in order.

DPDP Act s.6, s.7 & s.9 / Rule 10

4. Indian Law + Children’s Parental Consent

Enforces Indian S.6 & S.7 dropdowns and includes the Children’s Verifiable Parental Consent Procedure (verifiable-consent-procedure.docx) & Record (consent-record.xlsx).

Updates till May 2027 · CA/CS Ready

5. Free Updates till May 2027 + CA/CS Licence

Includes free updates until 13 May 2027 for your business or 1 named CA/CS client (or unlock all 8 sectors in the ₹29,999 Master Pack).

Step 2 of 3 · Inside your ZIP

2. Preview the 12 templates

Editable Word policies and notices plus Excel trackers with built-in formulas, Indian-law dropdowns and Dashboards.

All 12 templates
  1. First page of the Reality Check self-assessment (step 01)01Reality Check self-assessmentExcel · how-to 01
  2. First page of the Compliance Timeline (step 02)02Compliance TimelineExcel · how-to 02
  3. First page of the RoPA tracker (step 03)03RoPA trackerExcel · how-to 03
  4. First page of the Data Protection Policy (step 04)04Data Protection PolicyWord · how-to 04
  5. First page of the Consent Notice (step 05)05Consent NoticeWord · how-to 05
  6. First page of the Retention Schedule (step 06)06Retention ScheduleExcel · how-to 06
  7. First page of the Rights Request Form + Tracker (step 07)07Rights Request Form + TrackerWord + Excel · how-to 07
  8. First page of the DPIA + Risk Register (step 08)08DPIA + Risk RegisterExcel · how-to 08
  9. First page of the Vendor Risk Assessment (step 09)09Vendor Risk AssessmentExcel · how-to 09
  10. First page of the Data Processing Agreement (step 09b)09bData Processing AgreementWord · how-to 09b
  11. First page of the Cross-Border Transfer Register (step 10)10Cross-Border Transfer RegisterExcel · how-to 10
  12. First page of the Breach Register + both notices (step 11)11Breach Register + both noticesExcel + Word · how-to 11

Badges show the step that uses each document. Step 12 adds three bonus tools: a cost-of-inaction brief, a roles guide and a five-framework crosswalk.

Format architecture

RoPA vs. consent notice vs. internal policy

See at a glance what stays internal and what faces customers under the DPDP Act 2023 and Rules 2025.

FIG. 02 · DOCUMENT BOUNDARY & AUDIENCE MATRIX How Step 03 RoPA feeds both public notices and internal governance
STEP 03 · ROPA (.XLSX) 1. Master Data Inventory Audience : Internal DPO / Board Basis : S.6 Consent / S.7 Uses Scope : 20 Cols per Activity Output : Risk, DPIA & Retention Never publish raw RoPA externally STEP 05 · NOTICE (.DOCX) 2. Point-of-Collection Notice Audience : Customer / Principal Basis : Act S.5(1) & Rule 3 Scope : Itemised Data & Purpose Output : Withdraw & Board Links Separate from Terms of Service STEP 04 · POLICY (.DOCX) 3. Internal Governance Rulebook Audience : Staff, IT & Auditors Basis : Act S.8(4)-(6) & Rule 6 Scope : 14 Sections & Safeguards Output : Duty vs Choice Labels Signed by leadership; reviewed yearly
Step 03 · Excel (.xlsx)

RoPA Tracker vs. Website Privacy Notice

ropa-tracker.xlsx

What it is:
Internal 20-column master register of every personal data activity.
Must include:
Activity ID, purpose, data categories, Indian legal basis (Consent (S.6) or Legitimate Use - S.7(a) to S.7(i)), processors, storage, and retention link.
Boundary:
Never copy a GDPR RoPA ("Legitimate Interest" and "Contractual Necessity" do not exist in the DPDP Act) or publish your internal RoPA as a public notice.
Step 05 · Word (.docx)

Consent Notice Form vs. Terms of Service

consent-notice-template.docx

What it is:
Standalone customer notice shown before or with every consent request (Section 5(1), Rule 3).
Must include:
Itemised data table, specific purpose, one-click withdrawal link, rights/grievance contact, Board complaint link, and Eighth Schedule languages.
Boundary:
Do not bury consent inside Terms of Service or bundle unrelated marketing purposes into one tick-box (Rule 3(a)).
Step 04 · Word (.docx)

Internal Data Protection Policy vs. Public Notice

data-protection-policy.docx

What it is:
Internal 14-section governance rulebook signed by leadership for staff and auditors.
Must include:
Scope, roles, SDF check, seven principles, Rule 6(1)(a)-(g) security safeguards, children's data rules (s.9), and review cycle.
Boundary:
Every clause in our template is explicitly tagged as a statutory duty, a contract choice, or a recommendation.
Step 06 · Excel (.xlsx)

Retention & Erasure Schedule vs. Simple Backups

data-retention-schedule.xlsx

What it is:
Activity-linked schedule setting erasure triggers and mandatory audit-log retention windows.
Must include:
Primary erasure trigger (s.8(7)), statutory overrides (72 months / 6 years for GST tax invoices under CGST Act s.36; 8 years for corporate books of account under Companies Act s.128), mandatory 1-year minimum log floor (Rule 6(1)(e) & Rule 8(3)), and Third Schedule rules.
Boundary:
Do not delete processing and traffic logs immediately on account deletion; Rule 6(1)(e) and Rule 8(3) require at least 1 year of log retention.
Steps 09 & 09b · Excel + Word

Vendor Assessment & DPA vs. Standard NDA

vendor-risk-assessment.xlsx · data-processing-agreement-template.docx

What it is:
Processor security screening workbook (Step 09) and bilateral Data Processing Agreement (Step 09b, Section 8(2)).
Must include:
Processing scope, all seven Rule 6(1) security controls passed to the processor (Rule 6(1)(f)), rapid breach reporting for your 72-hour Board deadline, and erasure cascade.
Boundary:
A plain NDA does not satisfy Section 8(2) or Rule 6(1)(f). Under Section 8(1), the Data Fiduciary remains liable for processor failures.
Steps 07 & 11 · Excel + Word

Rights SLA Tracker & 72-Hour Breach Pack

rights-request-tracker.xlsx · breach-register.xlsx · 2 breach notices (.docx)

What it is:
Operational registers for the 90-day grievance ceiling (Rule 14(3)) and two-stage breach notices (Rule 7).
Must include:
90-day countdown formulas, zero-threshold breach log, immediate Board intimation + 72-hour detailed report tracker, and Data Principal breach notice.
Boundary:
The Indian DPDP Act has no minimum size threshold: every personal data breach must be notified to the Board and affected individuals.
Inside a template

See how a prefilled template works

Each video moves through the real document, one section at a time, and shows where every input comes from. Here is page one of the Data Protection Policy (Step 04).

From how-to 04: effective date, owner, approver and next review, filled from the Compliance Timeline.
Page one of the Data Protection Policy template: header, four fields, and sections 1 to 3

  1. 1Every bracket is yours

    Type your company name into the header and the title. The worked example uses a fictional online store.

  2. 2Four fields, filled from your plan

    Effective date, owner, approver and next review. The dates and owners come from your Compliance Timeline in step 02.

    A DPO is required only for a notified Significant Data Fiduciary

  3. 3Scope and roles

    The policy opens with its scope, then defines the roles and asks whether you are a Significant Data Fiduciary, a status only the Central Government can give by notification.

  4. 4Seven principles

    From lawful basis to accountability. Five cite the Act; two are your own commitments. Keep all seven.

    Lawful basis: consent, or a legitimate use the Act lists
Step 3 of 3 · Guided rollout

3. Follow the 12-step rollout order

13 walkthrough videos guide you step by step so the same activity IDs, vendors, and dates flow cleanly across every document.

Screen-recording walkthrough reel · swipe to preview 6 key steps All 13 walkthroughs
Step 01 0:24 preview · 2:27 full

Start here

Find out whether the Act applies, then see which duties you already cover.

Step 03 0:27 preview · 2:02 full

Know your data

Map every way your business uses personal data. Most other documents build on this one.

Step 04 0:24 preview · 1:58 full

Set the rules

The Data Protection Policy your business commits to, in 17 sections.

Step 05 0:30 preview · 1:55 full

Ask properly

The consent notice, children's verifiable parental consent procedure, and consent record.

Step 08 0:27 preview · 1:58 full

Check risky processing

Score the risk to people's rights before and after your fixes.

Step 11 0:26 preview · 1:55 full

When something goes wrong

Log a breach, file both Board reports on time, and tell the people affected.

  1. Step 01:

    Start here

    Find out whether the Act applies, then see which duties you already cover.

    00-does-this-apply-to-you.docxdpdpa-reality-check-self-assessment.xlsxPreview · 0:24 · full 2:27 with the toolkit
  2. Step 02:

    Plan the work

    Turn your gaps into a dated plan, with each task tied to a document.

    compliance-timeline.xlsxPreview · 0:28 · full 1:50 with the toolkit
  3. Step 03:

    Know your data

    Map every way your business uses personal data. Most other documents build on this one.

    ropa-tracker.xlsxPreview · 0:27 · full 2:02 with the toolkit
  4. Step 04:

    Set the rules

    The Data Protection Policy your business commits to, in 17 sections.

    data-protection-policy.docxPreview · 0:24 · full 1:58 with the toolkit
  5. Step 05:

    Ask properly

    The consent notice, children's verifiable parental consent procedure, and consent record.

    consent-notice-template.docxverifiable-consent-procedure.docxconsent-record.xlsxPreview · 0:30 · full 1:55 with the toolkit
  6. Step 06:

    Keep only as long as needed

    Turn retention periods into deletion dates, and track every erasure.

    data-retention-schedule.xlsxPreview · 0:28 · full 1:53 with the toolkit
  7. Step 07:

    Answer people on time

    A form for people to ask about their data, and a tracker so you answer on time.

    rights-request-form.docxrights-request-tracker.xlsxPreview · 0:26 · full 1:59 with the toolkit
  8. Step 08:

    Check risky processing

    Score the risk to people's rights before and after your fixes.

    dpia-template-risk-register.xlsxPreview · 0:27 · full 1:58 with the toolkit
  9. Step 09:

    Control your vendors

    Screen each vendor before you sign, and see who still needs work.

    vendor-risk-assessment.xlsxPreview · 0:27 · full 1:58 with the toolkit
  10. Step 09b:

    Sign the vendor contract

    The Data Processing Agreement: 15 clauses, plus Schedules A and B.

    data-processing-agreement-template.docxPreview · 0:27 · full 2:23 with the toolkit
  11. Step 10:

    Data leaving India

    Log every transfer abroad and re-check it against the gazette.

    cross-border-transfer-register.xlsxPreview · 0:30 · full 1:57 with the toolkit
  12. Step 11:

    When something goes wrong

    Log a breach, file both Board reports on time, and tell the people affected.

    breach-register.xlsxbreach-notification-to-board.docxbreach-notification-to-data-principal.docxPreview · 0:26 · full 1:55 with the toolkit
  13. Step 12:

    Bonus tools

    A budget brief, a roles guide for messy org charts, and a five-framework crosswalk.

    cfo-cost-of-inaction-onepager.docxdpdpa-roles-in-a-hairball-org.docxdpdpa-multi-framework-crosswalk.xlsxPreview · 0:28 · full 2:08 with the toolkit
Add-on packs & practitioner licence

Add-on packs & CA/Practitioner Master Pack

Add Rule 6 Security (₹2,500), Vendor Governance (₹2,500), ISO/GDPR/CCPA (₹7,500), or unlock all 8 sectors with a Multi-Client CA/CS Licence (₹29,999).

ADD-ON SALE
Add-on 01 · ₹2,500 incl. GST · 10 templates (Word + Excel)

Rule 6 Security Safeguards & Incident Add-On

Aligned with: DPDP Act s.8(4)-(6) (₹250 Cr security ceiling) · DPDP Rules 2025 Rule 6(1)(a)-(g) & Rule 7

Operationalises all seven Rule 6(1) security safeguards: encryption, masking, access control, 1-year visibility logs, backup continuity, processor clauses, and incident response.

  • Word
    ft-r6-01-encryption-and-cryptographic-controls-policy.docxEncryption, obfuscation, masking & virtual token controls (Rule 6(1)(a))
  • Word
    ft-r6-02-access-control-and-privilege-management-policy.docxRole-based access, MFA & least-privilege enforcement (Rule 6(1)(b))
  • Word
    ft-r6-03-logging-monitoring-and-1year-audit-retention-policy.docxVisibility logging & mandatory 1-year log retention policy (Rule 6(1)(c)&(e))
  • Word
    ft-r6-04-data-backup-and-recovery-policy.docxEncrypted backups & recovery testing for continued processing (Rule 6(1)(d))
  • Word
    ft-r6-05-business-continuity-and-resilience-plan.docxDisaster recovery & resilience plan for personal data systems (Rule 6(1)(d))
  • Word
    ft-r6-06-cyber-incident-management-and-rule7-response-plan.docxTechnical containment & 72-hour Board breach response SOP (Rule 7)
  • Excel
    ft-r6-07-security-incident-and-access-log-register.xlsx1-year access review & security event register with Dashboard
  • Word
    ft-r6-08-data-classification-and-handling-policy.docxLabelling and handling rules for digital and digitised personal data
  • Word
    ft-r6-09-acceptable-use-and-endpoint-security-policy.docxStaff acceptable use, BYOD & endpoint rules (Rule 6(1)(g))
  • Word
    ft-r6-10-password-and-authentication-standard.docxAuthentication & credential hygiene standard across data systems
₹2,500 incl. GSTOne-time add-on · licensed by CynorSense Solutions Pvt. Ltd.
ADD-ON SALE
Add-on 02 · ₹2,500 incl. GST · 6 templates (Word + Excel)

Vendor, Cloud & Rule 13(3) Governance Add-On

Aligned with: DPDP Act s.8(1)-(2), s.8(7)(b), s.16 · DPDP Rules 2025 Rule 6(1)(f), Rule 8(3), Rule 13(3) & Rule 15

Covers Section 8(1)-(2) processor liability across cloud hosts, SaaS tools, and software vendors with a 25-point audit workbook, DPA renewal tracker, Rule 13(3) software register, and exit erasure SOP.

  • Word
    ft-vg-01-third-party-processor-risk-management-policy.docxEnd-to-end processor onboarding, monitoring & offboarding policy (s.8(2))
  • Excel
    ft-vg-02-processor-contract-and-dpa-renewal-tracker.xlsxDPA clause verification, renewal countdown & breach-SLA register
  • Excel
    ft-vg-03-processor-security-and-privacy-audit-questionnaire.xlsx25-check vendor security & Rule 6(1) audit questionnaire with Dashboard
  • Word
    ft-vg-04-cloud-hosting-and-subprocessor-privacy-policy.docxCloud region, sub-processor approval & Rule 15 foreign-State order policy
  • Excel
    ft-vg-05-algorithmic-software-due-diligence-register.xlsxRule 13(3) algorithmic software risk & rights-harm register with Dashboard
  • Word
    ft-vg-06-vendor-exit-and-processor-erasure-verification-plan.docxProcessor offboarding SOP & written erasure certification template (s.8(7)(b))
₹2,500 incl. GSTOne-time add-on · licensed by CynorSense Solutions Pvt. Ltd.
SPECIAL SALE
Special Sale Pack · ₹7,500 incl. GST · 8 templates (Word + Excel)

ISO 27001 / 27701 + GDPR + CCPA Special Sale Pack

Aligned with: DPDP Act 2023 + ISO/IEC 27701 + ISO/IEC 27018 + NIST Privacy Framework + EU/UK GDPR + US CCPA/CPRA

Special multi-framework pack bridging Indian DPDPA compliance with ISO 27001/27701, ISO 27018, NIST Privacy, EU/UK GDPR, and US CCPA/CPRA using 8 policies and gap workbooks.

  • Word
    ft-gp-01-iso27701-privacy-information-management-policy.docxMaster PIMS governance policy aligned with ISO 27701 & DPDP Act
  • Word
    ft-gp-02-privacy-by-design-and-default-engineering-policy.docxSDLC privacy gates, data minimisation & release checklist
  • Excel
    ft-gp-03-iso27701-pims-gap-assessment-and-action-tracker.xlsxISO 27701 PIMS control readiness workbook with Dashboard
  • Excel
    ft-gp-04-iso27018-cloud-pii-protection-gap-assessment.xlsxISO 27018 public-cloud PII processor control assessment workbook
  • Excel
    ft-gp-05-nist-privacy-framework-gap-assessment.xlsxNIST Privacy Framework (Identify, Govern, Control, Communicate, Protect) tracker
  • Excel
    ft-gp-06-privacy-and-consent-notice-version-register.xlsxSection 6(10) proof ledger tracking every published notice version & language
  • Excel
    ft-gp-07-eu-uk-gdpr-to-dpdpa-readiness-tracker.xlsxPractical delta workbook bridging EU/UK GDPR and Indian DPDP Act duties
  • Excel
    ft-gp-08-us-ccpa-cpra-to-dpdpa-readiness-tracker.xlsxPractical delta workbook bridging US CCPA/CPRA and Indian DPDP Act duties
₹7,500 incl. GSTSpecial sale pack (standalone or bundled) · licensed by CynorSense Solutions Pvt. Ltd.
Buy ISO + GDPR + CCPA Pack · ₹7,500

Practitioner & Multi-Entity Master Pack: All 8 Sector Toolkits + Multi-Client CA/CS Licence + 1-on-1 Certified DPO Call — Buy Master Pack (₹29,999 incl. GST)

What the law sets

Penalty ceilings up to ₹250 crore

The Act sets maximum penalty ceilings by breach category. The Board may impose a penalty after an inquiry finds a significant breach and gives the person an opportunity of being heard.

01 · TRIGGER Breach / Complaint Act s.27(1) 02 · INQUIRY Records Inspected Act s.28 03 · HEARING Chance to be Heard Act s.33(1) 04 · MITIGATION 7 Factors Weighed Act s.33(2) & Sched.

Check which of the 19 legal duties your business already covers.Step 01 maps all 19 legal duties and 1 good-practice item against their citations and penalty ceilings.

Preview step 01

Visual summary: The Schedule to the DPDP Act, 2023 · ceilings and Section 33 inquiry flow (silent loop).
  • ₹250croreFailing to take reasonable security safeguards
  • ₹200croreFailing to notify the Board or people affected by a breach
  • ₹200croreBreaching the additional duties for children’s data
  • ₹150croreBreaching the additional duties of a Significant Data Fiduciary
  • ₹50croreBreaching any other provision of the Act or Rules

“May extend to”: each figure is the most the Board may impose, not a fixed fine.

Why trust it

Built from the DPDP Act 2023 & Rules 2025

Every section, rule, date, and formula traces directly to the notified Act and Rules:

FIG. 01 · STATUTORY-TO-WORKBOOK ARCHITECTURE Traceability from primary law to automated Excel formulas
STAGE 01 · T1 Primary Law Corpus • DPDP Act 2023 (44 Sec) • Rules 2025 G.S.R. 846(E) • 23 Rules & 7 Schedules • 19 Statutory Duties Ref: G.S.R. 843(E) / 846(E) STAGE 02 · CORE Prefilled Sector RoPA • Step 03 Master (.xlsx) • 8 Sector Activity Packs • S.6 Consent vs S.7 Uses • Feeds Steps 04 to 10 20 Columns · Activity IDs STAGE 03 · LOGIC Excel Scoring Rubrics • 90-Day Grievance (R.14) • 72-Hr Breach SLA (R.7) • 1-Yr Log Floor (R.8(3)) • 8 Live KPI Dashboards Deterministic Formulas STAGE 04 · EXEC Swift Rollout Pack • 12 Word/Excel Files • 13 Videos (26 min) • 3 Bonus Crosswalks • Counsel-Ready Drafts Zero Blank-Page Stall
90 days

Maximum grievance response period you may publish under Rule 14(3), applied strictly to grievances.

72 hours

Detailed breach report deadline to the Board under Rule 7(2)(b), following initial intimation without delay.

1 year

Minimum retention floor for personal data, traffic data, and processing logs under Rule 6(1)(e) and Rule 8(3).

No safe list

Cross-border transfers follow Section 16 negative-list notifications and Rule 15 foreign-State order checks.

  • Prefilled sector RoPA for a swift start

    Steps 03, 04, 06, 08, 09, and 10 arrive pre-populated with your industry’s processing activities, personal data categories, and DPDP Act basis.

  • Built-in Excel rubrics & decision rules

    Workbooks score readiness, enforce Indian-law dropdowns, flag 72h and 90d SLAs, and separate statutory duties from contract choices.

  • 13 training videos (26 min) included

    Short screen walkthroughs show every bracket and cell to update so your team finishes without long courses.

See the document-by-document rubrics, scoring rules, and statutory basis

Checkout

Get your sector toolkit (₹2,999 incl. GST)

Choose your sector, pay once, and get your prefilled sector RoPA, all 12 core Word & Excel templates with built-in scoring rubrics, 3 bonus tools, and all 13 training videos delivered by email right after payment.

See the full file list, add-on packs and sector preview

Or get the free Starter Self-Assessment & Duties Workbook (.xlsx) by email

₹2,999incl. GSTper sector · one time

No subscription. Single-sector licence by CynorSense Solutions Pvt. Ltd.

  • Prefilled sector RoPA + 12 core Word & Excel templates for your industry
  • Built-in Excel scoring rubrics, live formulas, dropdowns & 8 Dashboards
  • 13 step-by-step training videos (26 min) + free previews on this site
  • 3 bonus tools and the “Does this apply to you?” guide
Buy toolkit · ₹2,999

The price includes GST (₹2,999 incl. GST per selected sector toolkit). To get a GST invoice, email us your billing name, address and GSTIN. No refunds: the toolkit is digital and delivered right after payment.

Refund policy · Terms · Delivery · Contact

Your selected sector toolkit ZIP and program invitation arrive by email after payment. Check spam too.

Questions

Questions and answers

Does the DPDP Act apply to my business?

Ask two questions. Do you collect personal information digitally, such as names, phone numbers or emails, even in a spreadsheet on a laptop? Is any of it stored on a computer, phone, app or the cloud? If yes, and you process it in India or to offer goods or services to people in India, the law is built to cover you, unless an exemption applies, such as data an individual processes for a personal or domestic purpose, data the person has made public, or one of the other exemptions the Act lists. Step 01 starts with exactly these two questions.

How we arrived here

Do we need a Data Protection Officer?

A DPO is mandatory only for a business the Central Government notifies as a Significant Data Fiduciary. Every Data Fiduciary must publish the contact of someone able to answer questions about its processing. Steps 04 and 12 cover both.

How we arrived here

Do we have to do a DPIA?

The Act requires a periodic Data Protection Impact Assessment only from Significant Data Fiduciaries. The toolkit recommends one for any high-risk activity and step 08 shows how to run it.

How we arrived here

How long do we have to answer a request?

The Rules cap the grievance response period you publish at ninety days. The rights tracker applies the same 90-day target to every request type as its own choice, and turns a request red when fewer than 15 days remain.

How we arrived here

Is this legal advice?

No. It is a drafting aid that helps you prepare your own documents. Have counsel review them before you adopt them.

Free tools & method

Three free ways to start

2-minute processing map

Tick what you collect and the tools you use. See the duties and documents that match. Answers stay in your browser.

Build your map

Free starter workbook & duties list

Read all 19 legal duties in plain words or get the free Starter Self-Assessment & Duties Workbook (.xlsx) by email.

Get the free workbook

How we built the documents

See the scoring logic inside every workbook, what goes in RoPA vs. consent forms, and which provisions each rests on.

See the method
₹2,999 incl. GSTper sector · instant ZIP
Buy toolkit · ₹2,999