DPDPA Support documents: which of the 12 apply to you
Every file in the toolkit, by step. Seven make up the core path; the rest depend on how your business uses personal data.
The core path: for every business using the toolkit
Seven steps, each building on the one before. Each step page ends with the legal basis behind it.
Check whether the Act applies to you and which DPDPA duties you already cover.
- Word00-does-this-apply-to-you.docx
- Exceldpdpa-reality-check-self-assessment.xlsx
Turn your gaps into dated tasks, most due 13 May 2027.
- Excelcompliance-timeline.xlsx
Your record of every way you use personal data. Most other documents build on it.
- Excelropa-tracker.xlsx
The rules you commit to, pointing to the document that carries out each one.
- Worddata-protection-policy.docx
Erase when consent is withdrawn or the purpose ends, unless a law requires keeping it; keep logs at least a year.
- Exceldata-retention-schedule.xlsx
Publish how people can ask; answer grievances within the period you publish, 90 days at most.
- Wordrights-request-form.docx
- Excelrights-request-tracker.xlsx
Tell the Board and each affected person about a breach.
- Excelbreach-register.xlsx
- Wordbreach-notification-to-board.docx
- Wordbreach-notification-to-data-principal.docx
Only if this applies to your business
Your RoPA from step 03 tells you which of these you need.
If any activity relies on consent (Legal Basis = Consent). Activities on one of the legitimate uses the Act lists do not ask for consent.
- Wordconsent-notice-template.docx
If any outside company processes personal data for you. A processor that helps you offer goods or services may act only under a valid contract.
- Excelvendor-risk-assessment.xlsx
The contract itself, for each such vendor.
- Worddata-processing-agreement-template.docx
If any personal data goes to a vendor or system outside India.
- Excelcross-border-transfer-register.xlsx
Mandatory only for notified Significant Data Fiduciaries. The toolkit recommends it for any activity your RoPA rates high risk.
- Exceldpia-template-risk-register.xlsx
Optional bonus tools
For the conversations around compliance.
A budget brief, a roles guide for a flat org chart, and a crosswalk to five frameworks.
- Wordcfo-cost-of-inaction-onepager.docx
- Worddpdpa-roles-in-a-hairball-org.docx
- Exceldpdpa-multi-framework-crosswalk.xlsx
Children’s data has no separate document: the RoPA flags it (column M, step 03) and the policy covers it (step 04).
Get every document
₹29,999 incl. GST One time, no subscription.