DPDPA sector toolkit
DPDPA Toolkit for Data Centres, Cloud, Colocation & Managed IT
20 Word and Excel files (11 Excel, 9 Word), including the 12 core documents and 3 bonus tools, prefilled for Data Centres & Cloud. Each one is listed below with page 1 and its sections.
- 20 files you can edit in Word and Excel
- Delivered by email after payment
- UPI, card or netbanking through Razorpay
Three of the 20. Open one to see its full outline.
Word17 KB
Step 04 · Enterprise Data Protection Policy (17 Statutory Sections)
- 1. Purpose & Scope
- 2. Key Definitions
- 3. Data Protection Principles
- 4. Governance & Roles
- + 4 more
Excel11 KB
Step 01 · DPDPA Reality Check & 19-Duty Self-Assessment Workbook
- Instructions
- SDF Risk Factors
- Obligations Checklist
- Dashboard
Excel9 KB
Step 02 · DPDPA Statutory Compliance Timeline & Countdown Tracker
- Instructions
- Timeline
Prefilled for Data Centres & Cloud
What is already filled in for your sector
Who this pack is for: Cloud, VPS, colocation, and managed-IT providers act mainly as Data Processors for client workloads (bound by their contracts with client Data Fiduciaries (S.8(2)), which must carry security safeguards (Rule 6(1)(f)), and keep logs for 1 year (Rule 6(1)(e))), while acting as Data Fiduciaries for their own B2B customer accounts, billing, NOC/facility biometric & CCTV access, and engineers. Covers both roles.
The record of processing starts with these 5 activities. You edit them and add your own.
- Customer account provisioning & authorized technical contacts
- Data centre physical access control, visitor logs & CCTV
- NOC/SOC security monitoring, firewall & traffic logs
- Enterprise colocation/cloud contracts, SLA credits & GST billing
- NOC engineers, facility staff & contractor HR records
One row as it appears in the record:
| ID | Activity | Personal data | Lawful basis | How long |
|---|---|---|---|---|
| ACT-01 | Customer account provisioning & authorized technical contacts | Admin name, work email, mobile, SSH/API key fingerprint, org role | Consent (S.6) | Contract duration + 1-year minimum log retention (Rule 8(3)) |
What you get
All 20 files in this toolkit
Registers, logs and trackers9
-
-
Step 03 · Record of Processing Activities (RoPA) & Dashboard WorkbookRoPA Tracker (Record of Processing Activities) This is the foundational artefact for DPDPA compliance.
-
Step 05c · Consent & Parent-Guardian Verification Ledger WorkbookConsent Record Purpose: keep the evidence you need to show that a notice was given and consent was given for each purpose, that each withdrawal was acted on, and that a…
-
Step 06 · Data Retention & Rule 8 Erasure Countdown ScheduleData Retention Schedule Purpose: operationalise the Act S.8(7)-(8) erasure-when-purpose-served duty and Rule 8's specific retention-period mechanics into one live…
-
Step 07b · Data Principal Rights & 90-Day Grievance SLA Tracker (Rule 14(3))Rights Request Tracker Log every Rights Request Form (rights-request-form.docx) submission here the day it's received.
-
-
Step 10 · Section 16 Cross-Border Data Transfer & Rule 15 RegisterCross-Border Data Transfer Register & Assessment THE MODEL: Act S.16(1) lets the Central Government, by notification, restrict the transfer of personal data to a…
-
Personal Data Breach Register & Board-report (72-hour) Deadline CalculatorBreach Register Log every suspected or confirmed personal data breach here, however small - Rule 7 has no 'minor incident' exemption.
-
Assessments and checklists2
-
Step 01 · DPDPA Reality Check & 19-Duty Self-Assessment Workbook
DPDPA Reality Check - Self-Assessment Purpose: test whether a website notice plus a consent flow is enough.
-
Plans, procedures and forms6
-
Step 05a · Section 5 & Rule 3 Itemised Privacy & Consent NoticeUse it for processing that relies on consent — the rows in your RoPA with Legal Basis = Consent (S.6), e.g.
-
-
-
-
-
Policies and standards2
-
Step 04 · Enterprise Data Protection Policy (17 Statutory Sections)
This Policy sets out how [Organisation Name] (“we”, “the organisation”) collects, uses, stores, shares, and deletes personal data, in accordance with the Digital…
-
Briefings and other documents1
-
Bonus Tool #1 (Step 12) · CFO & Board Cost-of-Inaction & Penalty Ceiling BriefDPDPA is routinely filed next to “general compliance insurance” in budget conversations.
₹2,999 incl. GST
How the files fit together
A suggested order
Our suggestion, not a requirement of the standard or the law.
- 1
Find the gaps
Start with the assessment workbooks to see where you stand.
2 files: Step 01 · DPDPA Reality Check & 19-Duty Self-Assessment Workbook, Step 09a · Data Processor & Vendor 38-Point Risk Assessment Workbook
- 2
Plan the work and the response
Use the plans, procedures and forms to set owners, dates and the steps to follow.
6 files: Step 05a · Section 5 & Rule 3 Itemised Privacy & Consent Notice, Step 05b · Children's Verifiable Parental Consent Procedure (Sec 9 & Rule 10), Step 07a · Data Principal Rights & Grievance Request Form (Secs 11–14), Step 09b · Section 8(2) Data Processing Agreement (DPA · 15 Clauses) and more
- 3
Approve the policies
Edit the policies to match how you work, then get them approved.
2 files: Step 04 · Enterprise Data Protection Policy (17 Statutory Sections), Bonus Tool #2 (Step 12) · DPDPA Governance Roles in a Complex Org Chart
- 4
Keep the records
Keep the registers and logs up to date as evidence for an audit or a review.
9 files: Step 02 · DPDPA Statutory Compliance Timeline & Countdown Tracker, Step 03 · Record of Processing Activities (RoPA) & Dashboard Workbook, Step 05c · Consent & Parent-Guardian Verification Ledger Workbook, Step 06 · Data Retention & Rule 8 Erasure Countdown Schedule and more
- 5
Brief your leadership
Use the briefing documents to explain the work to decision makers.
1 file: Bonus Tool #1 (Step 12) · CFO & Board Cost-of-Inaction & Penalty Ceiling Brief
Questions
Before you buy
What exactly do I get?
20 editable files (11 Excel, 9 Word). Every file is listed on this page with its file name, size and number of sections.
How are the files delivered?
Digitally, after payment is confirmed. We email the steps and your files or program invitation to the address you give at checkout. Nothing is shipped. The delivery policy has the details.
How do I pay?
Through Razorpay, by UPI, card or netbanking. It is a one-time payment with no subscription.
Is GST included?
Yes. The price includes GST. To get a GST invoice, email [email protected] with your billing name, address and GSTIN.
Can I use the templates for my clients?
The licence covers one organisation in the sector you buy: your own, or one named client if you are a CA, CS, lawyer or compliance consultant buying for that client. You may adapt the documents and publish the completed ones, such as your privacy notice. Each further client or sector needs its own licence, or the All 8 Sectors Master & Practitioner Pack. Selling or publishing the blank templates as a template product is not allowed. See section 3 of the terms of sale.
Are these official documents of the standard body or regulator?
No. They are templates supplied by CynorSense Solutions Pvt. Ltd. They are not issued or endorsed by any standard body or regulator, and they are not legal advice. Using them does not by itself make an organisation compliant or certified.
Can I get a refund?
The files are delivered digitally, so we do not give refunds. We return duplicate or wrong charges and fix files that do not open. This does not limit any right the law gives you if a file is defective or not as described. See the refund policy.