Template library

Ready-to-use DPDPA documents.

14 standard policies, agreements, forms and notices, curated for the DPDP Act, 2023 and DPDP Rules, 2025.

Browse the library free

Generate filled-in versions from any of your assessments

Not legal advice — review with counsel before use. Every template is an original drafted against the DPDP Act, 2023 and DPDP Rules, 2025.

Policies

Internal and public-facing policies that document how your organisation collects, protects, retains and disposes of personal data.

Cookie policy

Explains which cookies run without consent, which wait for a per-purpose yes, and how visitors change their minds later. Needed by any website or app whose cookies, SDKs or pixels can identify a person.

s.6 (1)s.7 (a)s.7 (c)s.9 (3)DPDP Rules r.3

View template →

Data protection policy

The organisation-wide operating policy: two lawful gates only, notice and consent standards, rule 6 controls with named owners, breach clocks, retention pointers and rights-handling service levels. The foundation document of a DPDPA compliance programme.

s.6s.7s.8DPDP Rules r.3DPDP Rules r.6DPDP Rules r.14

View template →

Data retention policy

An operating schedule that gives every data set a trigger, a clock, an owner and an erasure method, plus the 48-hour pre-erasure warning and the one-year log floors. Needed to honour the erasure duties in section 8 (7) of the DPDP Act and rule 8 of the Rules.

s.8 (7)-(8)DPDP Rules r.6 (1)(e)DPDP Rules r.8

View template →

Employee data protection policy

Maps each stage of the employment lifecycle to its lawful ground — section 7 (i) for core HR, consent only where refusal is genuinely free — with restrained monitoring rules and post-exit retention. For any employer processing staff data in India.

s.6s.7 (i)s.8 (2)DPDP Rules r.6

View template →

Website privacy policy

A notice-first privacy policy led by an itemised data–purpose–enablement table, with withdrawal, rights, grievance and Data Protection Board escalation paths and the 22-language option. The public notice every Indian website or app should publish.

s.5s.6 (4)s.13 (3)DPDP Rules r.3DPDP Rules r.14 (3)

View template →

Agreements

Contracts that bind processors, vendors and overseas recipients to DPDP-compliant handling of personal data.

Cross-border data transfer agreement

Binds an overseas recipient of Indian personal data to India-law continuity, foreign-State access controls and a change-of-law fallback with repatriation machinery. Use it before personal data leaves India for a group company, vendor or cloud region abroad.

s.16DPDP Rules r.15DPDP Rules r.13 (4)DPDP Rules r.6 (1)

View template →

Data processing agreement

A fiduciary–processor contract built around the DPDP Act's one-sided liability: rule 6 safeguards as contractual minimums, breach clocks, erasure with certificates, and a load-bearing indemnity. Required whenever a processor handles personal data on your behalf.

s.6 (6)s.8 (2)s.8 (7)(b)DPDP Rules r.6 (1)(f)DPDP Rules r.7DPDP Rules r.8 (3)

View template →

Third-party vendor agreement

Vendor terms that first classify the vendor — processor or independent fiduciary, per purpose — and attach the matching duty set automatically, with incident windows, audit rights and data-sized liability. For every vendor whose services touch personal data.

s.8 (2)DPDP Rules r.6 (1)DPDP Rules r.7DPDP Rules r.15

View template →

Forms

Ready-to-use forms for capturing consent and receiving data principal rights requests.

Consent form for data processing

A per-purpose consent request with an unticked decision panel and an internal capture record evidencing when, how and against which notice version consent was given. Use it whenever processing rests on consent under section 6 of the DPDP Act.

s.5s.6s.9 (1)DPDP Rules r.3DPDP Rules r.10

View template →

Data principal rights request form

An intake form covering access, correction, erasure, nomination and grievances, verified against identifiers the organisation already issued rather than fresh ID documents. Publish it as your rule 14 means of receiving Data Principal requests.

s.11s.12s.13 (3)s.14s.15DPDP Rules r.9DPDP Rules r.14

View template →

Guardian consent form (section 9)

A form for taking verifiable consent from a lawful guardian — for a child, or for a person with a disability who has a lawful guardian. Authored in-house and written in plain English, with tick-boxes for the three guardianship routes (court order, National Trust Act 1999, RPWD 2016), an evidence-attachment list, and a re-affirmation clause that treats capacity as something that can change.

s.9 (1)DPDP Rules r.10DPDP Rules r.11

View template →

Notices

Notification templates for communicating with data principals and the Data Protection Board when incidents occur.

Notice of data breach

A plain-words letter telling each affected person what happened, what it could mean for them, what you have done and what they can do, with a named responder for questions. Send it without delay to every affected Data Principal once you become aware of a personal data breach.

s.8 (6)DPDP Rules r.7 (1)DPDP Rules r.7 (2)

View template →

Plain-language accessible consent notice

A consent notice authored in-house, written to read plainly (it grades "good" on our own readability scorer) and structured for screen readers: single-level headings, no tables, short sentences, and the minimised functional-support question instead of asking about disability. Use it where section 5 and Rule 3 demand a notice that is understandable on its own.

s.5s.6 (1)DPDP Rules r.3

View template →

Assessments

Structured assessments for evaluating privacy risk before and during new projects or processing activities.

Privacy impact assessment

A working assessment with a risk register at its heart, a DPDPA-specific legal-basis check and the rule 13 (3) algorithmic due-diligence module. Mandatory every twelve months for Significant Data Fiduciaries; a strong voluntary control for everyone else.

s.10 (2)(c)DPDP Rules r.13

View template →