Skip to content
DPDPA Workflow

Template library

Cookie policy

Explains which cookies run without consent, which wait for a per-purpose yes, and how visitors change their minds later. Needed by any website or app whose cookies, SDKs or pixels can identify a person.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to read and generate after a free sign-in. The first clauses are open below.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

Category

Policies

Legal basis
s.6 (1)s.7 (a)s.7 (c)s.9 (3)DPDP Rules r.3
ReadabilityReadable with work550 words · ~3 min read · reading ease 60/100Scored by the same checker the consent module uses on your own notices.

What it covers

The placeholders this template asks you to fill in.

[Organisation Name][Website or App Name][Essential Cookie Name][What the essential cookie does][Data items the essential cookie touches][Essential Cookie Lifespan][Optional Purpose, e.g. usage analytics][Cookie names and provider][Data items collected][Cookie Lifespan][What consent to this purpose enables][Cookie Settings Control Name][Third-Party Provider Names][Contact Person Name][Contact Email][Policy Version][Effective Date]

The document

The opening clauses — open to everyone

What this policy covers

This policy explains the small pieces of code and storage — cookies, software development kits, pixels and browser local storage — that [Organisation Name] uses on [Website or App Name], and the choices you have about them. Where any of these can identify you, the data they handle is digital personal data under the DPDP Act, 2023, and this policy is part of how we meet that law.

Cookies we cannot run the service without

A few cookies are strictly needed to deliver what you asked for: keeping you signed in, remembering a cart, balancing load, keeping the site secure. For these we rely on section 7 (a) of the DPDP Act (you voluntarily requested the service they make possible) or section 7 (c) (a legal duty on us, such as security log requirements). We do not ask consent for them, but we still list them so nothing is hidden:

Cookie or tool
What it does
Data it touches
How long it lasts
[Essential Cookie Name]
[What the essential cookie does]
[Data items the essential cookie touches]
[Essential Cookie Lifespan]
Sign in to continue

“Cookie policy” is free to read — after a quick sign-in.

A free Google sign-in is all it takes. No card, no trial clock.

What you unlock

The complete template text

Word (.docx) downloads

The guided generate this document form

Your Document locker — every generated version, re-downloadable any time

Why we ask

Anonymous bulk scraping and automated generation would degrade the library for everyone.

Signing in also lets us save your generated documents to your own workspace.

Sign-in is Google-only for now.

Generate

Sign in to read the full text, download it, or generate a filled-in version.

← All templates
Related templates

Data protection policy

The organisation-wide operating policy: two lawful gates only, notice and consent standards, rule 6 controls with named owners, breach clock…View template →

Data retention policy

An operating schedule that gives every data set a trigger, a clock, an owner and an erasure method, plus the 48-hour pre-erasure warning and…View template →

Employee data protection policy

Maps each stage of the employment lifecycle to its lawful ground — section 7 (i) for core HR, consent only where refusal is genuinely free —…View template →

Where next

See it operationalised: the Consent & notice module →
How the workspace turns this document into an ongoing, tracked duty.
Compare with: Data protection policy →
Another policies template in the library.
Compare with: Data retention policy →
Another policies template in the library.
Check whether the Act applies to you →
28 questions, no account.