Template library

Data protection policy

The organisation-wide operating policy: two lawful gates only, notice and consent standards, rule 6 controls with named owners, breach clocks, retention pointers and rights-handling service levels. The foundation document of a DPDPA compliance programme.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to read and generate after a free sign-in. The first clauses are open below.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

What it covers

The placeholders this template asks you to fill in.

[Organisation Name][Board Review Frequency][Accountable Executive Role][Privacy Lead Role][Grievance Contact Name or Role][If notified as a Significant Data Fiduciary, appoint an India-based Data Protection Officer responsible to the board and substitute them here.][Encryption Control][Encryption Control Owner][Access Control Description][Access Control Owner][Logging and Monitoring Control][Logging Control Owner][Backup Control][Backup Control Owner][Log Retention Control][Log Retention Owner][Additional Measures][Additional Measures Owner][Incident Reporting Channel][Security Lead Role][Acknowledgment Target][Rights Response Target][Training Frequency]

The document

The opening clauses — open to everyone

Why this policy exists and who must follow it

This policy is how [Organisation Name] complies with the DPDP Act, 2023 and the DPDP Rules, 2025. It binds every employee, contractor and consultant, and it covers all digital personal data we hold, including data collected on paper and later digitised. The stakes are concrete: failed security safeguards alone carry penalties of up to ₹250 crore, and knowingly breaching this policy is a disciplinary matter.

Accountability map

The board owns data protection risk and reviews it [Board Review Frequency].

[Accountable Executive Role] is the accountable executive for this policy.

[Privacy Lead Role] runs the privacy programme day to day and owns the registers, the training plan and this document.

Every system or process touching personal data has a named owner recorded in the processing register.

[Grievance Contact Name or Role] is our published contact under section 8 (9) of the Act, able to answer Data Principals' questions about their data; these details appear on our website and in every rights response. [If notified as a Significant Data Fiduciary, appoint an India-based Data Protection Officer responsible to the board and substitute them here.]