Templates

What each document must contain.

The privacy notice, the processor agreement, the grievance policy, the consent request, the breach letters, the retention policy and the rights response: what the Act and the Rules require in each, a sample structure, and what a checklist misses.

DPDP privacy notice: what it must containTemplate · Notice: A notice under Section 5 must accompany or precede every request for consent, be understandable on its own, itemise the personal data and state the specified purpose, and give the specific means to withdraw consent, exercise rights and complain to the Board. Rule 3 sets the contents; a policy written before 2025 rarely meets them.
Data Processing Agreement under Section 8(2)Template · Processor agreement: Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract, and Rule 6(1)(f) requires that contract to bind the Processor to reasonable security safeguards. The agreement is the only instrument that carries the Fiduciary’s duties across to the vendor, so it has to say what the vendor may do, how it secures the data, what happens on a breach, and what happens at the end.
Grievance redressal policy under the DPDP ActTemplate · Grievance policy: The Act sets three separate duties: publish the contact of a person who can answer questions about processing (Section 8(9)), establish an effective grievance redressal mechanism (Section 8(10)), and respond within the period you publish, at most ninety days (Section 13, Rule 14). The policy is where all three are written down and made visible.
Consent request wording: banner, form and recordTemplate · Consent request: Valid consent under Section 6 is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, before processing. The request is the moment all of that is tested: what the person sees, what they can refuse, what fires before they act, and what you keep as proof under Section 6(10).
Breach notification to affected individualsTemplate · Breach letter: On becoming aware of a personal data breach, Rule 7(1) requires the Data Fiduciary to intimate each affected Data Principal without delay, in a concise, clear and plain manner, through their registered channel: what happened, the likely consequences, what has been done, what they can do to protect themselves, and who to contact.
Breach report to the Data Protection BoardTemplate · Board report: Rule 7(2) requires two things to the Board: an intimation on becoming aware of the breach, without delay, and within seventy-two hours, or a longer period only if the Board allows on a written request, a detailed report with the findings, the remedial measures, the person responsible, and confirmation of what affected individuals were told.
Retention and erasure policy under Section 8(7)Template · Retention policy: Section 8(7) requires a Data Fiduciary, and its Processors, to erase personal data once consent is withdrawn or the specified purpose is no longer served, unless another law requires retention. Rule 8 fixes the period for the Third Schedule classes at three years from the last approach and adds a forty-eight hour warning before erasure. The policy is where each purpose gets a period and each period gets an erasure job.
Responding to an access, correction or erasure requestTemplate · Rights response: A Data Principal may ask for a summary of their personal data and the processing, the identities of everyone it was shared with, correction or erasure. Rule 14 requires the means of asking to be published, the request to be verified, and a response within the period you publish, at most ninety days. Every response must repeat the Section 8(9) contact.