Security & AccessPolicyFeatured
Access Control Policy
Guidance on the legal requirements, security safeguards and organisational considerations relevant to drafting an access control policy under the DPDPA.
DPDPA · Drafting Guides
Guides to Drafting DPDPA Policies
100+ detailed template guides that explain how to develop privacy, security and compliance policies in accordance with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
These resources are not ready-to-use templates. They are designed to guide you through the legal and practical considerations involved in drafting each policy for your organisation.
Find the right drafting guide
Describe what your organisation is doing, what data is involved and what document you need. You can paste a detailed 50–100 word situation. The search reads the complete request and identifies the guide that most closely addresses it.
Describe the situation
Include the people, data, activity, purpose and problem in your own words.
The request is dissected
Your situation is split into its separate needs, and the best guide is found for each.
Open the best guides
Each need shows its guide, why it matched, and the related policy, procedure or contract.
Featured drafting guides
Security & AccessPolicyFeatured
Information Technology and Cyber Security Policy
Guidance on drafting an IT and cyber security framework addressing the technical and organisational safeguards required for personal data.
Privacy DocumentsNotice / consent formFeatured
Privacy Notices for Five Categories
A drafting guide explaining how privacy notices can be structured for employees, potential recruits, trainees and interns, customers and vendors.
All drafting guides
Security & AccessPolicy
Acceptable Use Policy
Guidance on the considerations for drafting an acceptable use policy governing the handling of personal data, systems, devices and organisational resources.
Incident & RetentionPolicy
Incident Response Policy
Guidance on drafting an incident response framework addressing identification, escalation, response and data breach obligations under the DPDPA.
Incident & RetentionPolicy
Data Retention and Disposal Policy
Guidance on the legal and practical considerations for drafting rules on retention, review and secure disposal of personal data.
Privacy DocumentsNotice / consent form
Consent Forms for Five Categories
A drafting guide explaining how consent documentation can be structured for different categories of Data Principals and how withdrawal and related mechanisms should be addressed.
AuthenticationPolicy
Password and Authentication Policy
Guidance on drafting authentication and credential-management requirements as part of an organisation's personal data security framework.
Remote WorkPolicy
Remote and Work From Home Policy
Guidance on drafting security and privacy requirements for handling personal data while working remotely or from home.
Privacy DocumentsPolicy
Privacy Governance and Accountability Policy
Guidance and a model policy for establishing privacy governance, management responsibility, evidence of compliance, periodic assessment and Significant Data Fiduciary accountability under the DPDPA.
Privacy DocumentsPolicy
Consent and Preference Management Policy
Guidance and a model policy for obtaining, recording, managing and withdrawing valid consent and preferences, including Consent Manager interactions and notice alignment.
Privacy DocumentsPolicy
Data Minimisation and Collection Policy
Guidance and a model policy for limiting personal-data collection to specified purposes, reviewing collection fields and erasing data when its purpose is no longer served.
Incident & RetentionPolicy
Records Management and Recordkeeping Policy
Guidance and a model policy for maintaining reliable privacy and security records, including consent evidence, safeguards, breach records, erasure and audit documentation.
Privacy DocumentsPolicy
Personal Data Quality and Accuracy Policy
Guidance and a model policy for keeping personal data complete, accurate and consistent where it is used for decisions or disclosed, and for handling correction and updating requests.
Security & AccessPolicy
Network Sharing and Secure Communications Policy
Guidance and a model policy for secure network use, data sharing and communications through encryption, access controls, monitoring and incident-ready records.
Remote WorkPolicy
Mobile, BYOD and Personal Device Policy
Guidance and a model policy for handling personal data on mobile and personally owned devices, including enrolment, security controls, remote erasure and overseas access.
Security & AccessPolicy
Physical Personal Data and Removable Media Policy
Guidance and a model policy for protecting paper records and removable media throughout collection, transport, storage, access, retention and secure disposal.
Privacy DocumentsPolicy
Privacy Training and Awareness Policy
Guidance and a model policy for role-based privacy and security learning, induction, refresher training, awareness campaigns and auditable effectiveness reviews.
Privacy DocumentsPolicy
Privacy Risk and Exception Management Policy
Guidance and a model policy for identifying, assessing, treating, accepting and monitoring privacy risks and time-bound exceptions to established controls.
Privacy DocumentsPolicy
Data Processing, Purpose Limitation and Lawful Basis Policy
Guidance and a model policy for defining lawful purposes, limiting processing to those purposes and choosing between consent and legitimate uses under the DPDPA.
Incident & RetentionPolicy
Data Inventory, Data Mapping and Processing Records Policy
Guidance and a model policy for building and maintaining a personal data inventory, data flow maps and processing records that evidence compliance.
Security & AccessPolicy
Data Processor and Third Party Data Governance Policy
Guidance and a model policy for engaging processors and third parties under valid contracts, with due diligence, oversight, breach cooperation and exit obligations.
Privacy DocumentsPolicy
Data Principal Rights and Grievance Redressal Policy
Guidance and a model policy for receiving, verifying and answering rights requests and for running a grievance redressal mechanism within the prescribed periods.
Privacy DocumentsPolicy
Privacy Notice and Transparency Management Policy
Guidance and a model policy for drafting, publishing, versioning and updating privacy notices so every notice stays clear, complete and independent of other documents.
Privacy DocumentsPolicy
Children Personal Data and Verifiable Consent Policy
Guidance and a model policy for age assurance, verifiable parental consent, the prohibition on tracking and targeted advertising, and the exemptions available for children data.
Privacy DocumentsPolicy
Data Transfer, Disclosure and Cross Border Transfer Policy
Guidance and a model policy for approving disclosures, transfers outside India and localisation requirements, with records of every transfer decision.
Privacy DocumentsPolicy
Privacy by Design, Impact Assessment and Significant Data Fiduciary Governance
Guidance and a model policy for embedding privacy into projects, running data protection impact assessments and meeting Significant Data Fiduciary obligations.
Security & AccessPolicy
Personal Data Classification, Handling and Data Loss Prevention Policy
Guidance and a model policy for classifying personal data, setting handling rules for each class and preventing loss through encryption, masking and monitoring.
AI Usage PolicyPolicy
Artificial Intelligence, Analytics and Automated Processing Policy
Guidance and a model policy for using personal data in artificial intelligence, analytics, model training and automated processing, including algorithmic due diligence.
Privacy DocumentsPolicy
Privacy in Procurement and New Tool Approval Policy
Drafting guide and model policy for privacy review before buying software or approving a new tool, covering vendor due diligence, contract clauses, transfer checks and algorithmic due diligence.
Privacy DocumentsPolicy
Employee and Human Resources Personal Data Privacy Policy
Drafting guide and model policy for employee and HR personal data, covering the employment legitimate use, records, safeguards, rights requests and retention across the employment lifecycle.
Privacy DocumentsPolicy
Recruitment and Applicant Personal Data Privacy Policy
Drafting guide and model policy for recruitment and applicant data, covering notice and consent at application, accuracy where data drives a decision, screening, and erasure of unsuccessful applicants.
Privacy DocumentsPolicy
Direct Marketing and Marketing Communications Privacy Policy
Drafting guide and model policy for direct marketing, covering consent capture for marketing, preference and withdrawal handling, suppression lists and the ban on targeted advertising to children.
Privacy DocumentsPolicy
Cookies, Tracking and Online Advertising Privacy Policy
Drafting guide and model policy for cookies and online tracking, covering the cookie inventory, consent banner design, tag governance, advertising partners and transfers.
Privacy DocumentsPolicy
CCTV, Video Surveillance and Recording Policy
Drafting guide and model policy for CCTV and video surveillance, covering lawful purpose, signage and notice, camera siting, access to footage, retention, and requests for copies.
Privacy DocumentsPolicy
Biometric and Identity Verification Privacy Policy
Drafting guide and model policy for biometric and identity verification processing, covering necessity testing, consent, template security, fallback options, accuracy and erasure.
Privacy DocumentsPolicy
Customer and CRM Personal Data Privacy Policy
Drafting guide and model policy for customer and CRM data, covering notice and consent at onboarding, CRM field governance, service communications, rights requests and grievance redressal.
Privacy DocumentsPolicy
Research, Statistics and Secondary Use Privacy Policy
Drafting guide and model policy for research, statistical and secondary use of personal data, covering the research exemption, Second Schedule standards, de-identification and approval workflow.
Privacy DocumentsPolicy
Call Recording and Communications Monitoring Privacy Policy
Drafting guide and model policy for call recording and monitoring of communications, covering announcements and notice, quality monitoring, access controls, retention and access requests.
Privacy DocumentsSOP / procedure
Data Principal Rights Request Handling SOP
Drafting guide and model standard operating procedure for handling Data Principal rights requests end to end, from recognising and registering a request through identity verification, search, redaction, correction, erasure, response and grievance.
Privacy DocumentsSOP / procedure
Consent Capture, Withdrawal and Preference Change SOP
Drafting guide and model procedure for capturing valid consent, recording it as a consent artefact, distributing the consent state across systems, and processing withdrawal, partial withdrawal and preference changes, including Consent Managers and children.
Security & AccessSOP / procedure
Vendor Onboarding, Review and Offboarding SOP
Drafting guide and model procedure for the full vendor lifecycle: role determination, risk tiering, assessment, the contract gate, onboarding, the Vendor Register, monitoring, periodic review, vendor incidents, offboarding and vendors found without approval.
DPASOP / procedure
DPA Review and Contract Execution SOP
Drafting guide and model procedure for reviewing and executing data processing agreements, separate from vendor onboarding: classification, clause tiering, the required clause set, breach, rights assistance, deletion, audit and location terms, approval, repository and remediation of existing contracts.
Privacy DocumentsSOP / procedure
DPIA and Privacy Risk Assessment SOP
Drafting guide and model procedure for Data Protection Impact Assessments and privacy risk assessments: gates and screening, describing the processing, lawfulness, necessity, risks to Data Principals, rating, security and algorithmic limbs, treatment, acceptance and clearance.
Privacy DocumentsSOP / procedure
New Processing and Material Change Review SOP
Drafting guide and model procedure for reviewing new processing and material changes before they go live, and how this differs from an impact assessment: submission, screening, triage, purpose, notice, recipients, retention, security, escalation and mandatory record updates.
Privacy DocumentsSOP / procedure
Data Sharing and Disclosure Request SOP
Drafting guide and model procedure for deciding whether personal data may be disclosed to another party: intake, lawful basis, notice check, recipient, minimisation, accuracy, approval, transfer terms, research purposes, the Disclosure Register and internal sharing.
Incident & RetentionSOP / procedure
Deletion, Disposal and Deletion Evidence SOP
Drafting guide and model procedure for erasure and disposal with provable evidence: retention schedule and floor, inactivity position, the 48 hour intimation before erasure, the location list, backups, Data Processors, erasure records, legal holds and physical media.
Incident & RetentionSOP / procedure
Legal Hold and Suspension of Deletion SOP
Drafting guide and model procedure for legal holds that suspend deletion: triggers, scoping, hold notices, acknowledgement, technical suppression, processors, security of held material, interaction with rights requests, review, release and authority preservation.
Incident & RetentionSOP / procedure
Personal Data Breach Notification SOP
Drafting guide and model procedure for personal data breach notification, keeping the Data Principal and Board streams separate: reporting, triage, containment, breach determination, intimation to each affected person, initial and 72 hour detailed Board submissions, processors and closure.
Privacy DocumentsSOP / procedure
Government, Law Enforcement and Regulatory Request SOP
Drafting guide and model procedure for responding to police, government and regulator demands for personal data, preventing both over disclosure and unlawful refusal: front line response, verifying the requester, validating the power, scoping, approval, release, the register and foreign requests.
Incident & RetentionSOP / procedure
ROPA and Data Inventory Maintenance SOP
Drafting guide and model procedure for keeping the record of processing and data inventory accurate: field set, ownership, maintenance triggers, Recipient Register, search location list, retention schedule, discovering unrecorded processing, reconciliation and verification.
Privacy DocumentsSOP / procedure
Data Owner and Business Process Annual Review SOP
Drafting guide and model procedure for the annual review in which data owners attest to their business processes, and why it is not an audit: the cycle, review pack, attestation questions, evidence, access review, sign off, sampling and escalation.
Privacy DocumentsSOP / procedure
Privacy Audit and Self Assessment SOP
Drafting guide and model procedure for conducting privacy audits and self assessments: the audit universe and plan, engagement scoping, test programme, fieldwork, findings and severity, reporting, management response, follow up and closure.
Incident & RetentionSOP / procedure
Post Incident Privacy Review and Corrective Action SOP
Drafting guide and model procedure for reviewing an incident after it closes: independent commissioning, timeline, immediate and systemic causes, privacy questions, review of the response, corrective and preventive action, processor actions and verification of effectiveness.
Privacy DocumentsCharter / RACI
Privacy Governance Charter and Committee Terms of Reference
Drafting guide and model charter establishing privacy governance: the governing body, Privacy Governance Committee, its decision rights, the Privacy Working Group, risk appetite and escalation thresholds, and the Data Protection Officer and privacy function.
Privacy DocumentsFramework
DPDP Compliance and Control Framework
Drafting guide and model framework translating DPDP obligations into a tested control set: the control record, coverage, control families, the control set itself, testing, failure, remediation, reporting and maintenance.
Privacy DocumentsCharter / RACI
Privacy RACI and Ownership Matrix
Drafting guide and model matrix allocating who is responsible, accountable, consulted and informed for each privacy obligation, with a register of named individuals, deputies, acknowledgement, completeness checks and maintenance.
Privacy DocumentsFramework
Privacy Audit and Assurance Framework
Drafting guide and model framework for privacy assurance across three lines: risk tiering, independence and competence, the assurance universe and plan, the statutory audit cycle for a Significant Data Fiduciary, Board reporting and due diligence on algorithmic software.
Privacy DocumentsFramework
Privacy Maturity Assessment Framework
Drafting guide and model framework for measuring privacy maturity on two axes across twelve domains, with a defined maturity scale, gates, readiness for Significant Data Fiduciary notification, assessment conduct, targets and improvement.
Privacy DocumentsFramework
Privacy Metrics and Management Reporting Framework
Drafting guide and model framework for privacy metrics and management reporting: classifying measures, ownership, thresholds and consequences, the metric set, data quality, stability of the set and reporting to management.
Security & AccessQuestionnaire
Vendor Privacy and Security Due Diligence Questionnaire
Drafting guide and model questionnaire for vendor privacy and security due diligence: question design rules, tiering by supplier risk, scoring and what the answers actually decide.
Privacy DocumentsQuestionnaire
Business Unit Privacy Assessment Questionnaire
Drafting guide and model questionnaire for assessing how a business unit handles personal data, written for non specialists, covering purposes, notices, consent, accuracy, retention, recipients, rights and children.
Privacy DocumentsQuestionnaire
DPIA Screening Questionnaire
Drafting guide and model screening questionnaire that decides whether processing needs a full impact assessment, using mandatory triggers rather than scores, including children, cross border transfer and Significant Data Fiduciary triggers.
Privacy DocumentsQuestionnaire
New Product and Process Privacy Questionnaire
Drafting guide and model questionnaire for building privacy into new products and processes, organised by stage gates so the right questions are asked at the right time, and distinct from DPIA screening.
Privacy DocumentsQuestionnaire
Data Sharing Assessment Questionnaire
Drafting guide and model questionnaire for assessing a proposed data sharing arrangement, starting with whether the recipient is a processor or a fiduciary, then lawful basis, transfers, research exemptions and recipient disclosure.
DPAAgreement / clauses
DPDP Data Processing Agreement
Drafting guide and model Data Processing Agreement under the DPDP Act: instructions, personnel, sub processors, location, security safeguards, rights assistance, breach, return and deletion, with negotiation guidance and fallback positions.
DPAAgreement / clauses
Data Sharing Agreement
Drafting guide and model Data Sharing Agreement between Data Fiduciaries: party status, lawful basis and scope, transparency, children, accuracy, rights, security, breach, location, onward sharing and authorities, with negotiation fallbacks.
DPAAgreement / clauses
Privacy and Data Protection Contract Clause Library
Drafting guide and model clause library for privacy and data protection terms, explaining how a library differs from a template and using three tiers of clauses for different contract risk levels.
Incident & RetentionRegister / catalogue
Master Privacy Register and Evidence Catalogue
Drafting guide and model catalogue of every privacy register and the evidence the organisation must be able to produce: ownership, systems, retention, interaction with erasure, retrievability, and production to the Board or an auditor.
Privacy DocumentsRole SOP
Designated Privacy Personnel Role SOP
Drafting guide and model role SOP for the person designated to answer Data Principal questions, and why the role is not a European Data Protection Officer: appointment, publication, channels, identity verification, scope, access, correction and other rights work.
Privacy DocumentsRole SOP
HR Head Privacy Role SOP
Drafting guide and model role SOP for the Head of Human Resources across the employee lifecycle: lawful basis and HR data map, notices, consent for optional purposes, recruitment, children, onboarding and minimisation.
Security & AccessRole SOP
IT Head Privacy Role SOP
Drafting guide and model role SOP for the Head of Information Technology: system inventory and shadow IT, access control, encryption and masking, logging and monitoring, breach detection, backups, retention and erasure, and media disposal.
Security & AccessRole SOP
Vendor Management Head Privacy Role SOP
Drafting guide and model role SOP for the Head of Vendor Management as gatekeeper: intake gate, classification, tiering and due diligence, contract, onboarding, recipient register, locations and sub processors.
Privacy DocumentsRole SOP
Marketing Head Privacy Role SOP
Drafting guide and model role SOP for the Head of Marketing, where the consent model bites hardest: basis for each activity, notices and collection points, consent design, proof of consent, withdrawal and suppression, and acquired or public data.
Privacy DocumentsPublic website document
Website Privacy Policy under the DPDP Act
Drafting guide and model website privacy policy developed from a line-by-line review of a connected-device app policy. Explains the data mapping and client fact-finding needed before drafting, the distinction between a public policy and a standalone consent notice, and how to describe actual processing, sharing, AI features, retention and Indian rights. The model contains placeholders that must be completed and checked against live practices before publication.
Privacy DocumentsPublic website document
Terms of Service for Users in India
Drafting guide and model terms for digital services offered to consumers in India, including connected-device apps, paid features, subscriptions and AI tools. Covers affirmative contract acceptance, separate privacy and payment choices, mandatory consumer protections, cancellations, refunds, unfair terms, intellectual property and grievances. Includes a client questionnaire and model clauses to adapt to confirmed practices; distinguishes future-effective e-commerce amendments from existing duties and is the companion to the Website Privacy Policy guide.