Security & AccessFeatured
Access Control Policy
Guidance on the legal requirements, security safeguards and organisational considerations relevant to drafting an access control policy under the DPDPA.
DPDPA · Drafting Guides
Guides to Drafting DPDPA Policies
Practitioner-focused drafting guides that explain how to develop privacy, security and compliance policies in accordance with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
These resources are not ready-to-use templates. They are designed to guide you through the legal and practical considerations involved in drafting each policy for your organisation.
Browse the collection
Explore drafting guides that explain what each policy should address, the relevant requirements under the DPDPA and DPDP Rules, and the practical considerations for developing a policy suited to your organisation.
Featured drafting guides
Security & AccessFeatured
Information Technology and Cyber Security Policy
Guidance on drafting an IT and cyber security framework addressing the technical and organisational safeguards required for personal data.
Privacy DocumentsFeatured
Privacy Notices for Five Categories
A drafting guide explaining how privacy notices can be structured for employees, potential recruits, trainees and interns, customers and vendors.
All drafting guides
Security & Access
Acceptable Use Policy
Guidance on the considerations for drafting an acceptable use policy governing the handling of personal data, systems, devices and organisational resources.
Incident & Retention
Incident Response Policy
Guidance on drafting an incident response framework addressing identification, escalation, response and data breach obligations under the DPDPA.
Incident & Retention
Data Retention and Disposal Policy
Guidance on the legal and practical considerations for drafting rules on retention, review and secure disposal of personal data.
Privacy Documents
Consent Forms for Five Categories
A drafting guide explaining how consent documentation can be structured for different categories of Data Principals and how withdrawal and related mechanisms should be addressed.
Authentication
Password and Authentication Policy
Guidance on drafting authentication and credential-management requirements as part of an organisation's personal data security framework.
Remote Work
Remote and Work From Home Policy
Guidance on drafting security and privacy requirements for handling personal data while working remotely or from home.