BuildWrightFor Builders
Documents

DPDP Act documents for a business that holds personal data

What documents does a small business need for the DPDP Act and Rules?

Six documents for a business that holds personal data, filled in with your data uses, contacts and response time.

  • Privacy notice
  • Consent wording
  • Handling requests about personal data
  • Personal data breach intimations
  • Retention note
  • DPDP readiness checklist

₹1,499₹2,499

Launch price until 30 November. ₹2,499 after that.

Fill in and preview
  • See the first page of your own document before you pay
  • Pay through Cashfree by UPI, card or netbanking
  • Word to edit and PDF to print, the moment the payment clears
  • Full refund if the documents are not delivered
  • Refund policy

The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) were published on 13 November 2025. Rule 1(4) brings rules 3 and 5 to 16 into force eighteen months after publication, which is 13 May 2027. Those are the rules on the notice, security, breach intimation, erasure and the contact point. Under G.S.R. 843(E), sections 3 to 5, 7 to 10 and 11 to 17 of the Act, among others, start on the same date. Rule 4, on Consent Managers, starts a year after publication, on 13 November 2026.

From 13 May 2027 the business needs a notice that lists each item of personal data and its purpose, a way for people to withdraw consent and make requests, security safeguards, and intimations to the Board and affected people after a breach. Rule 7(2) asks for a first description to the Board without delay and a detailed report within seventy-two hours of becoming aware of the breach. The Schedule to the Act allows penalties up to ₹250 crore for failing to keep security safeguards and up to ₹200 crore for failing to intimate a breach.

The pack turns that into six documents: a privacy notice, consent wording, a procedure for requests about personal data, breach intimations to the Board, affected people and CERT-In, a retention note, and a dated readiness checklist. A business of any size that holds personal data can use it. The pack does not cover a business that collects the data of children, or of a person with a disability through a guardian.

Fill in your own

₹1,499₹2,499

Launch price until 30 November. ₹2,499 after that.

Your business

Business name *The legal name, as registered.
Business address *
Goods or services you use the data to provide *For example: a physiotherapy clinic in Pune.
Do you collect personal data of anyone under 18, or of a person with a disability through a guardian? *

The personal data

Each item of personal data and what you use it for *

Item 1

Personal data *
What you use it for *
One row for each item, such as name, mobile number, address or payment details.
Service providers that handle the data for you
For example your hosting, payment, email or delivery company. Leave it empty if there are none.

Who answers questions about personal data

Name *
Role *
Email *
Phone *
Web page where people withdraw consent and make requests *A page on your website. If you do not have one yet, enter the address you will publish it at.
Days you take to answer a request or complaint *

What you hold now

Do you already hold personal data that people gave you before this notice? *
Is your business one of these large platforms? *

We keep your answers and number so we can help if you ask. Ask us at any time and we delete them.

BuildWright does documentation, filing and compliance facilitation. This tool works from the rules cited on this page and does not give legal advice. We prepare the documents from your answers; you check, sign and send or file them.

Common questions

When do the main DPDP duties start?

13 May 2027 for the notice, consent, security, breach and erasure provisions, which is eighteen months after the Rules were published on 13 November 2025. Only the Consent Manager provisions, one year after publication, start earlier. The pack's checklist carries the dates.

How fast must a breach be reported?

Rule 7(2) asks for a description to the Board without delay and the detailed report within seventy-two hours of becoming aware of the breach, or a longer period if the Board allows one on a written request. The CERT-In Directions of 28 April 2022 add a separate duty to report cyber incidents within 6 hours of noticing them.

Does a small business have to comply?

The Act and Rules apply to a business that processes digital personal data, whatever its size. Holding customer or staff data is what brings a business in.

Does the pack cover children's data?

No. Section 9 and rules 10 and 11 deal with verifiable parental consent, and the pack does not build those documents. If you collect data of anyone under 18, we handle that separately.

Can I see the document before I pay?

Yes. Fill in your details and the page shows the first page of each document with your own answers in it. You pay only if it is what you need.

Can I change the document after I download it?

Yes. Each document comes as a Word file you can edit and a PDF you can print. You can also change your answers and prepare it again before you pay.

What if the payment goes through and the documents do not open?

The page checks the payment again and opens the documents on the same payment, so you are never charged twice. If they still do not arrive, write to us within 7 days and we refund the full amount.

Can you send or file it for me?

Yes. After you download, ask us to take the next step and we handle the sending or filing for you.

Not sure it applies to you?Check with the free DPDP Compliance Checklist first. Nothing you enter is stored.

Often needed next

Want this handled for you? Tell us where you stand and we prepare the documents and take the next step for you.