Independent DPDP educationBrowser-only workspace · no accounts, analytics or submissions
COMPLY/DPDP

01 Bounded operating templates

Structure the work. Keep the evidence elsewhere.

Six field structures for designing and reviewing internal workflows. They are not prescribed forms, legal advice or a substitute for an approved case, incident or evidence system.

02 Choose the operating moment

Six records that connect decisions to systems.

Open a template to inspect its recommended fields, evidence boundary and source mapping. Start with the gap surfaced by the readiness assessment.

When to use

Before launch, after a field or purpose change, and during a periodic collection-surface review.

  1. 01
    Surface + journey

    URL, app screen, offline step, audience, language and trigger.

  2. 02
    Notice version

    Version ID, approved copy, display date and evidence of what was rendered.

  3. 03
    Data + purpose

    Each collected field, whether required, and the specific purpose it supports.

  4. 04
    Choice state

    Legal route assessed, affirmative action if consent is relied on, and withdrawal path.

  5. 05
    Destinations

    Systems, teams, integrations and service providers that receive the data.

  6. 06
    Test + review

    Keyboard/language test, finding, accountable approver and next review event.

Evidence boundary

Do not paste personal data or live credentials into this record. Link to redacted evidence in an approved internal location.

Status-aware source mapAct No. 22 of 2023 G.S.R. 846(E) G.S.R. 843(E) Implementation aid · not a prescribed form
When to use

At procurement, renewal, integration change, incident, rights exercise and service exit.

  1. 01
    Service + owner

    Service, internal business owner, purpose and personal-data categories.

  2. 02
    Role assessment

    Fact-specific role conclusion, assumptions and decision owner.

  3. 03
    Contract record

    Agreement/DPA version, instruction and safeguard references, renewal date.

  4. 04
    Architecture

    Regions, remote support, sub-services, integrations and privileged roles.

  5. 05
    Lifecycle

    Retention event, delete/export behaviour, backup residual and exit method.

  6. 06
    Evidence + gaps

    Latest review, test result, unresolved question, owner and due event.

Evidence boundary

A vendor label does not determine the legal role. Verify what the parties decide and do in the real arrangement.

Status-aware source mapAct No. 22 of 2023 G.S.R. 846(E) Implementation aid · not a prescribed form
When to use

When a dataset, purpose or system is introduced, changed or prepared for deletion automation.

  1. 01
    Record class

    Dataset, system, purpose, accountable owner and sensitivity.

  2. 02
    Start event

    Observable event that starts the clock and system-of-record timestamp.

  3. 03
    End event

    Duration or condition, with its decision basis and approving role.

  4. 04
    Exception

    Hold reason, authoriser, scope and next review date.

  5. 05
    System action

    Delete, anonymise or restrict across primary, replica, export and backup copies.

  6. 06
    Proof of outcome

    Synthetic test, run log, failure queue, residual search and sign-off.

Evidence boundary

This is not a universal retention schedule. Sectoral, contractual and other applicable requirements need separate review.

Status-aware source mapAct No. 22 of 2023 G.S.R. 846(E) G.S.R. 843(E) Implementation aid · not a prescribed form
When to use

When designing or exercising the workflow; use only an approved, access-controlled case system for real requests.

  1. 01
    Request channel

    Published route, received timestamp, request type and acknowledgement.

  2. 02
    Proportionate verification

    Checks used, why they were necessary and how excess copies are avoided.

  3. 03
    Search plan

    Systems, service providers, owners, identifiers and residual locations.

  4. 04
    Decision record

    Action, exception or limitation, evidence considered and accountable approver.

  5. 05
    Execution

    Correction/export/erasure steps, failures, processor follow-up and validation.

  6. 06
    Response + closure

    Response date, secure delivery, grievance route and lessons for the next exercise.

Evidence boundary

Never use this public preview to record a real identity, request or case detail. It has no submission or storage function.

Status-aware source mapAct No. 22 of 2023 G.S.R. 846(E) Implementation aid · not a prescribed form
When to use

During tabletop exercises and within the organisation’s approved incident system for a real event.

  1. 01
    Signal log

    Alert, reporter/provider, received time, handler and preserved source.

  2. 02
    Awareness decision

    Decision time, criteria, decision-maker, uncertainty and rationale.

  3. 03
    Known-facts register

    Confirmed, suspected, unknown, source and last-updated timestamp.

  4. 04
    Communication tracks

    Affected-person and Board content, approvals, send evidence and corrections.

  5. 05
    Measures

    Containment, recovery, evidence preservation and provider actions.

  6. 06
    Recurrence record

    Root factors, remediation owner, test, residual risk and closure review.

Evidence boundary

Rule 7’s timing sequence requires fact-specific legal and incident judgement. A template cannot determine awareness or notification duties.

Status-aware source mapAct No. 22 of 2023 G.S.R. 846(E) G.S.R. 843(E) Implementation aid · not a prescribed form
When to use

For a readiness review, tabletop, audit preparation or control-owner handover.

  1. 01
    Control + claim

    What the evidence is meant to show and which control it supports.

  2. 02
    Artefact reference

    Approved location, file/version identifier and sensitivity classification.

  3. 03
    Owner + reviewer

    Person accountable for freshness and person who challenged it.

  4. 04
    Coverage

    System, population, time window and known exclusions.

  5. 05
    Test result

    Procedure, date, outcome, sample and unresolved finding.

  6. 06
    Lifecycle

    Review event, superseded-record handling and authorised access.

Evidence boundary

An index aids retrieval; it does not prove that evidence is accurate, complete or legally sufficient.

Status-aware source mapAct No. 22 of 2023 G.S.R. 846(E) Implementation aid · not a prescribed form

03 Safe use sequence

Draft, challenge, test, then govern.

  1. 01

    Draft with synthetic dataClarify the fields and owner before touching a live record.

  2. 02

    Challenge the assumptionsReview role, purpose, exception and system coverage.

  3. 03

    Exercise the workflowTest retrieval, failure handling and residual copies.

  4. 04

    Move into an approved systemApply access, retention, audit and review controls.

04 Start from evidence

Not sure which record comes first?

Answer ten bounded questions using evidenced, partial, unknown or gap. The result recommends work; it does not grade legal compliance.

Build readiness mapRead field notes