Our Consent Architecture Blueprint specifies how consent should move through your systems. This kit is the layer above it: the actual forms, screens and confirmations a data principal sees, written to satisfy DPDPA rather than translated from a European template.
The difference matters more than it sounds. DPDPA consent must be free, specific, informed, unconditional and unambiguous, presented alongside an itemised notice, and as easy to withdraw as to give. A consent screen adapted from a GDPR cookie banner satisfies almost none of those, because it was designed to obtain agreement rather than to record an informed decision.
Every form in the kit is paired with the record it must produce, so the wording a person reads and the evidence you keep are designed together. That pairing is what an auditor tests, and it is the part that is almost always missing.
Why it is structured the way it is, and the failure patterns it was designed around.
Not a table of statutory contrasts. The seven places where the two regimes diverge enough to change your data model, your consent screens and your engineering backlog.
A DPDPA-conformant notice set — customer, employee, vendor and website — with itemised processing tables and multilingual structure built in.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Built for
Kept current
Version 1.4, revised 19 July 2026. We update when a framework changes, when new rules are notified, or when an engagement teaches us something that improves it.
DOCX + PDF guide · 39 pages
What this will not do
A template cannot know your systems, test your controls or make the judgement calls that determine whether a programme holds up in an audit. Use it to move faster, not to skip the thinking — and treat any resource claiming to make you compliant on its own as a warning about its author.
The designation is discretionary, so the useful question is not whether you are one but what it would cost to be treated as one. Three additional duties, and why we tell large consumer platforms to assume it.
The Act set the principles. The Rules set the engineering requirements. Here is what changes in your systems — notice structure, breach clocks, and verifiable parental consent.
The 96-point operational checklist we use on day one of every DPDPA engagement, with evidence requirements per item.
A working risk register with a pre-populated scenario library, quantified exposure model and treatment tracking — not an empty template.
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.
