Practical guides
A practical consent and withdrawal worksheet
Follow one purpose from the explanation given to the action taken when a person changes their choice.
How it works →PRACTICAL RESOURCES
Useful reading for the work ahead.
Explore decisions, framework explanations, a plain-language glossary and a downloadable discussion checklist.
Practical guides
Practical guides
Adapt a global data inventory to India operations
Check whether a global record describes the people, systems and handovers used locally.
How it works →Practical guides
Answer enterprise privacy and security questions honestly
Build an evidence pack that distinguishes current practice, limited coverage and planned work.
How it works →Practical guides
DPO, privacy owner, legal adviser and security lead
Clarify the decisions and handovers behind the job titles.
How it works →Framework guides
Framework guides
India’s DPDP framework: scope, timing and practical preparation
Use the Act, commencement notification and Rules together when planning relevant work.
How it works →Framework guides
EU GDPR and UK GDPR: identify the relevant activity
Review overseas scope and responsibilities before choosing a programme or appointment.
How it works →Framework guides
ISO/IEC 27001: information security management
Understand the management-system objective and the privacy evidence it can support.
How it works →Framework guides
ISO/IEC 27701: privacy information management
Use a management-system objective to organise privacy responsibilities and improvement.
How it works →Framework guides
SOC 2: understand the assurance request
Clarify what a customer is asking for and what existing records can honestly support.
How it works →Decision guides
Scope and law
Does DPDP apply to our activities?
Establish the people, processing and geography before reaching a conclusion about scope.
How it works →People and support
Do we need a formal DPO or advisory support?
Separate a legal appointment question from the practical need for someone to coordinate privacy work.
How it works →Choices and processes
What consent arrangements do we actually need?
Decide the purpose and processing ground, then make the choice and follow-through work.
How it works →People and support
Should we hire, use external support or combine both?
Match the working arrangement to the decisions, recurring volume and internal capacity.
How it works →Scope and law
Which law, standard or assurance objective comes first?
Name the reason for the work before choosing a framework label.
How it works →Getting started
What should we do first?
Resolve material uncertainty, assign an owner and test a small number of important workflows.
How it works →Getting started
Do we need a gap review before implementation?
Use a review to resolve uncertainty; avoid repeating discovery when the issue and remedy are already clear.
How it works →Getting started
Who should carry out privacy improvements?
Break the work into decisions, documents, process changes and technical tasks.
How it works →Scope and cost
What determines the cost of privacy support?
Estimate the actual work and responsibilities before choosing a commercial model.
How it works →People and support
Do we need ongoing support or a defined project?
Look at the work that continues after the initial priorities have been addressed.
How it works →DPDP commencement update
Reviewed 14 September 2026. Commencement is phased: the Consent Manager registration tranche is scheduled for November 2026 and the main organisational duties and rights tranche for May 2027. Check the notification and other applicable requirements.
Read the official notifications →