Data processing agreement checklist
Prepare the scope, instructions, security expectations, supplier terms and incident contacts for a processor agreement.
Read guideDPDPA Shield resources
Free DPDP RoPA template and compliance guides
Start a Record of Processing Activities with a downloadable CSV, then use the guides below to prepare notices, processor agreements and incident workflows. These are working aids to adapt to your organisation, not government forms or compliance certification.
Download the DPDP RoPA template
The spreadsheet has 20 columns and one clearly marked fictional example. Open it in Excel, LibreOffice or Google Sheets. It describes processing activities; do not put customer records, identity documents or other raw personal data in it.
Download free RoPA CSVCSV · no signup required · editable · includes an illustrative row
How to fill it in
- Create one row for each processing activity, such as onboarding or support.
- Identify the purpose, data categories, owner, systems, suppliers and locations.
- Record the applicable processing ground and its evidence; verify rather than assume consent or an exemption.
- Confirm retention, deletion, safeguards and request handling with the responsible teams.
- Set a review date and update the register when the activity changes.
| Activity | Purpose and data | Review needed |
|---|---|---|
| Illustrative enquiry handling | Answer an enquiry using an email address and message | Ground, notice, access and deletion schedule |
Preparation guides
These links open explanatory web guides and checklists.
Privacy notice preparation
Understand the information a notice should explain and how to connect it to the actual processing purpose.
Read guideVerifiable parental consent
Review identity and age verification, consent evidence and the limitations of OTP-only flows.
Read guideData Protection Impact Assessment
Understand DPIA scope, Significant Data Fiduciary duties and practical risk assessment preparation.
Read guideCERT-In and DPB incident response
Plan incident escalation, initial notifications, follow-up reporting and evidence collection across the applicable clocks.
Read guideOfficial sources and editorial review
Prepared by DPDPA Shield. Explanations are plain-language summaries; the cited legislation controls. Last reviewed .