Build a privacy programme you can show, from data map to breach drill, in 90 days
A complete toolkit for the person who has just become the privacy lead: the method, the workbook, the forms, the notices, the exact words and a 90-day plan that works under GDPR, DPDP, CCPA and similar laws.
- A 10-chapter e-book teaching an eight-block privacy programme, with one composite 70-person company followed from first data map to a mock breach
- The Privacy Programme Workbook: 13 Excel sheets with settings, data inventory, records of processing, vendor register, rights request log with due dates, consent and notices, retention, DPIA register, breach log, training, a 24-check self-audit and a dashboard
- 4 fillable PDF forms and 6 Word files, including customer, website, employee and candidate notice samples, a 14-term DPA checklist, 41 messages, 8 rights response letters, a breach plan and 32 AI prompts
- A Breach Severity and Notification Helper, a Start Here map, 3 cheat sheets including law notes by country dated October 2026, a 59-event 90-day calendar and a 47-task CSV board
The Data Privacy Compliance Starter · Bodhih Pro Kits · 187 by Bodhih Training, trainers to 2,000+ companies since 2008.
How do I build a data privacy compliance programme for a small or mid-size company?
Decide which laws apply with counsel, name a privacy lead and sign a one-page charter, map every system holding personal data, choose one lawful basis per purpose, publish plain notices, log rights requests with deadlines, set retention periods, contract with vendors, screen new projects, plan breach response and train staff. Bodhih Training's Data Privacy Compliance Starter gives you a file for each step.
Want the full free guide first? Read How to Build a Data Privacy Programme for a Small or Mid-Size Company.
You already feel the problem. Here is what it is costing you.
You became the privacy person by accident
You asked one sensible question about old customer records and now privacy is yours, alongside twelve other duties. There is no budget for a platform and no lawyer down the corridor.
Nobody knows where the data is
The official answer is 'the CRM and the HR system'. The real answer includes exports on laptops, a chat group with phone numbers, an agency's shared drive and a tool someone signed up for last spring.
Requests and questionnaires arrive with deadlines
A customer wants everything deleted, a retail partner sends a sixty-question supplier questionnaire, and the bank asks whether you comply with the new law. Each one has a clock, and the clock started before you saw the email.
Vendors and AI tools you cannot see into
IBM's Cost of a Data Breach Report 2026 found incidents involving employees' unapproved AI tools more than doubled, and Verizon's 2026 Data Breach Investigations Report found a third party involved in 48% of breaches. Your vendors and tools sit inside your programme whether you manage them or not.
Laws that differ by country and keep changing
GDPR, the UK's Data (Use and Access) Act, India's DPDP Rules, California's new regulations, and more across Africa, Asia and the Gulf. Free templates assume one country and go out of date quickly.
No way to show leadership progress
Leadership asks whether you are compliant. Without an inventory, a log and a few numbers, the only honest answer is 'probably, mostly', and that satisfies nobody.
Picture the next few weeks with the kit open beside you.
Picture next Monday. You open the Start Here map, type your company, your name and the laws you believe apply into the Settings sheet, and send message 1 asking your sponsor for twenty minutes. By Wednesday the one-page charter is signed, the privacy mailbox is live, and every employee knows the two rules: forward requests the same day, report incidents within the hour.
Now it is day thirty. As you finish the last mapping interview and type its rows into the Data Inventory, the risk column lifts three systems to the top. The dashboard shows how many systems you hold, how many are sensitive, which vendors have no contract and which requests are due this week. It is not a pretty picture, but it is the first true one.
Imagine the day a deletion request arrives. You log it, the due date calculates, message 18 verifies the requester with one detail you already hold, and message 20 asks each data owner to search. Letter 4 explains what you deleted, what the law makes you keep and why, and the request closes well inside the deadline with the evidence saved.
And when an incident report lands at two in the afternoon, the printed breach plan is on the desk, the helper scores the facts, counsel has the reasons paragraph within the day and the notices are drafted from templates. Whether you start with the e-book tonight or the workbook tomorrow morning, the first hour is already planned.
19 files that do the work for you
The e-book shows you how. The tools make it happen. Here is exactly what you download.
The Data Privacy Compliance Starter (e-book, PDF)
The guide: methods, worked examples, scripts and exercises
Start here: privacy programme map
The whole job as eight building blocks with the file to open at each, your first hour, a 30/60/90 day use plan and links to measure your starting point.
Privacy Programme Workbook
13-sheet Excel workbook: settings, data inventory with risk scoring, records of processing view, vendor register with review dates, rights request log with due dates, consent and notice register, retention schedule, DPIA register, breach log with deadline flags, training tracker, self-audit score and a dashboard.
Breach Severity and Notification Helper
Six-sheet calculator: score an incident 1 to 25 from fourteen inputs, get a notification decision for the regulator and for affected people with reasons to record, and a deadline clock from discovery.
Data mapping interview sheet and privacy impact assessment form
Four-page fillable form: a 30-minute data mapping interview per system or team (page 1), a five-minute DPIA screening (page 2) and a full privacy impact assessment with risks, mitigations and sign-off (pages 3 and 4).
Rights request intake form
Two-page fillable form for every individual rights request: what was asked, identity verification, the clock, the systems to search, exemptions considered and the response record.
Breach assessment form
Two-page fillable incident record for the first 72 hours: facts, containment, severity scoring, the notification decision with reasons, who was told and when, and the lessons review.
Vendor privacy due diligence questionnaire
Three-page fillable questionnaire to send to any vendor that will touch personal data, with a scoring grid (0-100) and a decision box for the Vendor Register.
Privacy notices, retention schedule and DPA checklist
Policy template pack: customer, website and cookie, employee and candidate privacy notices in plain layered language; a retention schedule template with sample periods and a deletion run procedure; and a 14-term data processing agreement checklist with sample wording.
Privacy message library and rights response letters
41 ready-to-edit messages and scripts in 7 groups (programme launch, data mapping, vendors, rights requests, breach response, marketing and HR, training) plus 8 full rights request response letters.
Breach response plan and communication templates
A ready-to-adopt breach response plan: roles and contacts, the first 72 hours hour by hour, severity bands and what they trigger, five communication templates (staff holding statement, notice to affected people, support script, partner notification, press statement) and an annual drill.
Privacy programme charter and training plan
A one-page charter with eight commitments, roles and measures for leadership to sign, plus a six-module training plan with audiences, lengths, content and quiz examples, and an awareness calendar.
Worked example pack: a 70-person e-commerce company
The kit's forms and decisions shown completed for one composite case, from the first data map through a deletion request answered on time to a mock breach notified within the deadline, with the numbers and the words used.
AI prompt pack for privacy compliance
32 tool-agnostic prompts grouped by the nine steps of the privacy programme, each with what to paste in and what to check before you use the output.
Privacy decision cards
Three if-this-then-that cards: lawful basis by purpose, rights requests by type and situation, and the breach first 72 hours hour by hour.
Privacy mistakes to avoid
Mistakes-to-avoid card: twelve programme mistakes with what to do instead and the file that prevents each, plus ten misunderstandings about what counts as personal data.
Privacy law notes by country (October 2026)
Dated quick reference: rights request and breach deadlines, officer and registration duties, AI rules and penalties for the EU, UK, India, US, Singapore, Nigeria, Kenya, Australia, the Philippines and the GCC, plus the standards practitioners use.
90-day privacy programme calendar
59 calendar events over 90 days, from the first hour to the leadership review, each naming the file to open. Import into a new calendar and move to your dates.
Privacy programme task board
47 programme tasks as a CSV ready to import into Trello, Asana, Notion, Planner or Jira, with building block, week, owner, file to open and due date.
Chapter by chapter
Each chapter opens with a real situation, gives you a method and ends with something to do today, using the tools in your kit.
- Format
- PDF e-book + XLSX + fillable PDF + DOCX + printable PDF + ICS + CSV
- Files
- 19 files plus a one-click ZIP
- E-book
- 60 pages
- Workbooks
- 13-sheet programme workbook and 7-sheet breach helper, with sample data, formulas and dashboards
- Works with
- Excel, Google Sheets, LibreOffice, Word, Google Docs, Acrobat Reader, GoodNotes, Google Calendar, Outlook, Apple Calendar, Trello, Asana, Notion, Planner, Jira
- Best for
- Companies of roughly 10 to 1,000 people that handle customer, employee or user data, in any country
A Programme, Not a Policy
The seven principles most privacy laws share, the four practical duties and the eight-block method in one page.
Scope, Roles and the Charter
Deciding which laws apply with counsel, naming a lead, deputy, data owners and sponsor, and getting a one-page charter signed.
Find the Data
Thirty-minute mapping interviews, a shadow data sweep, the data inventory, the records of processing and strict sensitivity flags.
Lawful Basis, Consent and Notices
One basis per purpose from a decision card, consent that would stand up, cookies, and notices people can read.
Rights Requests, Start to Finish
Logging on day one, proportionate verification, searching every system, redaction, the right letter, and why deletion is rarely total.
Keep Less
A trigger, a period and a reason for every record type, and a deletion run with legal-hold checks and evidence.
Vendors, Processors and Transfers
Controllers and processors, the questionnaire, the DPA checklist, the vendor register and cross-border transfers in plain words.
Privacy by Design, Impact Assessments and the Harder Cases
A five-minute screen for every project, full assessments where needed, and employee monitoring, marketing, children's data and security basics.
AI and Privacy
Five questions for any AI tool that touches personal data, where AI helps run the programme, and where a human must decide.
The First 72 Hours
The breach plan in five phases, scoring an incident, deciding with counsel, notifying and learning without blame.
Training, Audit, Metrics and the 90-Day Build
Six training modules, a 24-check self-audit, a dashboard reduced to what leadership reads, and the three-phase 90-day build.
The Programme You Can Show
What you now have, the three habits to keep, and where your regulator and counsel have the final word.
Privacy Terms in Plain Words
Plain definitions of twelve privacy terms, from personal data to data breach.
Not just reading. Tools you will actually open again.
E-book
- The Data Privacy Compliance Starter: 10 chapters, a conclusion, an appendix of plain-word definitions and 6 hand-drawn figures (PDF)
Start here
- 00-Start-Here-Privacy-Programme-Map: the job as eight building blocks with the file to open at each, your first hour, a 30/60/90 day use plan and links to measure your starting point
Spreadsheets
- Privacy Programme Workbook (13 sheets): Start here, Settings, Data Inventory with risk scoring, Records of Processing, Vendor Register, Rights Requests with due dates and warning flags, Consent and Notices, Retention Schedule, DPIA Register, Breach Log with deadline status, Training Tracker, a 24-check Audit Checklist and a Dashboard with 24 live measures and a chart
- Breach Severity and Notification Helper (7 sheets): score an incident 1 to 25 from fourteen inputs, get a notification decision for the regulator and for affected people with a reasons paragraph, and a deadline clock from discovery
Fillable PDF forms
- Data mapping interview sheet and privacy impact assessment form (4 pages): interview, five-minute screening, full assessment, risks and sign-off
- Rights request intake form: the request, verification, the clock, systems searched, exemptions and the response record
- Breach assessment form: facts, containment, severity, the notification decision with reasons and the lessons review
- Vendor privacy due diligence questionnaire: questions for the vendor plus a 0-100 scoring grid and decision box
Word templates
- Privacy notices, retention schedule and DPA checklist: customer, website and cookie, employee and candidate notice samples, a 14-row retention schedule with a deletion run procedure, and a 14-term data processing agreement checklist with sample wording
- Privacy message library and rights response letters: 41 messages and scripts in 7 groups plus 8 response letters
- Breach response plan and communication templates: roles, the first 72 hours, severity bands, five communication templates and an annual drill
- Privacy programme charter and training plan: a one-page charter to sign plus a six-module training plan and awareness calendar
- Worked example pack: one composite 70-person e-commerce company from data map to a closed deletion request, a mock breach and a day-90 scorecard
- AI prompt pack for privacy compliance: 32 tool-agnostic prompts, each with what to paste in and what to check
Cheat sheets
- Privacy decision cards: lawful basis by purpose, rights requests by situation, and the breach first 72 hours
- Privacy mistakes to avoid: twelve programme mistakes with the file that prevents each, plus ten misunderstandings about personal data
- Privacy law notes by country, correct at October 2026: deadlines, officer and registration duties, AI rules and penalties for the EU, UK, India, US, Singapore, Nigeria, Kenya, Australia, the Philippines and the GCC, plus the standards practitioners use
Calendar and import
- 90-day privacy programme calendar (ICS): 59 events for Google Calendar, Outlook or Apple Calendar
- Privacy programme task board (CSV): 47 tasks for Trello, Asana, Notion, Planner or Jira
When you have worked through it, you will be able to…
Every outcome is practised with a worked example and a tool, not just described.
- Write a scoping note, record counsel's view of the laws in scope and set every deadline from one Settings sheet
- Map every system that holds personal data through short interviews and keep a records of processing view up to date
- Choose and record one lawful basis per purpose and publish plain, layered notices for customers, employees and website visitors
- Log, verify, search, answer and close rights requests with a calculated deadline and the right letter
- Adopt a retention schedule with triggers and run deletions with legal-hold checks and evidence
- Run vendor due diligence, check contracts against a DPA checklist and record transfer mechanisms
- Screen new projects and AI tools for privacy risk and run a full impact assessment where needed
- Score a breach, decide on notification with counsel, send the notices and report programme metrics to leadership
Know your starting point. Prove your progress.
People who measure before and after improve faster and can show it. AssessAll, our sister assessment platform, has AI-graded assessments that pair with this kit. Take one now, work through the kit, then re-take it.
A taste of Chapter 5
The trigger matters more than the period. "Seven years" means nothing on its own; "seven years from the end of the financial year of the last transaction" is a rule a system can apply. Common triggers: end of contract, last activity, decision date for unsuccessful candidates, leaving date for employees, recording date for CCTV. The reason column has two kinds of entry. "Legal: tax records" is a reason you can point to, and your accountant or counsel supplies the period. "Business: analytics on anonymised orders" is a judgement, and the test is whether you could explain it to the person whose data it is. "In case we need it" fails that test every time. Prompt 17 drafts a first schedule for your sector and marks each reason legal or business so you know which to confirm.
The honest comparison
| Free templates and typical advice | This kit | |
|---|---|---|
| Starting point | Download a privacy policy template | Scope with counsel, a signed charter, then a data map before any notice is written |
| Data mapping | A blank spreadsheet | An interview sheet, a shadow data sweep, an inventory with risk scoring and a records of processing view |
| Rights requests | One generic response template | An intake form, a log with calculated deadlines and warning flags, 8 response letters and the internal messages to search |
| Vendors | Sign whatever the vendor sends | A scored questionnaire, a 14-term DPA checklist and a register with transfer mechanisms and review dates |
| Breach response | A policy that says 'notify within 72 hours' | A printed plan, a severity and notification helper, a breach log with deadline status and five communication templates |
| AI | Not mentioned | Five questions for AI tools, human review rules and 32 prompts with checks |
| Countries | Assumes one law | Principles that travel, with country specifics in one sheet dated October 2026 |
Made for you if…
- Compliance officers and data protection leads building or rebuilding a programme
- IT managers who own security and have just been handed privacy as well
- HR and office managers who own policies and employee data
- Risk and business-continuity owners who need a breach plan that works
- Founders and COOs of small and mid-size companies answering questions from banks, partners and auditors
- Teams operating across India, the UK, the US, the Gulf, Singapore, the Philippines, Africa and Australia
Probably not for you if…
- Anyone looking for a legal opinion or a certification: the kit is educational, keeps country specifics in one dated sheet and points you to your regulator, counsel and local law
- Readers who want a library of one-page company policies on many topics: The Employee Handbook and Policy Builder covers that; this kit goes deep on the privacy programme
- Teams that need a full information security programme: the kit links privacy to security basics, and Bodhih's Information Security kit goes deep on it
Built by trainers, tested in real rooms.
Bodhih Training has designed and delivered corporate programmes since 2008. Bodhih Pro Kits package what works in those workshops into a guide plus the exact tools we use, so you can apply it the same day without a facilitator in the room.
From here to using it in three steps
- STEP 1
Tap Get the kit
Name, email and country. UPI, card or netbanking in India; international cards everywhere else. No account to create.
- STEP 2
Download instantly
Your download page opens at once, with every file and a one-click ZIP. A permanent link lands in your inbox too.
- STEP 3
Open the first tool
Start with the quick-start chapter, then the main spreadsheet or planner. Most buyers use something from the kit the same day.
The next request is already on its way. Have the programme ready when it arrives.
Open the Start Here map, fill in the Settings sheet and book your first three mapping interviews. Whether you begin with the e-book this evening or the charter with your sponsor tomorrow, the first hour is already planned.
Personal licence for the buyer's own use (and use with your own team or clients where the kit says so). Please don't share or resell the files. Team and company licences: solutions@bodhih.com.
What buyers say
No ratings yet. Only people who have bought this kit can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
The Bodhih family, when you are ready for more
The Harassment Prevention Programme Kit
Build a respectful workplace programme.
The Business Continuity and Crisis Plan
Be ready for the bad day.
Information Security for Small Business
Protect the company without a security team.
AssessAll
250+ AI-graded assessments to measure skills and earn verified credentials.
Jobulary
Individual development plans that start from evidence and stay yours.
Bodhih Training
Run this topic as a live workshop for your team, in person or online.
Pewple
Book a vetted coach for career, leadership or communication. Pay per session.
Bodhih.org pathways
Certification pathways in Applied AI, Workplace English and management.
The Data Privacy Compliance Starter: FAQs
Read the free guideAlready bought? Resend my linkHow do I build a privacy programme for a small company?
Work through eight blocks: scope and roles, a data map, lawful basis and notices, rights requests, retention, vendors and transfers, privacy by design, and breach response, with training and audit around them. The kit gives each block a chapter, a file and a place in a 90-day calendar.
Does it work under GDPR, DPDP, CCPA and other laws?
Yes. The method is built on the principles and duties most modern laws share, and every deadline is set on the workbook's Settings sheet from your own law. Country specifics for the EU, UK, India, the US, Singapore, Nigeria, Kenya, Australia, the Philippines and the GCC are in one sheet dated October 2026.
How long do I have to answer a data access request?
It depends on the law: one month under the GDPR with a possible extension for complex requests, 45 days under California's law, and different rules elsewhere. The Rights Requests sheet calculates the due date from the days you set, and flags requests inside the warning window or overdue.
Do I have to report every data breach?
No. Many laws require notification only when people are likely to be at risk, while some expect nearly every breach to be reported. The breach helper scores an incident, applies the threshold you set with counsel and writes a reasons paragraph to record whichever way you decide.
Can we use AI tools with personal data?
Often, with care. Chapter 8 gives five questions to ask about any AI tool (training, retention, automated decisions, accuracy and transparency) and a human review rule. The prompt pack shows where AI helps run the programme and what to check before you use any output.
How do I measure my starting point?
AssessAll offers three assessments that match this kit: Personal Data Judgment, Data Governance & Data Quality Stewardship Judgment, and People & Performance Data Judgment. Take one before you start and again after the 90 days. Links are on the Start Here map; the assessments are separate products, not included in the kit.
How do I turn this into a development plan?
Use the mistakes card and your assessment results to pick the skills you or your data owners will practise, then build them into a plan. Jobulary explains how its development plans work, and the link is on the Start Here map.
Is this legal advice or a certification?
No. The kit is educational: it helps a company organise and run its privacy programme. It is not a legal opinion or a certification. Laws, deadlines and thresholds change often, so check your regulator's current guidance, your counsel and local law, and have notices and contracts reviewed.
Which software do I need?
The workbooks open in Excel, Google Sheets or LibreOffice and use no macros. The forms are fillable in Acrobat Reader and most PDF apps, the templates open in Word or Google Docs, the calendar imports into Google Calendar, Outlook or Apple Calendar, and the CSV imports into Trello, Asana, Notion, Planner or Jira.
What is the refund policy?
Digital kits are non-refundable once downloaded. The exceptions are corrupted files that are not fixed within 3 working days, duplicate charges, or failed delivery.
How much does The Data Privacy Compliance Starter cost?
₹1,299 including 18% GST for buyers in India, or $34 for buyers outside India. One-time payment, no subscription, with an automatic invoice.
How do I get the files after paying?
Instantly. Your download page opens the moment payment succeeds, and a permanent download link is emailed to you. Download each file separately or everything in one ZIP.
What software do I need?
Any of the usual tools: Excel or Google Sheets for spreadsheets, Word or Google Docs for templates, Adobe Acrobat Reader, Preview, Xodo or GoodNotes for the fillable PDFs, and Google, Outlook or Apple Calendar for the calendar plan.
Can I get a refund?
Because it is a digital download, kits are not refundable once downloaded. We always refund a duplicate charge or a failed delivery, and if a file is corrupted and we cannot fix it within 3 working days. Full terms: bodhih.org/refunds.
Can my company buy this for a team?
Yes. Team and company licences, and workshops on this topic run by Bodhih Training, are available. Write to solutions@bodhih.com or call +91 99000 11601.
