Privacy Policy India | DPDP Act 2023 & DPDP Rules 2026

A DPDP privacy policy is the public document through which a data fiduciary meets its transparency duties. It does two jobs. It is the notice under section 5, which must accompany or precede every request for consent, and it is the standing disclosure required by section 8(9), which obliges you to publish the business contact of your Data Protection Officer or of a person able to answer questions on your behalf. Read with Rule 3 of the DPDP Rules, 2025, the notice must be understandable on its own and give an itemised description of the personal data alongside the specified purpose for each item. A line promising to "use your data to improve our services" fails that test.

Two neighbouring documents cause most of the confusion. Website terms of use govern the contract with users but cannot replace the notice, because consent under section 6 must be specific and cannot be buried in commercial terms. The older SPDI privacy policy, drafted under Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, was built around a narrow list of sensitive data such as passwords and biometrics. The DPDP regime covers all digital personal data and adds enforceable rights, so an SPDI-era policy needs rewriting, not a light edit. A well drafted DPDP privacy policy replaces it entirely.

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) received Presidential assent on 11 August 2023. Under section 3, it applies to digital personal data processed in India, including paper data digitised later, and to processing abroad connected with offering goods or services to data principals in India. Consent is the default ground: section 6 requires it to be free, specific, informed, unconditional and unambiguous, and as easy to withdraw as to give. Section 7 lists the legitimate uses that need no consent, such as employment-related processing. The rights of the data principal sit in sections 11 to 14: access, correction and erasure, grievance redressal and nomination.

The DPDP Rules, 2025, notified by the Ministry of Electronics and Information Technology in November 2025, supply the operational detail, and the official text of the Digital Personal Data Protection Rules, 2025 published by MeitY sets out their commencement schedule. Provisions constituting the Data Protection Board of India applied on notification, consent manager registration follows after twelve months, and most duties of data fiduciaries become enforceable on 13 May 2027, eighteen months after notification. Until then, section 43A of the Information Technology Act, 2000 and the 2011 SPDI Rules continue to apply in parallel; section 44(2) omits section 43A once it takes effect. MeitY has consulted on accelerating some obligations for significant data fiduciaries, so check the latest notification before fixing internal deadlines.

Penalties are set by section 33 and the Schedule. Failing to take reasonable security safeguards to prevent a breach can attract a penalty of up to 250 crore rupees, while failing to notify a breach or breaching the duties towards children can each cost up to 200 crore rupees. The Board fixes the amount after an inquiry, weighing gravity, duration and mitigation. Appeals from the Board lie to the Telecom Disputes Settlement and Appellate Tribunal under section 29.

The obvious trigger is launching a website or mobile app that collects names, emails or payment details from users in India. A contact form is enough. Once a visitor's name and number land in your CRM, you are a data fiduciary, whether you run a D2C brand, an edtech platform, a clinic or a chartered accountancy practice. Size makes no difference, nor does hosting the data in a third-party tool. The notice has to be live before the first form is submitted.

The second trigger is re-papering an existing base. Section 5(2) requires fiduciaries that obtained consent before the Act commenced to send each data principal a notice as soon as reasonably practicable, so companies holding years of subscribers or loyalty members need a compliant text to send. Employers are a third case. Section 7(i) allows processing for employment purposes without consent, yet HR teams still need a transparent account of what they hold, consistent with the data and confidentiality clauses of your employment contracts.

Two edge cases come up often. A US company selling subscriptions to Indian customers is caught by section 3(b) with no office in India, and its GDPR policy does not follow the Indian notice format. Then there is the startup expecting an exemption: section 17(3) lets the Central Government exempt classes of fiduciaries, including startups, from certain duties, but no exemption applies until it is actually notified, and security and breach obligations are never part of it.

• The identity and contact block names the data fiduciary as registered and publishes the business contact of the Data Protection Officer or designated person under section 8(9) and Rule 9. Intermediaries under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 name their grievance officer here.
• The itemised data and purpose schedule pairs each category of personal data with its specific purpose, as Rule 3 requires. No "other purposes" catch-all survives this format, and new purposes need a fresh notice.
• The consent and withdrawal clause explains how consent is recorded and how to withdraw it through a route no harder than the one used to give it. Processing then stops, including at your processors, under section 6(6).
• The legitimate uses clause identifies what you process without consent under section 7, such as employment records. Users then know which processing survives a withdrawal.
• The rights and grievance clause tells data principals how to request access, correction, erasure or nomination, and commits you to respond to rights requests and grievances within 90 days under Rule 14. It also points them to the Board once your grievance route is exhausted.
• The retention, processors and transfers clause sets retention periods by category and the one-year minimum for logs. Processors act only under a valid contract, and transfers abroad respect restrictions notified under section 16.
• The children and guardians clause requires verifiable parental consent under section 9 and Rule 10, and lawful guardian consent for persons with disabilities under Rule 11. It excludes tracking and targeted advertising aimed at minors.
• The security and breach clause describes safeguards such as encryption, masking and access controls under Rule 6. It commits to informing affected users and the Board without delay after a personal data breach.

Your contracts must back the policy up. Vendors and IT processors should sign service agreements carrying matching data protection obligations, and consultants handling customer files a non-disclosure agreement enforceable in India.

Data protection is a central subject in India, so there are no state privacy statutes to track. The variation comes from sectoral regulators, whose rules sit on top of the Act and often run on shorter clocks. A DPDP privacy policy for a regulated business has to reflect them, or it will contradict the disclosures the regulator already expects.

Banking, payments and fintech businesses start with the Reserve Bank of India circular on Storage of Payment System Data of 6 April 2018, which requires payment system operators to store the entire end-to-end transaction data only in India. RBI's digital lending framework adds that data collected through lending apps must be need-based, collected with explicit consent and kept on servers located in India. A fintech policy should therefore state where data is stored, not only which law governs it. Lending apps should also name the regulated entity behind the loan, because borrowers treat the app and the lender as one. A vague reference to "our partners" does not meet that standard.

Cybersecurity incidents bring in the CERT-In Directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, which apply to service providers, intermediaries, data centres and body corporates. Reportable incidents go to CERT-In within 6 hours of being noticed, and ICT logs must be kept for 180 days within Indian jurisdiction. This runs in parallel with the 72-hour report to the Board under Rule 7. Our breach clause refers to both regimes so your incident team works from one sequence.

Securities market entities such as stockbrokers, depositories and asset management companies fall under SEBI's Cybersecurity and Cyber Resilience Framework of August 2024. It layers audits, incident reporting and data localisation expectations on top of DPDP duties. A broking platform's policy should mention its regulated status and the channel through which incidents are reported to SEBI.

Healthcare providers, labs and telemedicine platforms hold the data users consider most sensitive, though the Act creates no separate sensitive category. Platforms integrated with the Ayushman Bharat Digital Mission must also follow its Health Data Management Policy, which routes the sharing of health records through the ABDM consent framework. Clinics should state how long consultation records are kept, since medical retention rules often exceed what users expect.

You start with the identity of the data fiduciary: company or LLP name, CIN or LLPIN, registered office and the website or app covered. If you are still setting up, finalise it alongside our company and LLP incorporation templates so the registered details match from day one. The questionnaire then asks what you collect, grouped by source such as checkout, support, cookies and recruitment. For each category you pick the purpose and indicate whether it relies on consent or on a legitimate use. The itemised schedule is built directly from these answers, so take your time.

Next come the operational details. You name the Data Protection Officer or contact person, choose channels for rights requests and grievances, and set retention periods by category. If you use cloud hosting, payment gateways or CRM tools abroad, the form asks which countries are involved. Businesses dealing with minors answer extra questions on parental consent, and regulated entities select their sector so RBI, SEBI or CERT-In references are added. The finished DPDP privacy policy is generated in Word and PDF, ready to publish on your site or inside your app settings. Check that every stated retention period matches what your systems really do before publishing.

The mistake seen most often is the copied foreign policy. A GDPR text relies on lawful bases such as legitimate interests, which the Indian Act does not recognise in that form, and it omits the Board, the nomination right and the Eighth Schedule language option. Close behind is bundled consent, the single "I agree to the Terms and Privacy Policy" box at signup. Section 6(1) limits consent to data necessary for the specified purpose, and one click cannot cover account creation, marketing and analytics at once. A third error is a withdrawal route leading to an inbox nobody reads, which turns a simple opt-out into a formal grievance.

Retention is the fourth weak spot. Policies promise to keep data "as long as necessary" while the database still holds every user since launch. Under section 8(7) and Rule 8, data must be erased once its purpose is served, and large e-commerce, gaming and social media platforms face a three-year inactivity limit with 48 hours' notice before erasure. Finally, many businesses forget that the 72-hour breach clock runs from awareness, not from the end of the investigation, and that a processor contract silent on incident reporting makes the deadline impossible to meet. When a user escalates, a reply drafted from our legal notice and compliance formats beats silence.