Privacy Policy Under the DPDP Act: What Indian Websites Must Disclose

An Indian D2C brand collects names, phone numbers, delivery addresses and payment references on its checkout page. Its privacy policy is a paragraph copied from a Shopify template that refers to "the GDPR" and a "Data Protection Officer in the European Union". There is no mention of the Digital Personal Data Protection Act 2023, no retention period, no grievance contact in India and no explanation of how a customer withdraws consent. When a customer complains to the Data Protection Board after receiving marketing calls she never agreed to, the brand's first response is that its policy was copied from a reputable source.

A privacy policy is not a website formality. Under the DPDP Act it is the public face of a legal obligation to give notice before processing personal data, and the details it omits are the details a regulator or an aggrieved customer will ask about first. This guide sets out what an Indian website must disclose, where the statutory requirement sits, and the drafting decisions that turn a generic template into a document that actually matches how the business handles data.

What the DPDP Act requires before you process personal data

The Digital Personal Data Protection Act 2023 regulates the processing of digital personal data in India. It applies to processing within India and, in specified circumstances, to processing outside India of data relating to goods or services offered to persons in India. The Act uses three core roles: the data principal is the individual to whom the data relates, the data fiduciary is the entity that determines the purpose and means of processing, and the data processor handles data on the fiduciary's behalf.

Processing is permitted only on two grounds: the consent of the data principal, or certain legitimate uses specified in the Act. For most consumer-facing websites, consent is the basis, and consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. That definition rules out pre-ticked boxes, bundled consent buried in general terms, and consent that is a condition of using a service the customer actually needs.

Section 5 requires the data fiduciary to give notice before requesting consent. The notice must be standalone, in clear and plain language, and must contain the specified particulars. It must be available in English and in the languages listed in the Eighth Schedule to the Constitution as the Rules provide, and it must be easier to understand than the average legal document. The privacy policy is the usual vehicle for that notice, though the Act contemplates the notice being presented at the point of collection rather than only on a separate page.

The disclosures an Indian privacy policy must contain

The Act's notice requirement is itemised, and a policy that covers most of the list but omits one item is not compliant. The table below maps the statutory particulars to the drafting decision each one forces.

Identity and grievance contact

Name the legal entity that determines the purpose of processing, not just the brand. If the website is operated by a subsidiary or a franchise, say which entity is the fiduciary. Give a postal address and an email that is monitored, and name the person responsible for privacy queries — the Act and the Rules contemplate a grievance redressal mechanism, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 separately require a body corporate to publish a privacy policy and designate a grievance officer with a contact address.

Data collected, by collection point

List the data by how it arrives: account registration, checkout, customer support, cookies and analytics, marketing forms, referrals, offline sources. For each, name the categories — identity data, contact data, transaction data, device and usage data, location data, and any sensitive categories the business actually handles. Avoid the phrase "including but not limited to" when describing personal data; it defeats the purpose of itemisation and is the kind of open-ended clause that regulators dislike.

Purposes and the purpose limitation principle

For each purpose, state which data it uses. Order processing uses identity, contact and transaction data. Marketing uses contact and usage data. Analytics uses device and usage data. Fraud prevention uses transaction and device data. The Act requires processing to be limited to the purpose for which consent was given, so a policy that collects data for order fulfilment and then uses it for profiling without a separate consent is non-compliant even if the policy mentions profiling somewhere in a general list.

Consent, withdrawal and the consent manager

Consent under the Act must be tied to a specific purpose and must be as easy to withdraw as it was to give. That has practical consequences for website design, not just drafting.

• Granular choices. Separate consent for order processing, marketing communications, analytics and third-party sharing. Bundling all four into one checkbox is not specific consent.
• No consent walls for essential services. A customer cannot be denied the core service for refusing marketing consent. Consent must be unconditional, meaning the service cannot be made conditional on consent to processing that is not necessary for it.
• Withdrawal mechanism. A link in the account settings and in every marketing email that takes the user to a working withdrawal page. A policy that says "email us to withdraw" is technically possible but weak if the email goes unanswered.
• Consent records. The date, time, version of the notice, the purpose consented to and the identifier of the data principal. The burden of proving consent sits with the fiduciary.
• Consent manager. The Act provides for registered consent managers who allow data principals to manage consent across fiduciaries through a single interface. The framework is being operationalised through the Rules; a business should monitor it and design its consent architecture so it can integrate later.

Retention, erasure and the end of the data lifecycle

The Act requires personal data to be erased once the purpose is fulfilled and retention is no longer necessary, unless retention is required by law. A privacy policy should state, for each category, how long it is kept and why.

Indian businesses have statutory retention obligations that override the general erasure rule: tax and accounting records under the GST law and the Companies Act 2013, employment records under labour law, and sectoral requirements for financial and health data. The policy should say that data is retained for the statutory period where the law requires it, and identify the laws by name rather than vaguely referring to "legal requirements".

Withdrawal of consent is not the same as erasure. Withdrawal stops future processing but does not automatically delete data already processed for a completed purpose. The policy should explain the difference, because customers who withdraw consent often expect immediate deletion and complain when marketing stops but the order history remains.

Sharing, processors and cross-border transfers

List the categories of recipients: payment gateways, logistics partners, cloud hosting providers, CRM and marketing platforms, analytics providers, professional advisers and government authorities where required by law. For each, state the purpose and whether the recipient is a processor acting on instructions or an independent fiduciary.

Where data is transferred outside India, state the countries or the mechanism. The Act permits transfer subject to restrictions notified by the central government, and sectoral rules may be stricter — the Reserve Bank's requirements for payment data localisation are the most cited example. If the business uses a global SaaS platform with data centres in the United States, Singapore and the European Union, the policy should say so rather than claim that all data is stored in India.

Where a processor is engaged, the contract should include the processor obligations the Act requires: processing only on instructions, security safeguards, breach notification, assistance with data principal requests, deletion on termination and audit cooperation. A privacy policy that lists a processor but no processing agreement is a gap that will be exposed in diligence.

Children, sensitive data and special categories

The Act treats a person below eighteen as a child and requires verifiable parental consent before processing a child's personal data. It also prohibits tracking, behavioural monitoring and targeted advertising directed at children. A website that allows users to create accounts without age verification, or that runs retargeting pixels on a platform used by minors, needs to address this in both the policy and the product.

Sensitive categories — health data, financial data, biometric data, caste and religious information — carry higher expectations of security and, in some sectors, separate regulatory requirements. The Act does not create a separate consent tier for sensitive data in the way the SPDI Rules did, but the security obligation and the penalty exposure are higher. If the business handles health records, it should also consider the Clinical Establishments framework and the Telemedicine Practice Guidelines where applicable.

Other Indian rules that affect the policy

SPDI Rules under the IT Act

The 2011 Rules under Section 43A of the Information Technology Act 2000 require a body corporate handling sensitive personal data to publish a privacy policy, implement reasonable security practices, and appoint a grievance officer. Until those rules are repealed or subsumed, a policy that ignores them leaves a separate compliance gap, particularly for businesses handling passwords, financial information, health data or biometric data.

Intermediary Guidelines 2021

If the website is an intermediary — hosting content uploaded by users — the Intermediary Guidelines require published terms of use, a grievance officer, a complaints mechanism and monthly compliance reporting. The privacy policy should cross-refer to the grievance process so users are not sent to two different addresses.

Sectoral requirements

Banks, insurers, securities intermediaries, hospitals and telecom providers face regulator-specific privacy requirements that go beyond the DPDP Act. A hospital website needs to address health information handling; a lending platform needs to address credit information reporting under the Credit Information Companies Regulation Act 2005. A generic policy will not satisfy those regulators.

Drafting the policy so it stays accurate

The most common failure of Indian privacy policies is not a missing clause; it is drift. The policy describes a data flow that changed six months ago, lists a vendor that was replaced, or promises a retention period the engineering team never implemented.

Four practices keep it accurate. First, maintain a data inventory that maps each collection point to the data, purpose, storage location and retention period, and update the policy from the inventory rather than from memory. Second, assign ownership of the policy to a named person with the authority to require product changes. Third, review the policy at least annually and whenever a new product, vendor or market is added. Fourth, keep every published version archived with its effective date, because the version in force at the time of a complaint is the version that governs.

Also publish the policy in a form that can be read on a phone. A policy that requires horizontal scrolling on a mobile browser is technically published and practically inaccessible, and accessibility is part of the plain-language requirement.

Penalties and enforcement

The Act's penalty schedule is significant. Breach of the notice and consent obligations, security safeguards and breach notification duties attracts monetary penalties that can run into tens of crores, with the highest tier reserved for failures in security safeguards. The Data Protection Board has powers to inquire, direct remediation and impose penalties, and the Act provides for appeal to the Appellate Tribunal.

Enforcement is expected to focus first on visible, high-impact failures: processing without notice, marketing without consent, security breaches affecting large numbers of people and failures to honour erasure requests. A policy that is accurate and a consent flow that records choices is the cheapest insurance against that exposure.

Common mistakes in Indian privacy policies

• Copying a GDPR template. References to EU law, EU representatives and rights that do not exist in Indian law.
• No DPDP reference at all. The policy predates the Act and was never updated.
• No retention period or criteria. "As long as necessary" is not a disclosure.
• Rights without a mechanism. Access and erasure are listed but there is no form, email or portal.
• No grievance officer or contact address. Customers cannot exercise rights and regulators cannot reach anyone.
• Bundled consent. One checkbox covers order processing, marketing and third-party sharing.
• Silent on cross-border transfer. Data is processed abroad while the policy implies it stays in India.
• No version archive. Nobody can prove what was published on a given date.
• No mention of the Data Protection Board. The statutory complaint route is omitted.

Frequently asked questions

Is a privacy policy mandatory for every Indian website?

If the website collects personal data, it needs a notice that satisfies the DPDP Act, and the SPDI Rules separately require a published privacy policy for bodies corporate handling sensitive personal data. An intermediary under the IT Act also needs published terms and a grievance mechanism.

A website that collects nothing — no forms, no analytics, no cookies — has little to disclose, but most commercial websites collect at least IP addresses and analytics data, which are personal data when linked to an individual.

What must the notice under Section 5 contain?

An itemised description of the personal data sought, the purpose of processing, the manner in which the data principal can exercise rights, and the manner of complaining to the Data Protection Board. The notice must be standalone, in plain language, and available in English and the languages specified in the Eighth Schedule as the Rules provide.

It should also identify the data fiduciary and give a contact point. A link to a 40-page legal document does not satisfy the plain-language requirement on its own.

Can I rely on legitimate uses instead of consent?

The Act specifies certain legitimate uses, including where the data principal has voluntarily provided data without indicating that it should not be processed, for employment purposes, for medical emergencies, for legal obligations and for specified state functions. These are narrower than they appear and each has conditions.

For marketing, profiling and most commercial analytics, consent is the safe basis. Relying on legitimate use for activities that are not clearly within the listed categories creates enforcement risk.

How long should we retain customer data?

For each category, retain only as long as the purpose requires or the law mandates. Order and invoice records are typically kept for eight years to align with tax and company law requirements; marketing contact data should be deleted or suppressed when consent is withdrawn; analytics data should be aggregated or deleted within a defined period.

Document the retention period in the data inventory and make sure the engineering systems actually enforce it. A stated period that is not implemented is worse than no statement, because it creates an expectation the business cannot meet.

Do we need a Data Protection Officer in India?

Not for every business. The Act requires a significant data fiduciary — designated by the central government based on factors such as volume and sensitivity of data and risk to data principals — to appoint a Data Protection Officer, conduct data protection impact assessments and audits. For everyone else, the requirement is an easily accessible grievance redressal mechanism, which in practice means a named grievance officer with contact details.

The SPDI Rules also require a grievance officer for bodies corporate handling sensitive personal data, so many Indian websites need one regardless of the significant data fiduciary designation.

What happens if our privacy policy is out of date when there is a breach?

The policy is evidence of what you told data principals. If a breach reveals processing that the policy did not disclose, the fiduciary faces exposure both for the breach and for the misleading notice. Regulators treat an inaccurate policy as an aggravating factor rather than a technicality.

Review the policy before any product launch that changes data flows, and keep the previous version so you can show what was disclosed at the time.

Drafting Support

Our drafting team prepares DPDP-compliant privacy policies and notices for Indian websites and apps, including data inventories, retention schedules and grievance procedures.