Privacy Policy (India)

A Privacy Policy (India) is a legally required public disclosure document under the Digital Personal Data Protection Act 2023 (DPDP Act 2023), the Information Technology Act 2000 (IT Act 2000), and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (SPDI Rules 2011) that explains to users — called Data Principals under the DPDP Act 2023 — how a business collects, processes, stores, shares, and protects their personal data.

The DPDP Act 2023, which received Presidential assent on 11 August 2023 and represents India's first complete data protection statute, requires Data Fiduciaries (entities that determine the purpose and means of processing personal data) to provide a clear notice to Data Principals before or at the time of collecting personal data. Under Section 5 of the DPDP Act 2023, this notice must specify: the personal data to be collected; the purpose of processing; how the Data Principal may exercise their rights under Sections 11–14; and the manner in which a complaint may be made to the Data Protection Board of India established under Section 18.

The SPDI Rules 2011 under Section 43A of the IT Act 2000 continue to apply alongside the DPDP Act 2023 for matters not yet covered by the DPDP Rules (yet to be notified). Rule 4 of the SPDI Rules requires every body corporate that collects, receives, possesses, stores, deals with, or handles sensitive personal data or information to publish a privacy policy on its website providing for the following: type of personal or sensitive personal data collected; purpose of collection; disclosure practices; reasonable security practices adopted; and contact details for grievances. The SPDI Rules define sensitive personal data to include passwords, financial information, health data, biometric information, and sexual orientation.

For Significant Data Fiduciaries — a category to be designated by the Central Government under Section 10 of the DPDP Act 2023 based on the volume and sensitivity of personal data processed — additional obligations apply, including appointment of a Data Protection Officer, conducting Data Protection Impact Assessments, and periodic audits. The Data Protection Board of India will have the power to impose financial penalties up to ₹250 crore per breach under the DPDP Act 2023.

The Consumer Protection Act 2019 and the Consumer Protection (E-Commerce) Rules 2020 impose additional disclosure obligations on e-commerce entities operating in India, including mandatory privacy policy publication and grievance officer appointment. The Reserve Bank of India's guidelines on digital payments and the Securities and Exchange Board of India's data localisation requirements for regulated entities add further compliance layers for financial businesses. Forms-legal.com provides this Privacy Policy template to assist Indian businesses in meeting their obligations under the DPDP Act 2023, IT Act 2000, and allied regulations.

A Privacy Policy is needed for any Indian business that collects personal data from users, customers, employees, or other individuals — whether through a website, mobile app, offline forms, or any other means. It is mandatory under the DPDP Act 2023 and the SPDI Rules 2011 for all body corporates handling personal or sensitive personal data.

Specific triggers: (1) Operating a website or app that collects user data (name, email, phone, location, payment details); (2) Running an e-commerce platform; (3) Providing cloud, SaaS, or IT services; (4) Operating a healthcare, education, financial services, or HR platform processing sensitive personal data; (5) Running any business that maintains customer records digitally; and (6) Receiving data from EU/UK users (requiring GDPR compliance in addition to DPDP Act compliance).

Parties in India should prepare a Privacy Policy (India) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Indian law, the Indian Contract Act 1872 governs contractual obligations, with Section 10 setting essential requirements for valid agreements. The Companies Act 2013 regulates corporate entities through the Registrar of Companies (ROC) and Ministry of Corporate Affairs (MCA). The Industrial Disputes Act 1947 and state labour commissioners govern employment disputes. The Information Technology Act 2000 and IT (Reasonable Security Practices) Rules 2011 protect personal data. The Income Tax Act 1961 and Goods and Services Tax Act 2017 govern tax obligations through the Central Board of Direct Taxes (CBDT) and GST Council. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A compliant India Privacy Policy under the Digital Personal Data Protection Act 2023 and IT (SPDI) Rules 2011 must include the following key elements.

Data Fiduciary identification: Full legal name, registered address, CIN (for companies registered under the Companies Act 2013), and contact email of the entity acting as Data Fiduciary. For Significant Data Fiduciaries designated under Section 10 of the DPDP Act 2023, the Data Protection Officer's name, designation, and contact details must be separately disclosed.

Grievance Officer details: Under Rule 5(9) of the SPDI Rules 2011 and the Consumer Protection (E-Commerce) Rules 2020, the name, designation, postal address, email address, and working hours of the Grievance Officer must be published in the privacy policy. The Grievance Officer must respond to complaints within one month of receipt.

Personal data collected: A specific list of personal data categories collected — name, email address, phone number, postal address, date of birth, PAN/Aadhaar (where collected), payment card details, device identifiers, IP addresses, location data, browsing history, and any sensitive personal data categories defined under Rule 3 of the SPDI Rules 2011 (passwords, financial information, health data, biometric data, sexual orientation).

Purposes of collection and legal basis: For each category of personal data, the specific purpose for which it is collected and the legal basis under the DPDP Act 2023 — either consent under Section 6 or legitimate use under Section 7 (processing for legal obligations, employment, medical emergencies, or state functions). Vague or catch-all purpose descriptions do not satisfy Section 5.

Data retention: The period for which each category of data is retained, and the basis for that retention period. Under the DPDP Act 2023, personal data must be deleted once the purpose for which it was collected is fulfilled, unless retention is required by law.

Third-party sharing and Data Processors: Identification of categories of third parties with whom personal data is shared (payment gateways, cloud storage providers, analytics services, marketing platforms), the purposes of sharing, and whether the third parties are Data Processors under contractual agreements. Cross-border data transfers — permissible subject to Central Government notification under Section 16 of the DPDP Act 2023 — must be disclosed with details of the destination countries.

Security practices: Description of technical and organisational security measures implemented — encryption in transit and at rest, access controls, regular security audits, IS/ISO/IEC 27001 certification (if obtained), and incident response procedures. Section 8(5) of the DPDP Act 2023 requires Data Fiduciaries to implement reasonable security safeguards.

Data Principal rights: Clear explanation of each right under Sections 11–14 of the DPDP Act 2023 — right to information (Section 11), right to correction and erasure (Section 12), right to grievance redressal (Section 13), right to nominate a person to exercise rights after death or incapacity (Section 14), and right to withdraw consent (Section 6). Instructions for exercising each right must be specific and actionable.

Children's data policy: Under Section 9 of the DPDP Act 2023, processing personal data of children (under 18 years) requires verifiable parental consent. The policy must describe the consent verification mechanism and confirm that the service does not knowingly collect data from children without consent.

Data Protection Board complaint mechanism: Contact details and URL for lodging a complaint with the Data Protection Board of India established under Section 18 of the DPDP Act 2023, after the Grievance Officer fails to resolve the complaint satisfactorily.

Policy updates: The date of last revision, the procedure for notifying Data Principals of material changes, and confirmation that continued use of the service after notification constitutes acceptance. Forms-legal.com provides this Privacy Policy template for Indian businesses of all sizes, covering mandatory requirements under the DPDP Act 2023, IT Act 2000, and SPDI Rules 2011.