UPDATE - NOVEMBER 2025: The Digital Personal Data Protection Rules, 2025 (DPDP Rules) were notified by MeitY on 14 November 2025 and are now in force on a phased timeline: immediate effect from November 2025 for foundational provisions; Consent Manager Framework from November 2026; full compliance obligations (notices, security safeguards, breach notification, children's data protections, cross-border transfer rules) from May 2027. The Data Protection Board of India has been established. The references in this article to rules being finalised should be read as updated accordingly - the Rules are now notified and businesses should be building their DPDP compliance programme actively. A privacy policy is the document on your website that tells your users what personal data you collect, why you collect it, how you use it, how you protect it, and what rights they have over their data. Under India's Digital Personal Data Protection Act 2023 (DPDP Act), having a privacy policy is not optional - it is a legal requirement for any website or app that collects personal data from users in India.
The Dpdp Act 2023: What It Requires Of Data Fiduciaries
The DPDP Act governs the processing of digital personal data in India. A "data fiduciary" - any business or individual that determines the purpose and means of processing personal data - has specific obligations before and during the processing of personal data: CONSENT: Under Section 6 of the DPDP Act, a data fiduciary must obtain the free, specific, informed, unconditional, and unambiguous consent of the data principal before processing their personal data. Consent must be signified by a clear affirmative action - a pre-ticked box is not valid consent. NOTICE: Under Section 5 of the DPDP Act, a data fiduciary must give the data principal a notice in clear and plain language before or at the time of collecting personal data. The notice must state: the personal data being sought, the purpose of processing, and the data principal's right to withdraw consent. PRIVACY POLICY AS NOTICE: The privacy policy on your website serves as the DPDP Act notice requirement. It must be written in plain language, be easily accessible (typically linked in the website footer), and must cover all mandatory disclosures.
Section 1: Identity Of The Data Fiduciary
Full legal name, registered address, contact email, and (for Significant Data Fiduciaries) the name and contact details of the Data Protection Officer. Users must know who is responsible for their data.
List Every Category Of Personal Data Collected:
Data provided directly by users: name, email address, phone number, date of birth, address, payment information, identity documents Data collected automatically: IP address, device type, browser type, cookies, browsing behaviour on the website, location data (if collected) Data collected from third parties: social media login data, data from third-party analytics providers For each category, explain how it is collected - registration forms, cookies, transaction data, third-party integrations.
Section 3: Purpose Of Processing
State the specific, legitimate purpose for which each category of data is processed. Vague statements ("to improve our services") are inadequate. The DPDP Act requires the purpose to be specified precisely. Examples: Email address: to deliver order confirmations, shipping notifications, and (with separate consent) marketing communications Phone number: to verify account registration via OTP and to contact the user about their orders Payment information: to process the transaction; payment data is processed by our payment gateway [name] and is not stored on our servers Browsing behaviour: to personalise product recommendations on the website [if applicable]
Section 4: Legal Basis For Processing
Under the DPDP Act, the primary legal basis for processing personal data is consent. However, the Act recognises certain "legitimate uses" that do not require consent - including processing necessary to perform a contract with the data principal, to comply with a legal obligation, and certain government-mandated purposes. The privacy policy should state the legal basis for processing each category of data.
Section 6: Cross-Border Data Transfers
If personal data is transferred outside India - to cloud servers in the US or Singapore, to a parent company, or to international vendors - this must be disclosed. State: the countries to which data may be transferred, the safeguards in place (contractual, encryption, etc.), and compliance with any Central Government restrictions on cross-border transfers under Section 16 of the DPDP Act.
Section 7: Data Retention
How long is each category of personal data retained? The DPDP Act requires data fiduciaries to retain personal data only for as long as necessary for the specified purpose. Common retention periods: Account data: retained while the account is active; deleted within [X] months of account deletion Transaction data: retained for [5-7 years] for tax and accounting compliance Marketing data: retained until consent is withdrawn, and deleted within [X] days of withdrawal Cookies: session cookies expire at end of session; persistent cookies expire at [X] months
When to obtain a review
A review is especially useful when…
- — You are about to sign, send, rely on or respond to this document.
- — The draft was copied from an old template or another state.
- — There is money, property, business control, statutory deadline or reputation risk involved.
- — You need Surat/Gujarat-specific drafting, review or negotiation support.
Legal information notice
This article is general legal information for India and Gujarat. It is not a substitute for advice on your specific facts, documents, limitation period, stamp duty position or court strategy.