Privacy Policy
A public document that explains how an organisation handles personal data.
A privacy policy is a public document in which an organisation explains how it collects, uses, shares, protects and deletes personal data. It is a general statement; the itemised notice shown when you ask for consent is a separate thing.
Meaning of Privacy Policy
A privacy policy is not the same as the notice required by the Act. The notice must be itemised, given at the point of asking for consent and tied to specific purposes. A policy is a broader statement. Most organisations publish both.
The DPDP Act does not use the phrase "privacy policy" as a legal requirement. What it requires is a notice under Section 5, which must accompany or precede each request for consent and, under Rule 3, be itemised and in clear, plain language. It must describe the personal data and the specific purpose, how the person can withdraw consent and exercise rights, and how to complain to the Board. A privacy policy is the longer, standing document that sits behind that notice on your website or app.
Most organisations still need one. Section 8(9) and Rule 9 require business contact information of a Data Protection Officer, or another person who can answer questions, to be published. Section 8(10) requires a grievance redressal mechanism, and Rule 14 expects the means of exercising rights to be published. A privacy policy is the natural home for these details, along with the retention approach, categories of recipients, cross-border transfers and a description of how children's data is handled under Section 9.
The policy must match reality. A document that promises deletion within 30 days while the systems keep data for years is worse than silence, because it can be treated as evidence of what you told people. It should also be consistent with the notice shown at each collection point, and with the requirement that consent requests be presented in plain language with the option to access them in English or an Eighth Schedule language.
Do not confuse it with other documents. An internal data protection policy is for staff and sets rules for handling data. A cookie policy covers trackers. Terms of service are the commercial contract. A privacy policy sits alongside these, written for the Data Principal. The Act gives no template, so a good policy is judged by clarity, accuracy and whether the person can understand what happens to their data.
Examples of Privacy Policy
A website footer links to a privacy policy, while the sign-up form shows a short itemised notice.
An online store publishes a policy with a short summary at the top, a table of purposes and retention periods, and a form for rights requests. The sign-up page carries a three-line itemised notice that links to the policy.
A hospital posts its policy at the registration desk and on its website, in English and Hindi. It names the privacy contact, explains how patient records are shared with insurers and says how long records are kept.
A game studio discovers that its policy copied from another company says "we never share data", though it uses an advertising SDK. It rewrites the policy, updates its notice and removes the SDK for players it believes may be under 18.
Why Privacy Policy matters
A policy that is vague, outdated or contradicted by practice is a liability. When a complaint reaches the Data Protection Board, the policy and the notice are among the first documents read, and a gap between what you say and what you do can support a finding of breach of the general obligations, with penalties of up to ₹50 crore after inquiry.
It also shapes trust. Customers, enterprise buyers and app store reviewers read policies. A clear one, written in the user's language, tells them you take privacy seriously and reduces the number of queries your support team has to answer.
How it works in practice
- 1Start from your data map. List what you collect, for which purposes, on which basis, who receives it and how long you keep it. The policy should be a plain-language rendering of that record.
- 2Use headings people can scan: what we collect, why, who we share it with, how long we keep it, your rights, how to withdraw consent, how to complain, children, contact details.
- 3Offer the policy in English and in the Eighth Schedule languages your users speak, and make the language switch easy to find.
- 4Link the policy from every collection point and keep the short itemised notice on the form itself, so the policy supports the notice and does not replace it.
- 5Show a version number and effective date, archive old versions and tell people about material changes, because you may need to show what a person saw on the day they consented.
- 6Review it whenever you add a vendor, feature or purpose, and at least once a year.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Copying a template from a foreign site. Such text often refers to GDPR concepts, such as legitimate interest, which the DPDP Act does not recognise.
Treating the policy as the notice. The Act expects an itemised notice at the point of asking for consent.
Using long legal language. A policy no one can follow does not support valid, informed consent.
Never updating it after adding new vendors or features, so the policy describes an older product.
Compliance tips
Test readability by asking someone outside the company to explain what the policy says in two minutes.
Keep one owner and one change log so the policy, notices and in-app prompts do not drift apart.
Add a short summary box at the top for readers who will not scroll.
Check each promise against the actual system before publishing.
Common questions about Privacy Policy
Is a privacy policy mandatory under the DPDP Act?
The Act does not name it as a requirement. It does require a notice, published contact details, grievance mechanism and information on how to exercise rights. In practice a privacy policy is the usual way to publish these, so almost every online business needs one.
What is the difference between a privacy policy and a privacy notice?
A notice is the itemised statement given when you ask for consent, tied to specific data and purposes under Section 5 and Rule 3. A policy is the wider standing document describing overall practices. They should agree with each other.
Can I reuse a GDPR privacy policy for India?
Not without changes. The structure may help, but the DPDP Act has different grounds, no legitimate-interest basis, its own breach and rights rules, and Board complaint routes. Rewrite the sections to match Indian law and your actual practice.
Which languages should a privacy policy be in?
Section 5(3) gives the person the option to see the notice in English or any Eighth Schedule language. The Act speaks of the notice, but offering the policy in the languages of your users is good practice and supports informed consent.