A privacy policy is more than a page placed in the footer of a website. It explains how a business collects, uses, stores and shares personal information. For organisations operating in India, understanding the privacy policy requirements has become increasingly important following the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

The legal framework is moving towards a more structured approach to privacy notices, consent, security, retention and individual rights. At the same time, sector specific regulations and international privacy laws may apply to particular businesses. A well drafted privacy policy should therefore reflect actual business practices rather than rely on a generic template.

What Is a Privacy Policy?

A privacy policy is a document explaining an organisation's practices concerning personal data. It normally tells users what information is collected, why it is collected, how it is used, who may receive it, how long it may be retained and how individuals can exercise applicable rights. The document serves an important transparency function. It also helps businesses establish a consistent internal approach to handling personal information. For Indian businesses, the privacy notice framework is increasingly connected with the statutory obligations of a Data Fiduciary under the DPDP Act. A Data Fiduciary is an entity deciding the purpose and means of processing personal data. A privacy policy should therefore be consistent with the organisation's actual processing activities.

Privacy Policy Requirements Under Indian Law

India's privacy framework has developed through several legal instruments. The Information Technology Act, 2000 and the Information Technology Rules, including the Sensitive Personal Data or Information Rules, 2011, established earlier privacy and security requirements. The DPDP Act, 2023 now provides a broader statutory framework for digital personal data. Section 5 of the DPDP Act requires a notice to accompany or precede a request for consent. The notice must inform the Data Principal about the personal data proposed to be processed, the purpose of processing, how specified rights may be exercised and how a complaint may be made to the Board. The DPDP Rules, 2025 provide more detailed requirements for such notices. This means businesses should not view a privacy policy as a static legal document. It should form part of the organisation's wider privacy governance system.

What Should a Privacy Policy Contain?

A good privacy policy should clearly identify the organisation responsible for processing personal data. The legal name of the business and appropriate contact details should be easy to find. It should explain the categories of personal data collected. Depending on the business, this could include names, contact details, account information, location information, transaction records, device information or information generated through use of a service. The policy should then explain the purposes for which each category is processed. Specific explanations are preferable to broad statements such as “for business purposes”. The notice should also explain relevant rights, consent withdrawal procedures and grievance mechanisms. Rule 3 of the DPDP Rules requires the notice to provide an itemised description of the personal data and the specified purpose for processing. It also requires information concerning rights, the manner of exercising those rights and complaints to the Board. The notice must be presented in clear and plain language.

Identity and Contact Details of the Business

Users should know who is collecting their information. A privacy policy should identify the relevant legal entity and provide a reliable privacy contact mechanism. Where a Data Protection Officer is legally required, the relevant contact details should be provided. This becomes especially important for corporate groups. A website may display one brand while another legal entity actually processes customer information. The privacy documentation should make the relationship clear.

Explain What Personal Data Is Collected

Businesses should describe the information they collect in understandable terms. This can include information supplied directly by customers, information generated through transactions and information collected automatically through websites or applications. The description should be sufficiently specific for an individual to understand the nature of the information involved. A business should also review whether every data field it collects is necessary. Collecting information simply because the technology allows it can increase privacy and security risks.

Explain Why the Information Is Collected

Purpose is one of the most important elements of an effective privacy notice. A business should connect data collection with a defined purpose. For example, an e commerce business may process contact details to deliver an order, payment information to complete a transaction and account information to manage the customer relationship. Separate purposes should not be hidden behind vague language. This is particularly important when businesses later introduce analytics, profiling, personalised marketing or artificial intelligence tools. A new use should be assessed against the original purpose and the applicable legal basis.

Consent Must Be Meaningful

Where consent is used as the basis for processing, it must satisfy the requirements of the DPDP Act. Section 6 states consent must be free, specific, informed, unconditional and unambiguous, with clear affirmative action. It must relate to the specified purpose and be limited to personal data necessary for that purpose. The request for consent must also use clear and plain language. Businesses should avoid confusing consent interfaces, pre selected choices and bundled permissions for unrelated activities. A user should understand what they are agreeing to. Where consent is withdrawn, the business must follow the statutory requirements concerning cessation of processing, subject to circumstances where continued processing is authorised or required by law.

Privacy Policies Must Match Actual Business Practices

One of the biggest weaknesses in privacy documentation is inconsistency. A policy may state personal data is retained for a specific period while the company's systems retain it indefinitely. It may say information is shared only with selected providers while several additional analytics services receive data. Such inconsistencies can undermine the value of the policy. Businesses should therefore conduct a data mapping exercise before drafting or updating the document. The legal team should understand how the website, application, CRM, payment systems, cloud platforms and marketing tools actually process information. The policy should describe reality rather than an idealised version of the business.

Data Sharing With Third Parties

Many organisations share personal information with service providers. These may include payment gateways, cloud hosting providers, customer support platforms, analytics companies, marketing platforms and outsourced service providers. The privacy policy should explain relevant categories of recipients and the purpose for sharing information. The business should also examine its contracts with these providers. Under Section 8 of the DPDP Act, a Data Fiduciary remains responsible for compliance concerning processing carried out by it or on its behalf by a Data Processor. A Data Processor may be engaged for activities related to offering goods or services only under a valid contract. A privacy policy therefore cannot replace appropriate vendor agreements.

Data Retention and Deletion

A privacy policy should explain how long personal information is retained or the criteria used to determine retention. The retention approach should be linked to business purposes and legal requirements. Section 8 requires a Data Fiduciary, subject to legal retention requirements, to erase personal data when consent is withdrawn or when it is reasonable to assume the specified purpose is no longer being served. The Data Fiduciary must also cause its Data Processor to erase relevant information. Businesses should therefore maintain internal retention schedules alongside their public privacy notices.

Security Measures and Data Breaches

A privacy policy should provide an appropriate explanation of security practices without revealing information which could itself create security risks. The DPDP Act requires Data Fiduciaries to implement appropriate technical and organisational measures and reasonable security safeguards to prevent personal data breaches. The DPDP Rules 2025 further specify security safeguards. Rule 6 includes measures such as encryption, masking, access controls, logs, monitoring, backups and appropriate contractual provisions concerning Data Processors. Businesses should also establish an internal breach response procedure. A privacy policy can explain how affected individuals will be informed where notification is required, but the operational response must be supported by technical and organisational processes.

Cookies and Online Tracking

Websites often collect information automatically through cookies, pixels, analytics tools and similar technologies. A business should identify the technologies it uses and explain their purposes where applicable. It should also distinguish essential functionality from analytics, advertising and other tracking activities where the relevant legal framework requires separate choices or disclosures. Cookie practices should match the actual configuration of the website. A privacy policy should not state cookies are used only for basic functionality if advertising platforms or analytics providers are also receiving information.

Privacy Policies for Mobile Applications

Mobile applications create additional considerations. An application may access device identifiers, location information, camera functions, contacts, photographs or other information depending on its functionality. The privacy documentation should accurately describe such collection and use. Businesses must also consider platform specific requirements. Google Play, for example, requires apps to provide a clear and accessible privacy policy and to disclose relevant data collection, use, sharing, security and retention practices. The policy should therefore be reviewed alongside the application's actual permissions and platform disclosures.

Children's Personal Data

Businesses serving children require additional care. Under Section 9 of the DPDP Act, a child means an individual who has not completed eighteen years of age. Processing a child's personal data requires verifiable parental or guardian consent, subject to the statutory framework. The Act also addresses processing likely to cause detrimental effects on a child's well being and restricts tracking, behavioural monitoring and targeted advertising directed at children, subject to specified exemptions. Businesses offering gaming, education, social, healthcare or other services likely to be used by children should assess these obligations before collecting information. The privacy policy alone will not satisfy these requirements. Product design, age assurance and consent mechanisms may also need to be considered.

International Data Transfers

A business may store or process personal data outside India. The DPDP Act generally permits transfer of personal data outside India subject to restrictions which may be imposed by the Central Government. Other laws may impose additional requirements. Businesses should therefore disclose relevant international processing practices where appropriate and understand the countries in which information is stored or accessed. If an organisation serves individuals in other jurisdictions, foreign privacy laws may also apply. For example, the GDPR contains its own transparency and international transfer requirements. A privacy policy should not make broad claims about international transfers without first understanding the organisation's actual technology and vendor arrangements.

Sector Specific Privacy Requirements

Not every business operates under the same regulatory framework. Financial institutions, payment businesses, insurers, healthcare organisations, telecommunications companies and other regulated entities may face additional requirements. For example, the RBI's framework for payment system data includes specific storage requirements in India. A business operating in this sector therefore needs to consider RBI requirements alongside the general DPDP framework. This is one reason generic privacy templates can create risk. A document suitable for an ordinary online retailer may be inadequate for a regulated financial or healthcare business.

Privacy Policy Requirements During the DPDP Transition

Businesses should pay close attention to the DPDP implementation timeline. The DPDP Act was enacted on 11 August 2023. The Central Government issued the commencement notification in November 2025, establishing a phased implementation structure. Certain provisions commenced immediately, some after one year and the principal operational provisions after eighteen months. The DPDP Rules 2025 follow a similar phased structure. Rules 1, 2 and 17 to 21 commenced upon publication. Rule 4 is subject to a one year period, while Rules 3, 5 to 16, 22 and 23 are subject to the eighteen month period. The eighteen month period runs from 13 November 2025, making 13 May 2027 the commonly calculated date for the principal requirements. This distinction matters. Businesses should avoid saying the entire DPDP framework is already operational. At the same time, waiting until 2027 to begin preparation would be commercially unwise.

When Should a Business Update Its Privacy Policy?

A privacy policy should be reviewed whenever there is a material change in data processing. Examples include launching a new product, introducing a new analytics platform, appointing a new processor, changing data retention periods, introducing targeted advertising, expanding internationally or using customer information for artificial intelligence. The policy should also be reviewed when legislation, rules or sector specific regulatory requirements change. Businesses should maintain version control and record significant changes. Where appropriate, affected users should be informed about material changes.

Common Privacy Policy Mistakes

A common mistake is copying a policy from another business. A document may look professionally drafted but describe services, technologies or data practices the business does not actually use. Another problem is excessive legal language. Users should be able to understand how their information is handled without needing specialist legal knowledge. Businesses also sometimes list every possible type of data without explaining why it is collected. This weakens transparency. Other frequent issues include outdated vendor lists, missing retention information, broken privacy contact channels, inconsistent cookie disclosures and failure to update the policy after launching new features. A privacy policy should be treated as a living compliance document.

Why Legal Review Matters?

A privacy policy sits at the intersection of technology, contracts, consumer communication and regulatory compliance. Legal review can help determine whether the document accurately reflects the organisation's processing activities and whether additional requirements apply because of the business model or sector. Professional privacy policy legal services can be particularly useful when a business is preparing for DPDP compliance, entering regulated markets, launching an application or handling international customer data. The objective should not be to make the document unnecessarily long. It should be accurate, understandable and aligned with the organisation's actual practices.

Privacy Policy as Part of Corporate Governance

A privacy policy works best when supported by internal controls. The business should know who owns privacy compliance, how customer requests are handled, how vendors are assessed, how personal data is deleted and how incidents are escalated. For growing organisations, privacy governance should connect with contracts, cybersecurity, human resources, procurement and product development. Broader corporate legal support for businesses can help organisations integrate privacy requirements with wider contractual and regulatory obligations rather than treating the policy as an isolated website document.

Penalties and Business Risk

Privacy compliance has financial consequences as well as reputational implications. The DPDP Act's Schedule provides penalties of up to ₹250 crore for certain failures concerning security safeguards. Other breaches carry maximum penalties depending on the obligation involved. A defective privacy policy may also expose a business to customer complaints, contractual disputes, regulatory scrutiny and difficulties during investor or enterprise due diligence. The precise consequences depend on the nature of the contravention and the applicable legal framework.

How to Build an Effective Privacy Policy?

The process should begin with a data audit. The business should identify what information it collects, where it comes from, why it is processed, who receives it, where it is stored and how long it remains in the organisation's systems. The next stage is to identify the applicable legal requirements. This should include the DPDP Act and Rules, relevant sector specific regulations and foreign laws where applicable. The privacy notice can then be drafted around the organisation's real processing activities. Finally, the business should establish a review process. Privacy compliance is not completed when a document is uploaded to a website. It requires continuing governance.

Conclusion

A privacy policy should be treated as an important part of a business's data governance framework, not as standard website boilerplate. The document should accurately explain what information is collected, why it is used, who receives it, how it is protected, how long it is retained and how individuals can exercise applicable rights. For Indian businesses, the DPDP Act 2023 and DPDP Rules 2025 have made privacy governance increasingly important. The phased implementation timeline provides businesses with an opportunity to review their data practices, update notices, strengthen consent mechanisms and establish appropriate internal controls before the principal obligations become operational.

Businesses should also remember that privacy compliance extends beyond the DPDP framework. Sector specific regulations, cybersecurity requirements, contractual commitments and foreign privacy laws can create additional obligations. The most reliable approach is to begin with the business's actual data flows and build the privacy policy around them. A clear policy supported by sound operational controls can improve transparency, reduce legal risk and strengthen customer confidence. Businesses should monitor the official Digital Personal Data Protection Rules resources published by MeitY for future implementation notifications and regulatory developments. The India Code legal database is also a useful government source for checking current legislation.

Frequently Asked Questions (FAQs)

Q1. Is a privacy policy legally required for every business in India?

The answer depends on the nature of the business and the data processing involved. Businesses processing digital personal data should assess the applicable statutory notice and transparency requirements rather than assume a privacy policy is merely optional website content.

Q2. What should a privacy policy include in India?

It should explain relevant personal data collected, purposes of processing, consent mechanisms where applicable, rights, grievance procedures, data sharing, retention and other information required by the applicable legal framework. Section 5 and Rule 3 of the DPDP framework are particularly important for consent notices.

Q3. Does the DPDP Act require consent for all personal data processing?

No. The Act provides for processing based on consent as well as specified legitimate uses. The appropriate legal basis should be assessed according to the processing activity.

Q4. Can a business use a free privacy policy template?

A template can provide a starting point, but it may not accurately reflect the organisation's data practices or sector specific requirements. A policy should be customised and reviewed before publication.

Q5. How often should a privacy policy be updated?

There is no universal interval suitable for every business. It should be reviewed whenever material changes occur in data collection, processing, sharing, retention, technology or applicable law.

Q6. Does a privacy policy need to mention third party vendors?

The policy should provide appropriate information about relevant sharing and recipients. Businesses should also maintain appropriate contracts with Data Processors. Section 8 requires processing by a Data Processor on behalf of a Data Fiduciary to be supported by a valid contract.

Q7. Should a privacy policy mention cookies?

Yes, where the website or application uses cookies or similar technologies. The disclosure should accurately reflect the technologies actually deployed and their purposes.

Q8. Does the privacy policy need to mention data retention?

Retention practices should be explained where required by the applicable framework, and businesses should maintain internal retention controls. The DPDP Act also contains obligations concerning erasure when the relevant purpose is no longer being served or consent is withdrawn, subject to legal requirements.

Q9. Does the DPDP Act apply to employee information?

The Act covers digital personal data, subject to its scope and exemptions. Certain processing for employment related purposes is addressed within the Act's legitimate use framework. Businesses should assess employee data separately from customer data because employment laws and internal HR requirements may also apply.

Q10. What happens if a privacy policy is inaccurate?

An inaccurate policy can create transparency, contractual and regulatory risks. More importantly, it can demonstrate a gap between documented practices and actual processing. The business should investigate the underlying data flows and correct both the operational practice and the privacy documentation.

Q11. When do the main DPDP privacy notice requirements become operational?

The principal operational provisions of the DPDP Act and Rules are subject to an eighteen month commencement period from November 2025. The commonly calculated date for these provisions is 13 May 2027. Businesses should monitor official Government notifications for implementation developments.

This update was released on 11 Sep 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.