Privacy Policy Under the DPDP Act: What Indian Businesses Must Include

Here is a fact that catches most Indian businesses off guard: the DPDP Act never uses the words "privacy policy." Not once. The law requires something it calls a notice, and the rules for that notice are specific enough that the generic privacy policy most companies copied off the internet, usually a GDPR template with "EU" swapped for "India", does not meet them.

That gap matters, because the burden of proving you gave a valid notice sits entirely on you. This guide explains whether the DPDP Act requires a privacy policy, how a privacy policy and a DPDP notice relate, exactly what the law says your notice must contain, and how to write one that holds up.

Does the DPDP Act Require a Privacy Policy?

The DPDP Act does not require a document called a "privacy policy." It requires a "notice" under Section 5, given before or at the time you ask someone for consent. A privacy policy and a DPDP notice are not the same thing: a privacy policy is the broad public document explaining your data practices, while the DPDP notice is a specific, consent-linked disclosure the law mandates by content and form.

In practice, most organisations satisfy the notice obligation inside their privacy policy, or link to it at the point of consent. That is fine. What is not fine is assuming a generic privacy policy automatically contains everything the DPDP notice must say. It usually does not.

Privacy Policy vs DPDP Notice

	Privacy Policy	DPDP Notice (Section 5)
What it is	A general public document describing your data practices	A specific disclosure tied to a consent request
Required by name?	No (a business norm and customer expectation)	Yes, the Act mandates it
When shown	Always available, usually a footer link	Before or at the time consent is requested
Governed by	General expectation and good practice	Section 5 of the Act and Rule 3 of the Rules
Must be itemised?	Not strictly	Yes, an itemised list of data and purposes

What Your DPDP Notice Must Include

Section 5 and Rule 3 of the DPDP Rules 2025 set out what a compliant notice must contain. Strip away the legal language and it comes down to a short, non-negotiable list.

Rule 3 then adds requirements about form, not just content:

• The notice must be self-contained. A person should be able to understand it without reading any other document.
• It must use clear, plain language, not dense legalese.
• It must give itemised descriptions, not a vague catch-all like "we collect data to improve our services."
• It must include working communication links so the individual can actually withdraw consent, exercise rights, and complain.

For the full mechanics of consent and notice, including how this interacts with consent withdrawal, see our consent and notice chapter.

The Language Rule Everyone Gets Wrong

This is the single most common error we see, and it is worth stating precisely.

Beyond the Notice: What Your Privacy Policy Should Still Cover

The notice is the legally mandated core, but a privacy policy that only contains the notice is thin. Several other DPDP obligations are most naturally documented in your privacy policy, and customers and auditors will expect to see them:

• DPO or contact details. Section 8(9) and Rule 9 require you to publish the contact details of your Data Protection Officer or an authorised person, prominently on your website or app.
• Grievance redressal. You must describe an effective mechanism for individuals to raise concerns and get a response.
• Retention and erasure. Explain that data is erased when consent is withdrawn or the purpose is fulfilled, whichever is earlier.
• Data Principal rights. Set out the rights to access, correction, and erasure, and how to use them. Our Data Principal rights chapter covers these in full.
• Breach contact. Who an individual can reach for more information, which connects to your breach notification process.

Common Privacy Policy Mistakes Under the DPDP Act

• Reusing a GDPR policy unchanged. GDPR has six lawful bases for processing; the DPDP Act has essentially two (consent and certain legitimate uses). A GDPR policy describes a legal framework that does not apply here.
• Burying the notice in legalese. Rule 3 explicitly demands plain language and self-containment. A wall of text fails on its own terms.
• No itemised list. "We collect personal information" is not itemised. You must specify the categories and the purpose for each.
• Forgetting the burden of proof. If a dispute arises, you must prove the notice was given and valid consent obtained. Keep records of what notice was shown, when, and to whom.

How to Write a DPDP-Compliant Privacy Policy

1. Map your data first. List every category of personal data you collect and the specific purpose for each. The itemised notice is impossible without this map.
2. Write the notice core against the three-point list above, in plain language, self-contained.
3. Add the supporting sections: DPO contact, grievance mechanism, retention, rights, breach contact.
4. Wire the links so withdrawal, rights requests, and Board complaints actually work.
5. Offer the language option (English or an Eighth Schedule language) at the point of consent.
6. Keep the evidence: log which version of the notice was shown and when, so you can discharge the burden of proof.

The Bottom Line

The DPDP Act does not ask for a "privacy policy" by name, but it absolutely requires the substance of one, delivered as a Section 5 notice with specific, itemised, plain-language content and working links. A generic template will not get you there.

Treat your privacy policy as the wrapper and the DPDP notice as the legally mandated core inside it. Map your data, write the notice precisely, support it with the DPO, grievance, retention, and rights sections, and keep proof that you showed it. That is the difference between having a privacy policy and meeting the law.

Frequently Asked Questions

For the full section-by-section breakdown of consent and notice, see our DPDP Act 2023 complete guide.