Data privacy (DPDP Act, 2023) · Template
Most Indian privacy policies are GDPR text with the country name changed. The DPDP Act, 2023 uses its own vocabulary — data fiduciary, data principal, consent manager — and imposes its own duties, and a policy that never mentions them is evidence that nobody read the Act it claims to comply with.
Quick Statutory Answer
Does the DPDP Act apply to my small business? The Act applies to the processing of digital personal data within India, including data collected offline and later digitised, and to processing outside India in connection with offering goods or services to data principals in India. In practice that reaches almost any business with a website, an app, a CRM or a customer database — size is not the test.
The full text of this document as VidhiSar drafts it, with every blank shown in square brackets. Copy it or download it as a Word file and fill it in yourself — or answer a few questions and VidhiSar fills it in and prints a formatted PDF. Clauses that apply only in some cases are left out here; the drafting flow adds them when your answers call for them.
PRIVACY POLICY
Effective Date: [Policy Effective Date] Last Updated: [Policy Effective Date]
BUSINESS IDENTITY
[Your Business Name] ("We", "Our", "Company") is a [Business Type] registered in India, operating at [Registered Business Address] and reachable at [Official Contact Email].
1. SCOPE AND APPLICABILITY
This Privacy Policy ("Policy") describes how [Your Business Name] collects, uses, stores, processes, and discloses your personal data in accordance with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology (Amendment) Act, 2008, and applicable Rules and Regulations framed thereunder.
2. PERSONAL DATA WE COLLECT
We collect the following categories of personal data: [Types of Personal Data Collected]. This data is collected when you interact with our business through [Collection Channels].
3. PURPOSE OF PROCESSING
Your personal data is processed solely for the following purposes: [Purpose of Data Processing]. We shall not process your data for any other purpose without your prior explicit consent.
4. LEGAL BASIS FOR PROCESSING
We process your personal data on the following lawful bases as recognized under Section 4 of the DPDP Act, 2023: (a) Consent freely given by you prior to collection; (b) Legitimate interests of the business, which do not override your fundamental privacy rights; and (c) Compliance with applicable legal obligations.
5. DATA SHARING AND THIRD PARTIES
We may share your personal data with: [Third Parties Data is Shared With]. All third parties with whom we share data are contractually bound to maintain equivalent data protection standards. We do not sell your personal data.
6. DATA RETENTION
We retain personal data only as long as necessary for the stated purpose or as required under applicable law. Upon expiry of the retention period or upon your valid request, data is permanently deleted or anonymised.
7. YOUR RIGHTS AS A DATA PRINCIPAL
Under Sections 11–14 of the DPDP Act, 2023, you are entitled to: (a) Access a summary of personal data processed; (b) Correct or update inaccurate data; (c) Erasure of your data upon withdrawal of consent; (d) Nominate a representative for data rights; and (e) Lodge a grievance with our Grievance Officer.
8. GRIEVANCE REDRESSAL
For any data privacy concerns, contact our Grievance Officer at: [Grievance Officer / Privacy Contact Email] within 30 days. We shall resolve all grievances within 30 working days. If unresolved, you may escalate to the Data Protection Board of India (DPBI).
9. DATA SECURITY
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with IS/ISO/IEC 27001 best practices.
10. AMENDMENTS
We reserve the right to update this Policy. Material changes shall be notified via [How Will Users Be Notified of Changes?] at least 15 days before taking effect.
For queries: [Official Contact Email] | [Registered Business Address]
What the law behind this document actually requires.
| Essential Clause | Legal Purpose & Protection | Governing Law / Benchmark |
|---|---|---|
| The categories of personal data collected | Specific categories, not 'information about you'. A data principal cannot exercise a right over a category they were never told about. | DPDP Act, 2023 — the Schedule |
| The purpose of each processing activity | The Act is built around processing for a stated, lawful purpose. Purpose is what a consent notice attaches to, so a policy that lists data without purposes cannot support the consent it relies on. | DPDP Act, 2023 — s. 8(5) |
| How rights are exercised | Access, correction, erasure and grievance redressal each need a route the reader can actually use — an address and a realistic response window, not a general contact form. | DPDP Act, 2023 — s. 8(6) |
| A named grievance contact | The Act contemplates a readily available means of grievance redressal. An unmonitored inbox is a compliance gap that surfaces at the worst moment. | DPDP Act, 2023 — ss. 11–13 |
| Third parties and processors | Say who receives the data and why. Each named processor should also sit behind a contract under s. 8(5). | DPDP Act, 2023 — the Schedule |
| Retention and deletion | How long data is kept and what triggers deletion. Indefinite retention is a position, and it should be a deliberate one. | DPDP Act, 2023 — s. 8(5) |
| How changes are notified | A policy that can change silently offers the reader nothing to rely on. | DPDP Act, 2023 — s. 8(6) |
The Act applies to the processing of digital personal data within India, including data collected offline and later digitised, and to processing outside India in connection with offering goods or services to data principals in India. In practice that reaches almost any business with a website, an app, a CRM or a customer database — size is not the test.
No. The DPDP Act uses its own concepts and duties — data fiduciary and data principal rather than controller and subject, its own consent notice requirements, its own breach intimation duty under s. 8(6), and its own rights under ss. 11 to 13. A GDPR policy will be missing those and will describe bases the Indian Act does not use.
The Schedule to the Act sets out financial penalties for different classes of breach, reaching up to ₹250 crore, and they apply per violation. The amount in any given case is determined by the Data Protection Board having regard to the factors the Act specifies.
If you collect names, phone numbers, addresses or payment details of individuals in India, you are processing personal data, and the channel does not change that. The obligations attach to the processing rather than to having a website.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.