DPDP-Compliant Privacy Policy

• Itemized data list: exactly which personal data you collect (name, phone, email, address, payment details, and so on), item by item, not "we may collect certain information"
• Specific purposes: why each item is collected and how it will be used, linked purpose by purpose
• User rights: how Data Principals can access, correct, and erase their data, and withdraw consent at any time

• Grievance contact: a designated contact for complaints, with grievances resolved within 90 days (see our page on the DPDP grievance redressal mechanism)
• Board complaint procedure: how a user can escalate to the Data Protection Board of India after exhausting your grievance route
• Plain language: written so a normal customer understands it, not dense legalese

A template downloaded from the internet describes someone else's data practices, not yours. It usually fails on every DPDP test at once: it doesn't itemize the data your business actually collects, doesn't state your real purposes, doesn't name your grievance contact, ignores the Data Protection Board complaint route, and offers no Indian language versions.

There's a bigger problem too. Under the DPDP Act, a privacy policy page alone was never enough anyway: you need working systems behind it, such as consent records, deletion workflows, and breach reporting. A polished policy sitting on top of non-compliant systems is a promise you can't keep, and the Board reads it exactly that way.

Our approach: we map your actual data first, then write the notice to match reality, alongside the consent notice format and workflows that make it enforceable.