Privacy Policy Compliance for Indian Businesses
A Privacy Policy is a legal document that discloses how a business collects, uses, stores, and protects personal data. With India’s Digital Personal Data Protection Act (DPDPA) 2023 now in effect, every business that processes personal data of Indian residents must have a compliant privacy policy. Non-compliance can attract penalties up to ₹250 crores per violation.
From Aadhaar-linked KYC data at banks to customer browsing data on e-commerce platforms, Indian businesses handle vast amounts of personal data daily. A Hyderabad-based fintech startup was fined ₹5 crores by RBI for inadequate data protection practices, highlighting the real cost of non-compliance.
DPDPA 2023: Key Requirements for Privacy Policies
Consent Management
Obtain free, specific, informed, and unambiguous consent before processing personal data. Consent must be as easy to withdraw as to give. Maintain auditable consent records.
Purpose Limitation
Clearly state each purpose for which data is collected. Data cannot be used for purposes beyond what was consented to without fresh consent.
Data Principal Rights
Right to access, correction, erasure, and grievance redressal. Must provide these rights through an accessible mechanism within prescribed timelines.
Breach Notification
Notify the Data Protection Board and affected individuals of any personal data breach. Implement reasonable security safeguards to prevent breaches.
Sector-Specific Privacy Requirements
Beyond the DPDPA, Indian businesses must comply with sector-specific data protection rules:
- • Banking/Finance (RBI): Data localisation mandate—payment data must be stored in India. RBI Master Direction on IT Framework requires data encryption and access controls.
- • Healthcare: DISHA (Digital Information Security in Healthcare Act) draft mandates protection of digital health data. Telemedicine Guidelines require patient data confidentiality.
- • Telecom (TRAI): Subscriber data cannot be shared without consent. TRAI regulations on unsolicited commercial communication (DND registry).
- • Insurance (IRDAI): Policyholder data protection requirements. Third-party data sharing restrictions.
Key Takeaways
- ✓ DPDPA 2023 requires explicit, informed consent for all personal data processing
- ✓ Penalties up to ₹250 crores for non-compliance—privacy is a boardroom issue
- ✓ Appoint a Data Protection Officer for significant data fiduciaries
- ✓ Implement consent management platforms with audit trails
- ✓ Review sector-specific regulations (RBI, IRDAI, TRAI) alongside the DPDPA
Frequently Asked Questions
Does DPDPA apply to data processed outside India?
Yes, if the processing is in connection with offering goods or services to data principals in India. This has extraterritorial applicability similar to GDPR.
Is data localisation mandatory under DPDPA?
DPDPA allows cross-border transfer to all countries except those restricted by the government. However, sector-specific rules (e.g., RBI for payment data) may mandate localisation.