By country

Privacy Policy Generator India

The Digital Personal Data Protection Act 2023 and its Rules - consent notices, Consent Managers and verifiable parental consent.

Generate your privacy policy Read the privacy policy guide

An Indian privacy policy has to be built around consent notices rather than around a lawful-basis table, because the DPDP Act does not offer the bases a GDPR document is structured on. The notice itself is a regulated artefact with a prescribed content list.

India’s Digital Personal Data Protection Act 2023 replaced the older IT Rules framework with a consent-centric statute. It applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India.

The Act is structurally different from GDPR. There is no legitimate interests basis: processing rests on consent or on a defined set of "legitimate uses". Notices must be standalone, plain, and available in English or any of the languages in the Eighth Schedule of the Constitution. A new intermediary role, the Consent Manager, is registered with the Data Protection Board.

The children’s rules are unusually strict. Verifiable parental consent is required for anyone under eighteen, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited outright rather than merely restricted.

What a privacy policy in India has to cover

An itemised description of the personal data and the purpose, presented with the consent request
The right to withdraw consent, and a withdrawal route as simple as the grant
The grievance officer’s name and contact, plus the route to the Data Protection Board
Verifiable parental consent for anyone under eighteen, and the prohibition on tracking children
Availability of the notice in English and Eighth Schedule languages on request

How India actually moves personal data

Consent notices as standalone artefacts

The DPDP notice cannot be buried in a longer policy - it must be a clear, standalone communication itemising the data, the purpose and the rights, presented alongside the request for consent.

Multilingual delivery

Data principals may require the notice in any Eighth Schedule language, which turns translation into a compliance obligation rather than a nicety.

Consent Managers

A registered intermediary through which people can give, manage, review and withdraw consent. If you integrate with one, that relationship needs describing.

Grievance redressal

Both the DPDP Act and the IT Rules require a route to raise a complaint with the business before escalating - the Act to the Data Protection Board, the Rules to a named grievance officer.

Cross-border transfers

Permitted by default except to countries the Government restricts by notification, which inverts the GDPR model of default prohibition with exceptions.

Third parties the draft will ask you about

Razorpay · PayU · Paytm · UPI rails · AWS ap-south-1 · Zoho · Delhivery · MSG91 · Google Workspace

The rules that apply

DPDP Act 2023

Consent or legitimate uses as the only bases, itemised notice requirements, and penalties up to ₹250 crore for failures to prevent a breach.

DPDP Rules

Operational detail on notice content, Consent Manager registration and obligations, breach reporting to the Board, and retention limits for classes of data fiduciary.

Verifiable parental consent

Required for all users under eighteen, with tracking and targeted advertising to children prohibited.

Significant Data Fiduciaries

A designation bringing extra duties: a Data Protection Officer based in India, independent audits and algorithmic due diligence.

IT Rules 2021

Intermediary obligations that continue to apply, including a published privacy policy, grievance officer and takedown timelines.

What the generated privacy policy contains

Identity and contact details of the controller
Your legal entity, trading name, registered address and a working contact route - plus a representative or DPO where one is required.
Categories of personal data and their sources
What you collect directly, what you observe automatically, and what you receive from third parties such as payment providers or ad platforms.
Purposes and lawful basis, purpose by purpose
A table that pairs each processing purpose with its lawful basis rather than listing all six bases and hoping one fits.
Recipients and sub-processors
The categories of recipient, and for the ones that matter to users - payment, hosting, analytics, support - the named provider.
International transfers and their safeguards
Where data leaves its home jurisdiction, and the mechanism relied on: adequacy, standard contractual clauses, the UK addendum or IDTA.
Retention periods per data category
Concrete periods or the criteria used to set them, which is what regulators ask for first when a complaint lands.
Rights and how to exercise them
Access, rectification, erasure, portability, objection and restriction, with the actual route to make a request and the deadline you work to.
Complaints and supervisory authority
The regulator a user can escalate to, named, with a link - not a generic "your local authority".

DPDP implementation order

Rebuild consent capture around itemised notices
One notice per purpose, standalone, in plain language, with a withdrawal route as easy as the grant.
Set the age gate to eighteen
And build a verifiable parental consent flow that does not itself over-collect.
Name a grievance officer and publish response times
Required by the IT Rules and expected under the Act’s redressal duty.
Assess whether you are a Significant Data Fiduciary
If designated, appoint an India-based DPO and schedule independent audits.
Plan for multilingual notices
At minimum English plus the languages of your largest user bases.

Where this usually goes wrong

Relying on legitimate interests

There is no such basis in the DPDP Act. A GDPR-shaped policy that leans on legitimate interests describes a basis Indian law does not recognise.

Age-gating at thirteen

The Indian threshold is eighteen, with verifiable parental consent below it. This is the widest child-protection band of any major regime.

Burying the notice inside the privacy policy

The Act requires a standalone, itemised notice presented with the consent request.

No grievance officer named

The IT Rules require the name and contact of a grievance officer to be published, with response timelines.

Behavioural advertising to under-eighteens

Prohibited, not merely consent-gated. Ad targeting stacks that rely on age-agnostic profiling are non-compliant by default.

Frequently asked questions

Does the DPDP Act apply to companies outside India?

Yes, where the processing relates to offering goods or services to data principals in India. Physical presence is not required.

Is there a legitimate interests basis in Indian law?

No. Processing rests on consent or on the enumerated legitimate uses - employment, emergencies, legal obligations and similar. The GDPR balancing test has no equivalent.

What is a Consent Manager?

A registered intermediary that lets people give, manage, review and withdraw consent across services through a single interface. It is a distinctive feature of the Indian regime.

What age counts as a child under the DPDP Act?

Under eighteen. Verifiable parental consent is required, and tracking and targeted advertising directed at children are prohibited.

Is a privacy policy legally required?

If you process personal data, in almost every market yes. GDPR and UK GDPR require the disclosure at the point of collection, CCPA/CPRA requires a notice at collection plus an annually reviewed policy, and app stores and payment processors require a public policy URL before they will list or onboard you.

Can I copy another company’s privacy policy?

It is both a copyright problem and a compliance problem. A copied policy describes someone else’s data flows, processors and retention periods, so it is inaccurate the moment you publish it - and an inaccurate transparency notice is itself a breach of GDPR Article 13.

How often does a privacy policy need updating?

Whenever your processing changes - a new analytics tool, a new payment provider, a new market - and as a backstop, review it annually. CPRA makes the twelve-month review explicit.

Does PolicifyAI give legal advice?

No. PolicifyAI is a technology provider, not a law firm. The output is a structured, jurisdiction-aware draft that a qualified adviser should review before you rely on it.