Back to Module
1 of 3|Documentation & Compliance
video 20 min•Required Documents
Privacy Policy
The most visible document for your users.
🎯 Learning Objectives
- ▸ Understand the mandatory contents of a Privacy Policy
- ▸ Learn how to write it in plain language
- ▸ Avoid common mistakes in privacy policies
The Structure
A DPDPA-compliant privacy policy must cover specific areas. It should not be a copy-paste of a GDPR policy, as the laws are different.
- • What data we collect (Name, Email, etc.).
- • Why we collect it (Purpose).
- • Who we share it with (Third parties, Processors).
- • How long we keep it (Retention).
- • How we protect it (Security measures).
- • Your rights (Access, Correction, Erasure, etc.).
- • How to complain to the Data Protection Board.
Avoid legal jargon. Use clear, plain language. The DPDPA requires the notice to be understandable to an average person.
The "Specific Purpose" Rule
You cannot write "We use your data to improve our services" without explaining exactly what that means. The policy must specify the purpose (e.g., "We use your email to send weekly newsletters").
📖 Glossary
- Privacy Policy
- A statement or legal document that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer's data.
- Plain Language
- Writing that is easy to read and understand, avoiding complex technical or legal terms.
🔑 Key Takeaways
- The policy must be easily accessible.
- It must clearly state what data is collected and why.
- It must explain how users can exercise their rights.
📚 Further Reading
- DPDPA Section 5 — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...