- +91 80768 85539
- info@expertvuw.com
- Pan-India service available.
Home / Contracts & Documents / Privacy Policy Drafting
Last updated: 2 October 2026
Every website or app that collects personal data needs a clear privacy policy — and the Digital Personal Data Protection Act now sets specific notice and consent requirements. Expertvuw’s team maps your data flows and drafts a privacy policy and notices that match how your business actually uses data.
The Digital Personal Data Protection Act, 2023 (DPDP Act) applies to digital personal data processed in India and to processing outside India that offers goods or services to people in India. The DPDP Rules, 2025 were notified on 13 November 2025 with a phased start: consent manager provisions from November 2026, and the core obligations — notice and consent, data principal rights, security safeguards and breach intimation — from 13 May 2027.
Under the Act, a data fiduciary must give a clear notice describing the personal data collected and the purpose, obtain free, specific and informed consent (or rely on a permitted legitimate use), allow consent to be withdrawn as easily as it was given, enable access, correction and erasure, provide a grievance officer, and protect data with reasonable security safeguards. Penalties can reach ₹250 crore for failing to maintain security safeguards.
Until the core obligations apply, the IT Act’s reasonable security practices rules continue to matter. A privacy policy should describe your real practices — copying another company’s policy creates risk rather than reducing it.
Basis: Digital Personal Data Protection Act, 2023; Digital Personal Data Protection Rules, 2025 (notified 13 November 2025, phased commencement); Information Technology Act, 2000 and related rules. Last updated: 27 September 2026.
DPDP Rules, 2025 notified on 13 November 2025.
Notice, consent, rights, security and breach intimation apply from 13 May 2027.
Must be free, specific, informed and withdrawable.
Access, correction, erasure and grievance redressal.
Up to ₹250 crore for failing to maintain security safeguards.
The policy must match actual data handling.
Privacy policies often fail because they are copied.
o
u
o
Privacy policies connect with these services.
Website and app terms.
Cookie notices and consent.
EU data protection.
Information security management.
Map data collected and flows.
Compare with DPDP requirements.
Prepare the policy and notices.
Set up consent and rights handling.
Publish on website and app.
Update as rules and practices change.
Privacy compliance is ongoing.
p
r
r
e
Share your query and our team will reply during business hours.
Businesses collecting personal data need to give notice of their practices; the DPDP Act makes notice and consent requirements explicit.
The DPDP Rules were notified on 13 November 2025; core obligations apply from 13 May 2027.
Up to ₹250 crore for failing to take reasonable security safeguards, with other penalties for other breaches.
No. The policy must describe your own data practices accurately.
It applies to processing outside India that offers goods or services to people in India.
ACS – Director, Expertvuw Management Pvt Ltd
Agreements and policies are drafted by Expertvuw’s team for your review and negotiation. Where you need a legal opinion, dispute advice or representation, it is provided by independent advocates. Expertvuw is a corporate services company, not a law firm.