Do we need a privacy policy under the DPDP Act?
The Act's specific requirement is a notice accompanying the request for consent, telling the Data Principal what personal data is sought, for what purpose, how to exercise their rights and how to complain. A published privacy policy is the normal way of making that information available, but a generic policy on its own does not satisfy the notice obligation if the person was never shown it at the point consent was taken.
The distinction matters because notice is tied to a moment. If your consent record cannot show which notice, in which version and language, the person saw when they agreed, the consent is materially weaker.
Practically: version your notices, present the relevant one at the point of collection, and bind each consent record to the version displayed.
General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.
Related questions
Priya Gupta — Priya writes on compliance operations at ProtectComply, including data principal rights, grievance handling and sector-specific programmes.
Where do you stand under DPDP?
Take the free readiness check and find out in 10 minutes.
Start free readiness check →