Policies drafted from the Act, not from a GDPR template

What §5(3) requires a notice to say

Section 5 governs the notice that accompanies consent: an itemised description of the personal data, the purpose, how to exercise rights and how to complain, in plain language. Sub-section (3) is the one that catches Indian organisations out — the notice has to be available in English or any language listed in the Constitution's Eighth Schedule, at the data principal's option. A notice nobody in your customer base can read is not a notice.

So the generator does not produce a single document. It produces a notice whose content is itemised against the purposes you actually declared, and then publishes that notice in as many of the 22 languages as you turn on, each at its own public address. The English text is the source of record and every other language is derived from it.

The 33-document catalogue, and the six you need first

The catalogue seeds 33 document types across ten groups: governance, consent and notice, data lifecycle, rights, security, breach, third party, special categories, audit, and training. It is stored rather than hard-coded, so an administrator can edit the section outline for a type and every subsequent generation follows it.

Most organisations do not need 33 documents in week one. In practice the useful first pass is six.

• Privacy Notice Policy — the §5 notice itself, and the one your banner and preference centre link to.
• Consent Management Policy and Consent Withdrawal Procedure — how consent is obtained and how a withdrawal is actioned internally.
• Data Retention & Deletion Policy — the schedule the retention clocks are supposed to be enforcing.
• Data Breach Response Policy — the runbook the breach module assumes exists.
• Grievance Redressal Procedure — the process behind the officer you are required to publish.

Clause-to-section grounding, and what that guarantee is worth

Generation is driven by two inputs, not by a prompt. The first is your organisation profile — legal name, entity type, corporate identity number, registered state and address, operating cities, website, and the named DPO and grievance officer. The second is a structured questionnaire whose answers are mapped group by group, so the prompt for a security policy sees the security answers rather than all of them. Bulk generation refuses to start until the profile is complete and the questionnaire has been submitted, which is a deliberate block: a document generated from blanks reads fluent and says nothing.

Every generated section comes back with the statutory citations it relied on and the answer keys it drew from. Citations are then filtered against a whitelist of valid references — sections 1 to 44 of the Act, rules 1 to 22, and a short list of adjacent standards — and anything that does not match is dropped rather than printed.

Be clear about what that check does. It proves a citation is a real provision. It does not prove the provision says what the clause claims. That is exactly why every section arrives as a draft, carries its own rationale, and has to be accepted by a human before it can be approved. Where a fact is missing the model is instructed to leave a marked placeholder rather than invent one, and generated text is scrubbed of any organisation name that is not yours.

When your answers change, the affected clauses say so

Because each section records the answer keys it used, a change to those answers is detectable. After a document is approved, a drift check flags the specific sections whose inputs have since moved and marks them as needing refresh. You regenerate those sections rather than the whole document, and locked sections — the ones your counsel wrote by hand — are left alone.

The same mechanism runs the other way for uploaded documents. A policy you already have can be imported as PDF, Word, text or Markdown, pre-processed to strip cover pages, tables of contents and repeated headers, and then analysed section by section against the sections the Act requires for that document type. Findings carry a severity, a statutory reference, the passage they came from, and a suggested rewrite you can accept as a drafted clause.

Version control, named sign-off and publication

A document is drafted, sent for review with a named reviewer, approved with a typed name, an effective date and a review interval, and then published. Publishing supersedes any other published document of the same type, so there is exactly one live version and the rest are history. A new version forks a draft while the live one keeps serving, and an AI-drafted changelog suggests what to write in the amendment note.

Publication produces a public page per language at a stable address under your tenant slug, served as rendered content rather than a download, plus a branded PDF carrying your logo, your colours, a document control page, the version history and the amendment log. An append-only audit log records every creation, edit, regeneration, translation, review request, approval, publication and supersession with actor and before-and-after state.

One thing to know before you rely on this: the bulk publish path will approve outstanding drafts without a typed signature so that a first-time rollout is not blocked on 33 individual sign-offs. If your evidence story depends on every published document carrying an attested approver, publish from the document rather than in bulk.

Where generated policy work goes wrong

The failure modes here are organisational more often than technical.

• The questionnaire is filled in by whoever had time, so the security section describes controls the infrastructure team has never heard of. The document is internally consistent and externally false.
• Thirty-three documents are generated in an afternoon and none is ever approved, so the tenant has a full catalogue with nothing live. Published count, not generated count, is the number that matters.
• A policy is published in twelve languages and then edited in English only. Other languages are marked as needing translation, but nothing forces the re-run before someone reads the stale Bengali version.
• Retention periods in the written policy and retention periods on the consent purposes disagree, because two different people set them in two different screens.
• An approver types their own name on a document they wrote. Nothing in the workflow prevents author and approver being the same person; if your governance requires separation, enforce it outside the tool.

What the generator does not do

It is not legal advice and does not replace counsel. It drafts from your answers and the Act; it cannot tell you whether your lawful basis is defensible, whether you are a Significant Data Fiduciary, or whether a particular processing activity should happen at all.

It does not track amendments to the law by itself. The statutory reference the prompts are grounded in is maintained in the codebase and updated deliberately. When the Act or the Rules move, someone updates that reference and you regenerate — it is not a live feed.

It does not verify that a citation supports the clause attached to it. The validation confirms the section or rule number is real, and no more.

It does not produce certified translations, and the PDF export is English. Other languages publish as web content, which is the right surface for a notice a principal is meant to read, but it is machine translation with human editing available, not a sworn translation.