India: what the rules require

The policy or notice must state the personal data collected, the specific purpose of processing, how to withdraw consent, how to exercise rights and raise grievances, and how to complain to the Data Protection Board.

Basis: DPDP Act Section 5 and Rule 3 of the DPDP Rules 2025 require a clear, standalone, plain-language notice; Section 5(3) requires an option to view it in English or an Eighth Schedule language.

How to meet it: Add an itemised list of data categories mapped to each purpose, followed by short sections on withdrawing consent, exercising rights, grievances and complaining to the Data Protection Board of India. Offer the notice in English and the relevant Indian languages.

The policy must explain that consent is free, specific, informed and unambiguous, limited to the stated purpose, and can be withdrawn at any time as easily as it was given, with processing stopping after withdrawal.

Basis: DPDP Act Section 6, including Section 6(4) on withdrawal with comparable ease; Section 8(7) requires erasure once consent is withdrawn unless law requires retention.

How to meet it: State the exact channel for withdrawing consent (for example a settings toggle or link) and confirm that it takes no more effort than giving consent. Explain that processing stops and data is erased within a defined period unless retention is legally required.

The policy must explain that individuals can request access to, or a copy or summary of, their personal data and how it is processed, and how to submit that request.

Basis: DPDP Act Section 11; UAE PDPL Articles 13 to 18; DIFC Law Article 33(1) (free, within one month); Saudi PDPL Article 4; Qatar PDPPL (right to review); Oman PDPL (right to obtain a copy); ADGM and Bahrain PDPL access rights.

How to meet it: List access as a named right with the request channel, identity checks and expected response time, for example one month in DIFC and 30 days under Qatar guidelines.

The policy must explain how individuals can ask for inaccurate data to be corrected or updated and for data to be erased, and when erasure may be refused.

Basis: DPDP Act Section 12; DIFC Law Article 33(2); Saudi PDPL Article 4; UAE PDPL Articles 13 to 18; Qatar PDPPL (alter or delete); Oman PDPL (rectify, update, erase, block); ADGM rights to correction and deletion.

How to meet it: Add named sections for correction and erasure, the request method, and the legal grounds for refusing erasure (for example legal retention duties).

The policy must tell Data Principals they can nominate another individual to exercise their rights in the event of death or incapacity, and explain how to register a nominee.

Basis: DPDP Act Section 14 gives Data Principals the right to nominate; Rule 14 of the DPDP Rules requires fiduciaries to publish how rights are exercised.

How to meet it: Add a sentence such as: You may nominate another person to exercise your rights if you die or become incapacitated; to register a nominee, [method].

The policy must describe the grievance redressal mechanism, how to raise a grievance, the response time (no later than 90 days) and the right to approach the Data Protection Board after using it.

Basis: DPDP Act Sections 8(10) and 13; Rule 14 of the DPDP Rules 2025 requires grievances to be resolved within a reasonable period not exceeding ninety days.

How to meet it: Add a grievance section naming the contact, the form or email, the committed response time (90 days or less) and that unresolved grievances can be taken to the Data Protection Board of India.

The policy must state that personal data of anyone under 18 is processed only with verifiable parent or guardian consent, that the business does not track, behaviourally monitor or target ads at children, and that guardian consent is obtained for persons with disabilities.

Basis: DPDP Act Section 9 (verifiable consent; ban on tracking, behavioural monitoring and targeted advertising directed at children); Rules 10 and 11 of the DPDP Rules 2025.

How to meet it: Add a children's data section that sets 18 as the age threshold, describes the verification method (for example DigiLocker tokens or existing identity data) and states that no tracking or targeted ads are directed at children.

The policy must state that data is erased once the purpose is served or consent is withdrawn, that users get at least 48 hours' notice before erasure where Rule 8 applies, and that personal data, traffic data and logs are retained for at least one year.

Basis: DPDP Act Section 8(7); Rule 8 of the DPDP Rules 2025 (48-hour notice, minimum one-year retention of logs, and a three-year limit for large e-commerce, social media and online gaming platforms).

How to meet it: Publish a retention schedule per data category, the trigger for erasure, the 48-hour pre-erasure notice and the one-year minimum log retention. Large platforms should state the three-year inactivity rule.

The policy must describe the technical and organisational measures used to protect personal data, such as encryption, access control, logging, backups and staff confidentiality.

Basis: DPDP Act Section 8(5) and Rule 6; Saudi PDPL Article 19; Qatar PDPPL Article 13 (cited by NCSA in Binding Decision No. 3 of 2025); DIFC, ADGM, UAE, Bahrain and Oman security obligations.

How to meet it: Add a security section naming the main controls (encryption in transit and at rest, role-based access, logging and monitoring, backups, staff training). Avoid absolute promises such as 100 percent secure.

A security policy must require logs of all ICT systems to be enabled and kept for a rolling 180 days within India, and system clocks to be synchronised with NIC or NPL NTP servers or sources traceable to them.

Basis: CERT-In Directions of 28 April 2022 issued under Section 70B(6) of the IT Act, 2000, in force since 28 June 2022.

How to meet it: State that all ICT system logs are retained for at least 180 days on infrastructure in India and shared with CERT-In on request, and that clocks sync to NIC or NPL NTP servers.

The policy must commit to notifying the Data Protection Board without delay and with a detailed report within 72 hours, and to informing each affected Data Principal without delay with the nature, impact, mitigation and a contact.

Basis: DPDP Act Section 8(6) and Rule 7 of the DPDP Rules 2025 (detailed report within seventy-two hours unless the Board allows longer).

How to meet it: Add an incident response clause: initial notice to the Board without delay, detailed report within 72 hours, and plain-language notice to every affected user covering what happened, likely impact, steps taken and a contact person.

A security or incident policy must require reportable cyber incidents to be reported to CERT-In within 6 hours of noticing them and must name a point of contact for CERT-In.

Basis: CERT-In Directions of 28 April 2022 under Section 70B(6) IT Act; non-compliance is punishable under Section 70B(7).

How to meet it: Add a step requiring reports to CERT-In within 6 hours, independent of any DPDP breach notice, and record the designated CERT-In point of contact.

The policy must disclose whether personal data is transferred outside India and confirm transfers will not go to any country the Central Government restricts.

Basis: DPDP Act Section 16 (Government may restrict transfers to notified countries); Rule 15 of the DPDP Rules 2025; Rule 13 may require Significant Data Fiduciaries to keep specified data in India.

How to meet it: List the countries or regions where data is stored or accessed and commit to stopping transfers to any jurisdiction the Government restricts.

The policy must state that processors and vendors handle personal data only under a binding written contract covering instructions, security, confidentiality, sub-processing and deletion or return.

Basis: DPDP Act Section 8(2) (processors only under a valid contract); UAE PDPL Article 8; DIFC Law Article 24 (written agreement, prior authorisation for sub-processors); ADGM written contract duty; Bahrain PDPL Article 8.

How to meet it: Add a vendors section describing the categories of processors used, the written data processing agreements in place, sub-processor approval and that vendors must notify you of breaches without undue delay.

The policy must prominently publish the business contact details of the Data Protection Officer, or of a person who can answer questions about processing, and Significant Data Fiduciaries must name a DPO based in India.

Basis: DPDP Act Section 8(9) and Section 10(2); Rule 9 of the DPDP Rules 2025 (prominent publication on website or app).

How to meet it: Add a contact block with the DPO or responsible person's name or title, email and postal address, displayed prominently on the website and app.

If designated a Significant Data Fiduciary, the policy must commit to an annual DPIA and independent audit, an India-based DPO and checks that algorithmic software does not risk Data Principals' rights.

Basis: DPDP Act Section 10; Rule 13 of the DPDP Rules 2025 (annual DPIA and audit, algorithmic due diligence, possible localisation of specified data).

How to meet it: Add a governance clause covering annual DPIAs, an independent data audit, algorithm risk checks and reporting of findings to the Data Protection Board.

The policy must explain which cookies and trackers are used, their purposes and providers, and how users accept, refuse or withdraw consent for non-essential ones.

Basis: No dedicated cookie law was verified in these jurisdictions (DLA Piper confirms none in Saudi Arabia), so general notice and consent rules apply; Bahrain Resolution No. 48 of 2022 says consent required as a condition of browsing is invalid, and DPDP Section 9(3) bans tracking of children.

How to meet it: Add a cookie section or separate cookie policy listing cookies by category, purpose, provider and duration, with a banner that lets users refuse non-essential cookies as easily as they accept them.