1.1 Understanding Privacy Policies
A privacy policy is more than a legal requirement -- it is a contract of trust between an organization and its users. When drafted effectively, it protects the organization legally while building user confidence. When drafted poorly, it creates liability and erodes trust.
What is a Privacy Policy?
A privacy policy is a legal document that discloses how an organization collects, uses, stores, shares, and protects personal data. Under DPDPA 2023 and GDPR, it must be:
- Clear and Plain Language: Understandable by ordinary users without legal training
- Comprehensive: Covering all data processing activities
- Accessible: Easily locatable and available before data collection
- Accurate: Reflecting actual data practices (not aspirational)
- Updated: Revised when practices change materially
Section 5 of DPDPA mandates that Data Fiduciaries provide notice to Data Principals containing: (a) personal data being collected, (b) purpose of processing, (c) manner of exercising rights, and (d) manner of making complaints. This forms the statutory minimum for privacy policies in India.
Legal Framework for Privacy Policies
| Jurisdiction | Key Requirement | Penalty for Non-Compliance |
|---|---|---|
| India (DPDPA 2023) | Notice under Section 5 | Up to Rs. 200 Crore |
| EU (GDPR) | Articles 13-14 transparency | Up to 4% global turnover / EUR 20M |
| USA (CCPA/CPRA) | Notice at collection | $7,500 per intentional violation |
| India (IT Rules 2011) | Rule 4 privacy policy | Compensation under S.43A IT Act |
Many organizations copy privacy policies from competitors or use generic templates without customization. This creates significant legal risk because the policy may not reflect actual data practices, creating a gap that regulators and litigants can exploit.
1.2 Website Privacy Policies
Website privacy policies must address the unique characteristics of web-based data collection including cookies, analytics, form submissions, and third-party integrations.
Essential Components
- Identity and Contact: Name, address, and contact details of the Data Fiduciary. Include DPO contact if applicable.
- Data Collected: Specific categories -- name, email, IP address, device information, browsing behavior, etc.
- Collection Methods: Forms, cookies, pixels, analytics tools, third-party integrations.
- Purpose of Processing: Each purpose must be specific and lawful -- service delivery, marketing, analytics, legal compliance.
- Legal Basis: Consent, contract, legal obligation, legitimate interest (GDPR) or consent/legitimate use (DPDPA).
- Data Sharing: Categories of recipients, especially third-party processors and cross-border transfers.
- Retention Period: How long data is kept and criteria for determining retention.
- User Rights: Access, correction, erasure, portability, objection -- with exercise mechanism.
- Security Measures: General description of technical and organizational measures.
- Cookie Policy: Types of cookies, purposes, and consent mechanism.
Website Privacy Policy Template Structure
Use layered disclosure: a short-form summary at the top highlighting key points (what data, why, and rights), with detailed sections below. This improves readability while maintaining legal completeness.
Cookie Consent Requirements
Under both DPDPA and GDPR, cookies that are not strictly necessary require prior consent:
- Strictly Necessary: No consent required (authentication, security, load balancing)
- Functional: Consent required (language preferences, personalization)
- Analytics: Consent required (Google Analytics, Hotjar, etc.)
- Marketing: Consent required (advertising, retargeting pixels)
1.3 Mobile App Privacy Policies
Mobile applications present unique privacy challenges due to device permissions, background data collection, and app store requirements. Drafting requires attention to platform-specific guidelines.
App-Specific Data Collection
Mobile apps can access data that websites cannot. Your privacy policy must address:
- Device Permissions: Camera, microphone, contacts, calendar, location, photos, storage
- Device Identifiers: IMEI, advertising ID, device fingerprint
- Background Collection: Location tracking, health data, activity monitoring
- Push Notifications: Notification content and personalization
- In-App Purchases: Transaction data and payment information
- Third-Party SDKs: Analytics, crash reporting, advertising networks
Apple App Store: Requires App Privacy Labels disclosing data collection. Privacy policy URL mandatory. Google Play Store: Data Safety section required. Privacy policy mandatory for apps handling personal/sensitive data. Non-compliance leads to app removal.
Additional App Privacy Policy Clauses
When reviewing app privacy policies, create a permission audit: list every permission requested, the specific feature requiring it, and whether it's essential or optional. Regulators increasingly scrutinize over-permissioning.
1.4 Employee Privacy Policies
Employee privacy policies require a different approach than consumer policies. They must balance organizational interests in monitoring and security with employee privacy expectations and labor law requirements.
Unique Considerations for Employee Data
- Consent Limitations: Employee consent is often not freely given due to power imbalance. Reliance on legitimate interest or legal obligation is often more appropriate.
- Monitoring Disclosures: Email, internet, CCTV, GPS, and keystroke monitoring must be disclosed with clear boundaries.
- Sensitive Data: Health records, biometrics, background checks, disciplinary records require enhanced protection.
- Retention Challenges: Employment records may need to be retained for years post-employment for legal compliance.
- Cross-Border HR: Multinational employers must address data flows between group companies.
Covert monitoring of employees without prior notice can result in: (1) evidence being inadmissible in disciplinary proceedings, (2) claims of breach of privacy under Article 21, and (3) potential criminal liability under IT Act Section 66E if visual images are captured.
Employee Privacy Policy Structure
Employee privacy policies should be: (1) provided at onboarding with acknowledgment, (2) incorporated by reference in employment contracts, (3) accessible on the company intranet, and (4) reviewed annually. The acknowledgment should confirm reading and understanding, not consent to all processing.
1.5 Drafting Best Practices
Beyond legal compliance, effective privacy policies require attention to language, structure, and maintenance processes.
Language and Readability
- Plain Language: Avoid legalese. Write at 8th-grade reading level where possible.
- Active Voice: "We collect your email" not "Your email may be collected"
- Specific Language: "Google Analytics" not "third-party analytics"
- Avoid Hedging: "We share data with partners" not "We may share data"
- Define Terms: Define technical and legal terms in a glossary section
Structural Best Practices
- Executive Summary: One-paragraph summary of key points at the top
- Table of Contents: For policies longer than 2 pages
- Layered Approach: Short-form notices linking to full policy
- Visual Aids: Tables for data categories, icons for rights
- Version Control: Date, version number, change log
Maintenance Process
"The best privacy policy is one that accurately reflects what you do with data, written so clearly that your grandmother could understand it, and maintained so diligently that your regulator cannot fault it." Adv. (Dr.) Prashant Mali
Part 1 Assessment
Test your understanding of privacy policy drafting
Section 5 of DPDPA requires notice to contain: (a) personal data collected and purpose, (b) manner of exercising rights, and (c) manner of making complaints. While disclosing third-party sharing categories is good practice, listing specific processor names and contacts is not a statutory requirement under Section 5.