The Act asks for a notice, not a policy — and your privacy policy almost certainly cannot do the notice’s job.
They are different documents doing different jobs, and only one of them is named in the law.
Publish both. Just stop asking one of them to do the other’s work.
The practical consequence is specific. A single company-wide privacy policy, linked from the footer, cannot serve as the notice for a patient registration form, a job application and a marketing sign-up at once — because a notice is tied to this collection, for this purpose, at the moment it happens.
The writing is the last step, not the first. Starting with a draft is how you end up with a notice that describes somebody else’s business.
Every purpose placed: section 6 consent, or a named legitimate use under section 7. This is the step that shortens everything afterwards, and the one templates skip.
Standalone, itemised, in plain language, with the three routes named — one for registration, one for hiring, one for marketing, rather than one for the company.
Chosen from who actually walks through your door, not all twenty-two. Translating into languages nobody asks for is cost with no compliance return.
The section 5(2) notice owed to people who consented before the Act, drafted and planned for delivery — the obligation established businesses most often have not scoped.
Alongside those, the documents nobody sees but an auditor asks for first: the retention, access and breach-response policies, and a consent record designed so section 6(10) can actually be discharged. All of it in your words, and yours to edit afterwards.
Short list, and the failures are nearly always the same three: not standalone, not itemised, and missing one of the three routes.
Presented so it can be understood on its own, without reading your terms, your policy or anything else.
StandaloneAn itemised description of the personal data. “Contact details” is a category; name, mobile and address are items.
ItemisedThe purpose, with an itemised description of what the person actually gets from it. Not “to improve our services”.
PurposeHow to withdraw consent, how to exercise rights, and how to complain to the Data Protection Board. All three, named.
Three routesEnglish or any language in the Eighth Schedule, at the person’s option. Twenty-two of them, and you choose which you need.
LanguageYou must be able to demonstrate the notice was given and the consent was given. Having collected it is not the same as being able to show it.
ProvableThe last one changes how the other five are built. A notice you cannot later produce — in the version that was live on the day, in the language the person read — is a notice you cannot rely on. Which is why version history is a drafting decision, not a filing decision.
This one catches almost every established business, and almost nobody has a plan for it.
Where somebody consented before the Act commenced, you must give them a notice as soon as reasonably practicable. Not at renewal. Not next time they visit.
Every patient, customer, candidate and subscriber already on your records. For most businesses that is a far larger number than anyone signing up next year.
Sending the notice does not pause your business. You continue until the person withdraws — which is exactly why the notice has to explain how they can.
Tens of thousands of people, contact details of varying quality, several languages, and a record needed of who was reached and when.
The notice has to describe what you have been doing with their data, which means somebody has to establish that honestly before a word is written.
Asking anyway feels like the cautious choice. It is the opposite, and here is exactly why.
Consent carries a withdrawal right under section 6(4). Ask for consent to something you would lawfully continue under section 7 — treating a patient, paying an employee — and you have handed someone a switch you cannot honour when they flip it.
Section 6(1) requires it to be free, specific, informed, unconditional and unambiguous. Consent you cannot actually act on if refused is none of those, and section 6(2) makes any part that infringes the Act void to that extent.
A form with fourteen tick-boxes teaches people to tick everything. The two that genuinely needed a decision — marketing, a secondary use of their data — get the same two seconds of attention as the twelve that did not.
Every purpose gets placed: section 6 consent, or a named legitimate use under section 7. The notice is written afterwards, and it is shorter and more believable because that work was done first.
One rule that is not open to interpretation: withdrawal must be as easy as giving. If consent is one tap on a form, withdrawal cannot be “write to us and allow fourteen working days”. That is a design constraint on the form, not a line in a document.
Documents, in your own words, that your team can maintain after we stop being involved.
Drafted by Indian privacy practitioners, and yours to edit — not locked inside a tool you have to keep paying for.
The language is usually fine. It is standalone, itemised and the three routes that are missing — and no amount of rewriting fixes a document in the wrong place.
Almost certainly not, and it is the most common misunderstanding we meet. The Act names a notice under section 5, and Rule 3 requires it to be presented so it can be understood independently of any other information, in clear and plain language, with an itemised description of the personal data and the purpose. A company-wide policy linked from your footer is broad by design and covers everything at once — which is the opposite of itemised, and cannot be tied to the moment a particular person hands over particular data. Keep the policy; procurement teams and app stores expect one. Just do not let it stand in for the notice.
Yes. Section 5(2) says that where a person gave consent before the Act commenced, you must give them a notice as soon as reasonably practicable — informing them of the personal data and the purpose it has been processed for, how to exercise their rights and withdraw, and how to complain to the Board. The relief is that you may continue processing until they withdraw, so this is not a business interruption. It is a drafting and delivery exercise across your whole existing base, and it is the obligation established businesses are most likely not to have scoped at all.
No, and this is worth being blunt about because the instinct is so common. Consent under section 6 carries a withdrawal right under section 6(4). If you ask for consent to something you would lawfully continue under section 7 — treating a patient, running payroll — you have created a switch you cannot honour when somebody flips it. Section 6(1) also requires consent to be free and unconditional, and section 6(2) voids any part that infringes the Act, so consent you would ignore if refused was never valid consent. The first piece of work is sorting purposes by lawful basis. The writing comes after.
Section 5(3) gives the person the option of English or any language in the Eighth Schedule — twenty-two of them. That is an option they hold, not twenty-two documents you must publish on day one. In practice you choose from who you actually serve: a hospital in Indore needs Hindi and English before anything else, and a national platform needs a wider set. We help you decide honestly, because translating into languages nobody asks for is a cost with no compliance return, and missing the one your patients speak is the opposite.
You can, and for a simple business it may get you most of the way. The parts a template cannot supply are the ones that fail: the itemised list of what you collect, the purposes you pursue, whether each rests on consent or a legitimate use, and which of your forms and screens the notice has to appear on. A template is a shape. Most of the work is what goes in it, and a generic notice that does not describe your actual processing is worse than useless because it looks compliant.
Yes — retention, access control and breach response, written so your team can follow them rather than admire them. Worth knowing that the Act does not name these documents the way it names the notice; they exist because Rule 6 requires specific security safeguards, Rule 8 governs erasure, and Rule 7 sets what happens in a breach, and none of those can be discharged by people improvising. A policy nobody follows is evidence against you, so we keep them short enough to be followed.
Real client quotes, attributed by role and sector — we never name a client.
Working across
It is the one document the Act names, the first thing anyone will look at, and the cheapest thing on this site to get right.
Thank you — we have it. Someone will reply by email, usually within one working day.
Nothing else is needed from you. If it is urgent, email tushar@ruleexpert.com and it will reach the same people.
RuleExpert