{"id":1028,"date":"2022-10-14T20:41:25","date_gmt":"2022-10-14T20:41:25","guid":{"rendered":"http:\/\/sh007.global.temp.domains\/~studiobh\/veritaslegal\/?p=1028"},"modified":"2023-04-13T14:33:43","modified_gmt":"2023-04-13T14:33:43","slug":"elements-of-a-privacy-policy-in-india","status":"publish","type":"post","link":"https:\/\/veritaslegal.in\/staging\/elements-of-a-privacy-policy-in-india\/","title":{"rendered":"Elements of a Privacy Policy in India"},"content":{"rendered":"\n

Co-authored by Rahul Dwarkadas (Partner) | Rohini Jaiswal (Senior Associate)\u00a0<\/em><\/p>\n\n\n\n

1. Legal background <\/strong><\/p>\n\n\n\n

Data Privacy and Protection regime in India is presently regulated by the Information Technology Act, 2000 (\u201cIT Act 2000<\/strong>\u201d) in conjunction with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules<\/strong>“). <\/p>\n\n\n\n

2. Privacy Policy <\/strong><\/p>\n\n\n\n

In compliance with the IT Act 2000 and SPDI Rules, an organization is mandated to demonstrate its intent to receive, collect, store, process, transmit, protect and utilize personal data (\u201cPI<\/strong>\u201d) or sensitive personal data (\u201cSPDI<\/strong>\u201d) provided by its users during the course of its commercial activities via <\/em>a privacy policy[1]<\/sup><\/a>. The privacy policy must be easily accessible for such user via<\/em> publication on the website.<\/p>\n\n\n\n

3. Fundamental factors of a Privacy Policy<\/strong><\/p>\n\n\n\n

A few fundamental factors and pre-conditions to be kept in mind while drafting a privacy policy are as follows:<\/p>\n\n\n\n

i. Consent, Notice and Transparency<\/em><\/strong><\/p>\n\n\n\n

A privacy policy must be clear, unambiguous and must contain comprehensible statements of practices and policies adopted by the organization. The organization must obtain consent before collecting or using such information. Consent includes notions of \u2018notice<\/em>\u2019 and \u2018choice<\/em>\u2019. \u2018Notice<\/em>\u2019 denotes the manner in which the privacy policy is presented to the users whereas a \u2018Choice<\/em>\u2019 is expressly provided to opt-in and\/or opt-out of the information sharing requirements. <\/p>\n\n\n\n

ii. Definition Clause <\/em><\/strong><\/p>\n\n\n\n

A privacy policy should have comprehensive and explicit definitions of the general terms (such as data, users, SPDI etc.) used in the policy. <\/p>\n\n\n\n

iii. User Information<\/em><\/strong><\/p>\n\n\n\n

A privacy policy should illustrate the type of PI or SPDI being collected. <\/p>\n\n\n\n

iv. Purpose<\/em><\/strong><\/p>\n\n\n\n

A privacy policy must clearly identify, in unambiguous terms, the purpose of data collection. Further, it should have a data minimization clause to limit collection and processing to that which is relevant and reasonably necessary to accomplish legitimate commercial purposes. A change in the purpose triggers the requirement of notifying the users of such change.<\/p>\n\n\n\n

v. Sharing and storage of user data<\/em><\/strong><\/p>\n\n\n\n

An organization must obtain permission from users prior to disclosure of the collected PI \/ SPDI to third parties and\/or its affiliates, except where such disclosure is mandated under law. Further, it should have data retention clauses governing the period of retention and the manner of disposal once <\/em>the purpose is served.<\/p>\n\n\n\n

vi. Data security<\/em><\/strong><\/p>\n\n\n\n

The privacy policy must inculcate reasonable security practices and procedures adopted by the organization, including electronic and physical safeguards to maintain security and confidentiality of data through authorized access, browser encryption etc.<\/p>\n\n\n\n

vii. Notification of change <\/em><\/strong><\/p>\n\n\n\n

Additionally, an announcement via<\/em> email or website popups is required to reflect periodic reviews and updates in the policy. <\/p>\n\n\n\n

viii. Contact information<\/em><\/strong><\/p>\n\n\n\n

The privacy policy should contain email, postal and telephonic coordinates of the organization to address queries or exercise of the user\u2019s data protection rights.<\/p>\n\n\n\n

ix. Dispute Resolution<\/em><\/strong><\/p>\n\n\n\n

The SPDI Rules require appointment of a Grievance Officer[2]<\/sup><\/a> for users to report complaints or unsatisfactory reparation of the same by the organization.<\/p>\n\n\n\n

4. Conclusion<\/strong><\/p>\n\n\n\n

With the growing digital transformations in the manner conducting businesses, organizations must be prudent while drafting, designing and reviewing their privacy policy and should have a policy tailored to its business requirements which is in compliance with the law.<\/p>\n\n\n\n

\n\n\n\n

[1]<\/sup><\/a> Section 43 A, IT Act 2000.<\/p>\n\n\n\n

[2]<\/sup><\/a> Section 5(9), SPDI Rules.<\/p>\n","protected":false},"excerpt":{"rendered":"

Co-authored by Rahul Dwarkadas (Partner) | Rohini Jaiswal (Senior Associate)\u00a0 1. Legal background  Data Privacy and Protection regime in India is presently regulated by the Information Technology Act, 2000 (\u201cIT Act 2000\u201d) in conjunction with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules“).  2. Privacy…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24],"tags":[],"class_list":["post-1028","post","type-post","status-publish","format-standard","hentry","category-insights","entry","no-media"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/veritaslegal.in\/staging\/wp-json\/wp\/v2\/posts\/1028","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/veritaslegal.in\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/veritaslegal.in\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/veritaslegal.in\/staging\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/veritaslegal.in\/staging\/wp-json\/wp\/v2\/comments?post=1028"}],"version-history":[{"count":2,"href":"https:\/\/veritaslegal.in\/staging\/wp-json\/wp\/v2\/posts\/1028\/revisions"}],"predecessor-version":[{"id":1080,"href":"https:\/\/veritaslegal.in\/staging\/wp-json\/wp\/v2\/posts\/1028\/revisions\/1080"}],"wp:attachment":[{"href":"https:\/\/veritaslegal.in\/staging\/wp-json\/wp\/v2\/media?parent=1028"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/veritaslegal.in\/staging\/wp-json\/wp\/v2\/categories?post=1028"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/veritaslegal.in\/staging\/wp-json\/wp\/v2\/tags?post=1028"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}