Your website could have a detailed privacy policy and still fail the Digital Personal Data Protection (DPDP) notice requirements.
Rule 3 requires privacy notices to be understandable independently of other information.
The notice must clearly explain:
- What personal data will be processed.
- Why it will be processed.
- What goods, services or uses the processing enables.
- How consent can be withdrawn.
- How Data Principal rights can be exercised.
- How complaints can be made to the Data Protection Board.
A generic link to a lengthy privacy policy may not satisfy these requirements.
The takeaway: Review the actual notices presented when requesting consent, not just the privacy policy published on your website.
This article is general information, not legal advice.