Data Privacy Policy Template India

DATA PRIVACY POLICY TEMPLATE (INDIA)

THIS DATA PRIVACY POLICY (the "Agreement") is entered into as of this [Day] day of [Month], [Year] (the "Effective Date") by and between:

[Company Name], a company incorporated under the Companies Act, 2013, having its registered office at [Registered Address] (hereinafter referred to as the "Company", which expression shall, unless repugnant to the context or meaning thereof, be deemed to mean and include its successors and permitted assigns);

AND

[User/Data Principal Name], an individual/entity residing at/having its principal place of business at [Address] (hereinafter referred to as the "Data Principal").

1. RECITALS

(A) The Company is engaged in the business of [Description of Business]. (B) In the course of such business, the Company collects, processes, stores, and transfers "Personal Data" and "Sensitive Personal Data" (as defined under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023). (C) The Data Principal wishes to access/use the services provided by the Company, and the Company requires the Data Principal’s consent to process such data in compliance with applicable Indian laws.

2. OPERATIONAL DEFINITIONS

1. "Applicable Law" means all statutes, enactments, acts of legislature or parliament, laws, ordinances, rules, by-laws, regulations, notifications, guidelines, or policies as applicable in the Republic of India, including but not limited to the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.
2. "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
3. "Processing" in relation to personal data, means a manual or automated operation or set of operations performed on personal data, and includes activities such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, use, alignment or combination, indexing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure, or destruction.
4. "Data Fiduciary" refers to the Company, which determines the purpose and means of processing of personal data.
5. "Sensitive Personal Data" shall have the meaning ascribed to it under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

3. SUBSTANTIVE TERMS AND OBLIGATIONS

1. Consent: The Data Principal hereby grants free, specific, informed, unconditional, and unambiguous consent to the Company to process their Personal Data for the purposes of [Purpose, e.g., service delivery, billing, marketing].
2. Data Minimization: The Company shall process only such Personal Data as is strictly necessary for the purposes specified in Clause 3.1.
3. Security Standards: The Company represents and warrants that it has implemented "Reasonable Security Practices and Procedures" as defined under Section 43A of the IT Act, 2000, including encryption, access controls, and periodic audits to protect Data Principal’s information.
4. Data Retention: The Company shall retain Personal Data only for as long as is necessary to satisfy the purpose for which it was collected, or as required by law, subject to a maximum retention period of [Number] years unless otherwise mandated by statutory authorities.
5. Data Principal Rights: The Data Principal shall have the right to: (i) access the summary of personal data being processed; (ii) request correction or erasure of inaccurate or incomplete data; and (iii) withdraw consent at any time, subject to legal constraints.

4. DEFAULT, TERMINATION, AND REMEDIES

1. Breach: Any unauthorized disclosure, loss, or misuse of Data Principal’s information by the Company, or any fraudulent misrepresentation of data by the Data Principal, shall constitute a "Material Breach".
2. Notice and Cure: In the event of a breach, the non-breaching party shall provide written notice to the breaching party. The breaching party shall have 30 (thirty) business days to cure said breach to the reasonable satisfaction of the non-breaching party.
3. Termination: If the breach remains uncured after the 30-day period, the non-breaching party may terminate this Agreement immediately upon written notice.
4. Remedies: Upon termination, the Company shall, at the option of the Data Principal, delete or return all Personal Data in its possession, save for records required to be maintained under the Companies Act or other mandatory Indian laws.

5. BOILERPLATE LEGAL PROVISIONS

1. Severability: If any provision of this Agreement is held to be invalid or unenforceable, such provision shall be severed, and the remaining provisions shall continue in full force and effect.
2. Entire Agreement: This document constitutes the entire agreement between the parties regarding the subject matter hereof and supersedes all prior agreements or understandings.
3. Force Majeure: Neither party shall be liable for any failure to perform its obligations where such failure results from any cause beyond its reasonable control, including acts of God, war, or governmental regulation.
4. Governing Law: This Agreement shall be governed by and construed in accordance with the laws of the Republic of India.
5. Dispute Resolution: All disputes arising out of or in connection with this Agreement shall be settled through binding arbitration administered by a sole arbitrator appointed in accordance with the Arbitration and Conciliation Act, 1996. The seat of arbitration shall be [City/State], India.

6. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the parties have executed this Agreement as of the date first above written.

FOR THE COMPANY: Signature: __________________________ Name: [Signatory Name] Title: [Title, e.g., Authorized Signatory] Date: [Date]

FOR THE DATA PRINCIPAL: Signature: __________________________ Name: [Data Principal Name] Date: [Date]