Privacy Policy Checklist Data Collection, Sharing and Retention

You download an app, tap I Agree, and move on. Most people in India do exactly this. But that single tap can hand over your name, phone number, location, browsing habits, and sometimes even payment details to a company you know very little about.

With India’s Digital Personal Data Protection Act the DPDP Act, passed in August 2023 and made fully operational through the DPDP Rules notified by MeitY in November 2025, every website and app that collects your data must now follow a clear set of rules. Whether you are a regular user who wants to know what you are agreeing to, or a small business trying to write a proper policy document, this privacy policy checklist covers the three areas that matter most: what data is collected, how it is shared, and how long it is kept.

Why a Privacy Policy Is Not Just a Formality Anymore

Before the DPDP Rules came into effect in November 2025, most privacy policies in India were copy-pasted legal documents that nobody read. The Ministry of Electronics and Information Technology has issued the final rules for the Digital Personal Data Protection Act, formally setting India’s data protection law into motion, with penalties for confirmed violations that can reach ₹250 crore per occurrence. Not informing users about a data breach can attract a separate fine of up to ₹200 crore, and violations of other policy requirements can cost a company up to ₹50 crore.

This means a company’s privacy policy is no longer just text on a webpage. It is a legal commitment, and the Data Protection Board of India has the authority to act on it.

The Privacy Policy Checklist Data Collection, Sharing and Retention

1. What Data Is Being Collected

A trustworthy policy will name the exact types of data it collects. Look for these on the checklist:

Full name, phone number, and email address
Device information phone model, operating system, IP address
Location data, if the app requests it
Payment details if you make a purchase
Cookies and browsing behaviour on the site

The DPDP Act is guided by seven core principles including consent and transparency, purpose limitation, data minimization, accuracy, storage limitation, security safeguards, and accountability. The data minimisation rule means a company can only collect data that is genuinely needed for the service it offers. If a simple news app asks for your exact GPS coordinates, that is a warning sign.

The policy must also say why each type of data is collected. Vague statements like for better service do not meet the current legal standard. You should see specific purposes listed for each data point.

What good looks like: We collect your phone number to send OTP verification during login.
What bad looks like: We collect information to improve your experience.

2. How Your Data Is Shared

This is the section most people overlook. Even if a company does not sell your data, it may share it with analytics tools, advertising networks, or delivery partners. A complete policy will tell you:

Which third parties receive your data payment gateways, delivery partners, ad networks, cloud hosting providers
Whether your data goes outside India some companies store data on servers in the USA or EU
Whether data is shared within a group of companies

Rule 15 of the DPDP Rules 2025 allows data fiduciaries to transfer personal data outside India, though this opens the door for future limitations tied to foreign government access. A policy must disclose any such transfer clearly.

One practical tip if a privacy policy lists specific third-party services by name like a payment gateway or customer support tool, that is a good sign. Generic phrases like trusted partners with no names listed are a red flag.

Online platforms, including gaming sites, often work with payment processors, identity verification services, and customer support tools. A platform that offers a lotus365 win product should clearly name each partner and state exactly what data those partners receive and why.

3. How Long Your Data Is Kept

Data retention is one of the weakest areas in most Indian privacy policies. Many still say things like we keep your data as long as needed, which tells you nothing useful.

The DPDP Rules set timelines for data retention and erasure of personal data, and once consent is withdrawn, personal data must be deleted unless a legal obligation to retain data applies.

A well-written retention section might look like this:

Data Type	How Long It Is Kept
Account information	Until account is closed
Transaction records	5 years Indian tax law requirement
Customer support chats	2 years after ticket closure
Login logs and session data	90 days

If a platform runs automated services such as a lotus365 bot, its privacy policy should also clarify what data that automated service processes and for how long it stores interaction records.

What to Check Before You Sign Up

Here is a quick checklist you can run through in under two minutes:

Does the policy name specific data types, or does it use vague language?
Is a clear purpose given for each type of data collected?
Are third-party names listed, or does it just say partners?
Is there mention of data going outside India?
Are retention periods given for each data category?
Can you request deletion of your data, with a contact provided?
Is a grievance officer named, with contact details in India?

Under the DPDP Act, every company must appoint a grievance officer in India, and build a self-service privacy page or at minimum a dedicated email address that actually responds. If a privacy policy has no contact for complaints, the company may not be compliant.

When to Be Especially Careful

If a platform handles financial transactions, health information, or data from users under 18, the stakes are higher. Under the DPDP Act, minors are persons below 18 years of age, and platforms must determine if they are accessible to minors before collection begins, as verifiable parental consent is required.

For any platform where money changes hands, check that the company names an Indian grievance officer and explains how to escalate a complaint to the Data Protection Board if the company does not respond within a reasonable time.

FAQs

A data fiduciary is any company or individual that decides why and how personal data is collected and processed. If you sign up on a website, that website becomes the data fiduciary for your account data. The DPDP Act places most compliance obligations on data fiduciaries, not on the user.

Not freely. Under the DPDP Rules 2025, companies can share your data with third parties only for the specific purpose they told you about. Sharing data for unrelated purposes requires separate consent. You also have the right to withdraw consent at any time, after which your data must be deleted unless a law requires the company to hold it.

If a company holds your data longer than necessary without a valid reason, it may be violating the DPDP Act. You can raise a complaint with the company’s grievance officer first. If that does not lead to a resolution, you can escalate to the Data Protection Board of India.

For financial transactions, Indian tax law generally requires records to be kept for six to eight years. A good privacy policy mentions this specifically as the legal basis for holding financial data beyond the normal service period.

Operating without one is a violation under the DPDP Act for any platform that processes digital personal data of Indian users. You can choose not to use the platform, or raise a complaint through MeitY’s official grievance channels. Platforms without a visible, accessible policy should be treated with caution.