Category: Compliance

Privacy Policy Under DPDP Act and Rules 2025: Guide

Last updated: 18 October 2026

Short answer: An Indian website or app that collects personal data needs a privacy policy today, and will need a fuller, DPDP-style notice by 13 May 2027, when the main duties under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 begin. Until then, section 43A of the IT Act and the SPDI Rules, 2011 still require a published privacy policy and a grievance officer. A DPDP-ready policy must give an itemised list of the personal data you collect with the specific purpose for each, explain how users can withdraw consent as easily as they gave it, exercise their rights and complain to the Data Protection Board, and publish a contact person. Write it in clear language, available in English or any Eighth Schedule language the user chooses.

The timeline: what applies now and what applies later

The DPDP Rules, 2025 were notified on 13 November 2025 and come into force in three stages.

From	What comes into force	What it means for your website
13 November 2025	Definitions and the Data Protection Board	Start mapping what personal data you hold
13 November 2026	Registration and duties of Consent Managers	Relevant only if you will accept consent through a Consent Manager
13 May 2027	Notice, consent, security safeguards, breach intimation, erasure, children’s data, rights and grievances, cross-border transfer; section 43A of the IT Act is omitted	Your DPDP notice, consent flows, vendor contracts and breach plan must be live

In early 2026 the Ministry of Electronics and Information Technology consulted industry on shortening some of these periods. As on 18 October 2026 no change to the commencement dates has been notified. Do not wait: data mapping, consent screens and vendor contracts take months.

Until 13 May 2027: a body corporate handling “sensitive personal data or information” (passwords, financial details, health data, biometrics and similar) must publish a privacy policy, take written consent for sensitive data, use reasonable security practices, and appoint a grievance officer who redresses grievances within one month (SPDI Rules, 2011). A policy written for the DPDP Act can satisfy both regimes if you add a short transitional paragraph.

Who the DPDP Act covers

The Act applies to digital personal data of individuals processed in India, and to processing outside India in connection with offering goods or services to people in India. It covers data collected online, and data collected on paper and later digitised. It does not apply to an individual processing data for personal or domestic purposes, or to data that a person has made public herself.

Term	Meaning
Data Principal	The individual the data is about: your user or customer. For a child (under 18), it includes the parent or lawful guardian.
Data Fiduciary	You: the business deciding why and how data is processed.
Data Processor	A vendor processing data for you: hosting, e-mail, CRM, payment gateway, courier, call centre.
Consent Manager	A registered entity through which a person can give, manage and withdraw consent.

What a DPDP-compliant privacy notice must contain

Section 5 and rule 3 require the notice that accompanies or precedes a request for consent to:

Be understandable on its own, independently of your other terms.
Give, in clear and plain language, an itemised description of the personal data and the specified purpose of processing, with a description of the goods, services or uses enabled.
Give the specific link on your website or app, and any other means, by which the person can withdraw consent, exercise her rights and complain to the Board.

Add these items as well, because other provisions require them or users will look for them:

Contact details of a Data Protection Officer or of a person who can answer questions about processing (section 8(9), rule 9).
Grievance process and timeline: respond within a reasonable period not exceeding 90 days (rule 14).
Rights: access to a summary of data and the identities of those it was shared with, correction, completion, updating, erasure, grievance redressal and nomination (sections 11 to 14).
Sharing: categories of processors and other fiduciaries you share data with.
Retention: how long you keep each category, and that you will erase it when the purpose is served or consent is withdrawn (section 8(7)). Rule 8 also requires keeping certain logs and associated data for at least one year.
Security: a short description of safeguards such as encryption, access control and logging (rule 6).
Children: whether you serve users under 18 and how you obtain verifiable parental consent (section 9, rule 10).
Cookies: what you use and how to change choices.
Language: the notice must be available in English or any Eighth Schedule language, at the user’s option.

Free sample: itemised notice table

This table is the heart of a DPDP notice. Adapt the rows to what your site actually collects.

Personal data	Purpose	Legal basis	Kept for
Name, e-mail, mobile number	Creating and managing your account; sending order and service messages	Consent	Until you delete your account, plus [ ] months
Delivery address	Delivering your order	Voluntarily provided for this purpose (section 7(a))	[ ] years for tax and accounting records
Payment status and transaction ID (card details are handled by our payment gateway)	Confirming payment, refunds and accounting	Consent and compliance with law	As required by tax law
IP address, device and log data	Security, fraud prevention and keeping logs	Compliance with law and security obligations	At least one year (rule 8)
Analytics cookies	Understanding how the site is used	Consent through the cookie banner	[ ] months
Marketing preferences	Sending offers and newsletters	Separate, optional consent	Until you withdraw consent

How to withdraw consent or exercise your rights: Visit [link to your rights page] or write to [privacy e-mail]. Withdrawing consent is as easy as giving it. We will respond within [ ] days and in any case within 90 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.

Contact person for personal data questions: [Name or designation], [e-mail], [address].

Need the complete, editable set? The Lexfolio Website Legal Pack includes a DPDP-ready Privacy Policy and Notice, consent and checkbox wording, a cookie policy and banner text, terms of use, refund and shipping policies, a contact and grievance officer page, a rights request form, breach intimation formats and a short data processing agreement.

Consent done right

Consent must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action” (section 6(1)). Pre-ticked boxes, silence or continued browsing are not consent.
Ask for separate consent for optional purposes such as marketing. Do not bundle it with the terms of use.
Users must be able to withdraw consent as easily as they gave it (section 6(4)), and you must then stop processing within a reasonable time.
For some uses, consent is not needed: section 7 lists “certain legitimate uses”, such as where a person voluntarily gives data for a specified purpose (a phone number for delivery) and does not object.

Security, breaches and penalties

Security safeguards: reasonable measures including encryption or masking, access control, monitoring and logs, backups, and security clauses in processor contracts (section 8(5), rule 6).
Breach intimation: inform affected users and the Board of every personal data breach; a detailed report to the Board is due within 72 hours of becoming aware (rule 7).
Penalties (Schedule to the Act): up to Rs 250 crore for failing to take reasonable security safeguards; up to Rs 200 crore each for failing to report a breach or breaching children’s data duties; up to Rs 50 crore for other breaches.

Common mistakes

Copying a foreign (GDPR or US) policy that does not mention the DPDP Act, the Board or Indian grievance timelines.
A vague list such as “we may collect information” instead of an itemised table with purposes.
No working link for withdrawal of consent and rights requests.
Cookie banners with “Accept” but no equally visible “Reject”.
Forgetting vendors: you remain responsible for processing by your processors (section 8(1)), so sign data processing agreements.
Allowing under 18 users without a parental consent step, or running targeted advertising at children.

Get ready before May 2027. The Website Legal Pack is written for both the current IT Act regime and the DPDP Rules, with a launch checklist and shaded notes telling you what to delete after 13 May 2027.

Handling employee data too? See our guide to the appointment letter under the new Labour Codes and the POSH compliance checklist.

Frequently asked questions

Is a privacy policy mandatory for a website in India?

Yes, if you handle personal data. Under the SPDI Rules a body corporate handling sensitive personal data must publish one now, and from 13 May 2027 the DPDP Act requires a detailed notice before seeking consent.

When does the DPDP Act fully apply?

The main duties of Data Fiduciaries apply from 13 May 2027 under the DPDP Rules, 2025. Consent Manager provisions apply from 13 November 2026.

Can I use a privacy policy generator?

You can start with one, but make sure it has an itemised data and purpose table, Indian grievance timelines, a withdrawal link and the Board complaint route. Generic templates often miss these.

Do small businesses and blogs need to comply?

Yes. The DPDP Act has no general small business exemption, though the Government may notify exemptions for certain classes. A blog with a contact form or newsletter collects personal data.

What age counts as a child under the DPDP Act?

Anyone below 18. You need verifiable consent of a parent or lawful guardian, and you must not track, behaviourally monitor or target ads at children.

Do I need a separate cookie policy?

India has no separate cookie law, but cookies that collect personal data fall under the DPDP Act. A short cookie policy with a consent banner is the practical approach.

*This article is general information, not legal advice.*

18 October 2026

POSH Compliance Checklist for Indian Companies (2026)

Last updated: 18 October 2026

Short answer: Every employer with ten or more employees must constitute an Internal Committee (IC) at each office under the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 (the POSH Act). The core checklist is: a written POSH policy; a properly composed IC (senior woman Presiding Officer, at least half women, one external member, tenure up to three years); display of the IC order and penal consequences; regular awareness programmes and IC training; inquiries within the statutory timelines; an annual report to the employer and the District Officer; and, for companies, POSH figures in the Board’s report. Failing to constitute an IC can attract a fine of up to Rs 50,000, doubled with possible licence cancellation for a repeat offence.

Who must comply

The Act protects any woman at a workplace, employed or not: employees, interns, trainees, contract workers, visitors, clients and job applicants. “Employee” is defined widely to include regular, temporary, ad hoc and daily wage staff, workers engaged through contractors, probationers, trainees and apprentices, paid or unpaid.

“Workplace” covers Government and private bodies of every kind, hospitals, sports facilities, a dwelling where a domestic worker is employed, and any place visited by the employee during employment, including employer-provided transport. Treat client sites, business travel, offsite events and work-related online spaces as part of the workplace.

Ten or more employees: constitute your own IC at each office or administrative unit (section 4).
Fewer than ten employees, or complaint against the employer: complaints go to the Local Committee constituted by the District Officer (section 6). You still have duties to prevent harassment and support the complainant.

The Internal Committee at a glance

Requirement	Rule	Source
Presiding Officer	A woman employed at a senior level at the workplace (or from another office of the same employer if none is available)	Section 4(2)(a)
Employee members	At least two, preferably committed to the cause of women or with social work or legal experience	Section 4(2)(b)
External member	One person from an NGO or association committed to the cause of women, or a person familiar with sexual harassment issues (for example, with legal or social work experience)	Section 4(2)(c), rule 4
Gender balance	At least half the members must be women	Proviso to section 4(2)
Tenure	Not more than three years	Section 4(3)
Quorum for inquiry	At least three members including the Presiding Officer	Rule 7

Complaint and inquiry timelines

Step	Time limit	Source
Complaint by the aggrieved woman	Within 3 months of the incident (or the last incident in a series); extendable by up to 3 more months for recorded reasons	Section 9
Copy of complaint to respondent	Within 7 working days	Rule 7(2)
Respondent’s reply	Within 10 working days of receiving the copy	Rule 7(3)
Inquiry completed	Within 90 days	Section 11(4)
Inquiry report to employer	Within 10 days of completing the inquiry	Section 13(1)
Employer acts on recommendations	Within 60 days of the report	Section 13(4)
Appeal	Within 90 days of the recommendations	Section 18

Conciliation is possible only at the request of the aggrieved woman, and no monetary settlement can be the basis of conciliation (section 10). Neither party may be represented by a lawyer before the IC (rule 7). During the inquiry, on the woman’s written request, the IC can recommend her transfer or the respondent’s, leave of up to three months for her, or other interim relief (section 12, rule 8).

The POSH compliance checklist

No.	Requirement	Done
1	Written POSH policy adopted, circulated to all staff and published on the website or intranet	[ ]
2	IC constituted by written order at each office or unit, with correct composition	[ ]
3	External member qualified and appointed by a nomination letter covering fees and confidentiality	[ ]
4	IC tenure end date diarised (maximum three years) and fresh order issued in time	[ ]
5	IC order, member contacts and penal consequences displayed at a conspicuous place in every unit	[ ]
6	Workplace and IC details registered or updated on the SHe-Box portal	[ ]
7	Every new joiner given the policy and asked to sign an acknowledgement	[ ]
8	Awareness programmes for employees, and orientation and capacity building for IC members, held and recorded	[ ]
9	Sexual harassment listed as misconduct in service rules or standing orders	[ ]
10	Confidential complaint register kept, with timelines tracked for every case	[ ]
11	Annual report under section 21 and rule 14 sent to the employer and the District Officer	[ ]
12	Companies: POSH and maternity benefit disclosures included in the Board’s report	[ ]

Need the complete, editable set? The Lexfolio POSH Compliance Kit gives you a POSH policy, the order constituting the IC, the external member’s nomination letter, complaint and notice formats, interim relief and conciliation records, an inquiry report, the annual report, a display notice and an employee acknowledgement, plus a one-page Hindi policy summary.

The annual report and Board’s report disclosures

IC annual report (section 21, rule 14). In each calendar year the IC prepares a report for the employer and the District Officer, stating: the number of complaints received; the number disposed of; the number pending for more than 90 days; the number of workshops or awareness programmes held; and the nature of action taken. The Act does not fix one national filing date, and many District Officers set their own (often January for the previous year). File even a “nil” report.

Employer’s report (section 22). The employer must include the number of cases filed and their disposal in its annual report, or, if it does not prepare one, inform the District Officer.

Companies. The Companies (Accounts) Second Amendment Rules, 2025, effective from 14 July 2025, require the Board’s report to state the number of sexual harassment complaints received, disposed of, and pending for more than 90 days during the year, along with a statement on compliance with maternity benefit law and the number of female, male and transgender employees.

Duties of the employer under section 19

Provide a safe working environment, including safety from visitors and clients.
Display the penal consequences of sexual harassment and the order constituting the IC.
Hold workshops and awareness programmes at regular intervals, and orientation programmes for IC members.
Provide facilities to the IC, help secure the attendance of the respondent and witnesses, and give the IC the information it needs.
Help the woman if she chooses to file a criminal complaint, and initiate action under the criminal law against the perpetrator where appropriate.
Treat sexual harassment as misconduct and act on it.
Monitor the timely submission of IC reports.

Since 1 July 2024 the related offences are in the Bharatiya Nyaya Sanhita, 2023: sexual harassment (section 75), assault or criminal force to outrage modesty (section 74), voyeurism (section 77), stalking (section 78) and words or gestures insulting the modesty of a woman (section 79). The POSH process does not bar a criminal complaint.

What the Supreme Court has directed

In Aureliano Fernandes v. State of Goa, (2024) 1 SCC 632 (decided 12 May 2023), the Supreme Court found serious gaps in implementing the Act and directed verification that all public bodies and institutions have properly composed committees, publication of committee details and complaint procedures on websites, and regular training for committee members. In continuing proceedings, on 3 December 2024 the Court directed States to notify District Officers, constitute Local Committees and have District Officers survey whether organisations have set up ICs. Expect your District Officer or labour department to ask for your IC details.

The Ministry of Women and Child Development relaunched the SHe-Box portal on 29 August 2024 as a central platform for IC and LC information and for registering and tracking complaints. Register your workplace and keep the IC details current.

Common mistakes

A Presiding Officer who is not a senior woman, or a committee with fewer than half women.
No external member, or the company’s own lawyer acting as the external member.
Letting the IC’s tenure lapse without a fresh order.
Rejecting a complaint as late without considering the three month extension.
Pushing the complainant into conciliation, or settling with money.
Missing the 90 day inquiry limit and the 10 day reporting limit.
Discussing the case on e-mail groups or with the media, in breach of the confidentiality rule in section 16.
Not filing the annual report, or leaving POSH data out of the Board’s report.

Be audit ready. The POSH Compliance Kit includes a compliance calendar and every format an inspector, District Officer or auditor is likely to ask for, in editable Word and PDF.

Setting up HR documents as well? See our guide to the appointment letter under the new Labour Codes, and for website data practices, the privacy policy guide under the DPDP Act.

Frequently asked questions

Is POSH compliance mandatory for companies with fewer than ten employees?

They need not constitute an IC; complaints go to the Local Committee. They must still prevent harassment, have a policy and cooperate with the Local Committee.

Can a man file a complaint under the POSH Act?

The Act protects women. Many employers’ policies extend protection to all genders as a matter of internal policy, handled under service rules.

Who can be the external member of the IC?

A person from an NGO or association committed to the cause of women, or a person familiar with issues relating to sexual harassment, such as someone with experience in social work on women’s issues or familiar with labour, service, civil or criminal law.

What is the time limit to file a POSH complaint?

Three months from the incident or the last incident in a series, extendable by up to three more months if the IC is satisfied that circumstances prevented earlier filing.

When should the annual POSH report be filed?

Every calendar year, with the employer and the District Officer. Check your District Officer’s notice for the date; many fix January.

What is the penalty for not having an IC?

A fine of up to Rs 50,000. A repeat offence can attract double the punishment and cancellation or non-renewal of the business licence or registration (section 26).

*This article is general information, not legal advice.*

18 October 2026

Appointment Letter Under New Labour Codes: What to Include

Last updated: 18 October 2026

Short answer: Yes, an appointment letter is now a legal requirement for establishments covered by the Occupational Safety, Health and Working Conditions Code, 2020 (the OSH Code). Section 6(1)(f) requires every employer to issue a letter of appointment to every employee, in the form prescribed by the appropriate Government. The four Labour Codes came into force on 21 November 2025, and the Central Rules under them were notified in May 2026. The letter should at least state the designation, skill category, nature of employment, wages, date of joining, social security coverage and duties, and, for women employees, whether maternity benefit applies. For most private employers the State’s rules decide the exact form, so check your State’s labour department notification.

Why the appointment letter is now a statutory document

Before the Labour Codes, an appointment letter was mostly a matter of good practice and of State shops and establishments laws. The OSH Code changed that. Section 6(1)(f) makes it a duty of the employer to issue a letter of appointment to every employee on appointment. Employees who were already in service when the Code began were to be given such letters within three months of commencement, that is, by about 20 February 2026. If you have not done this, issue the letters now.

The Code applies to “establishments” as defined in it, which broadly means places where ten or more workers are employed in any industry, trade, business, manufacturing or occupation, and to factories, mines, docks and similar workplaces. Even a small office outside the definition should issue a written letter: it is the first document a labour authority, court or auditor will ask for.

Central or State rules?

Labour is in the Concurrent List. The Central Rules (for example, the Occupational Safety, Health and Working Conditions (Central) Rules, 2026, notified on 8 May 2026) apply only where the Central Government is the “appropriate Government”: railways, mines, banks, insurance companies, major ports, Central public sector undertakings and similar. For most private employers the State Government is the appropriate Government, so the State rules fix the form of the appointment letter, registers and returns. Several States notified their rules during 2026, but the position differs from State to State. Where a State rule is not yet in place, the transition arrangements announced by the Central Government allow the older State rules to continue on that point.

What the appointment letter must contain

Published summaries of the OSH (Central) Rules, 2026 list these particulars for the prescribed appointment letter. Treat them as the minimum and add anything your State form asks for.

Particular	What to write
Name and designation	Employee’s full name, father’s or spouse’s name, designation
Skill category	Unskilled, semi-skilled, skilled or highly skilled, matching the minimum wage category
Nature of employment	Regular (permanent), fixed-term with end date, or other
Wages	Basic pay and each allowance separately, wage period and mode of payment
Date of joining	Exact date
Social security	Provident fund and ESI coverage, with UAN and ESI number where available
Nature of duties	A short description of the job
Maternity benefit (women employees)	Whether maternity benefit under the Code on Social Security, 2020 applies

The legal points your letter should reflect

Topic	What the Codes say	Drafting tip
Definition of wages	Under the Code on Wages, 2019, if allowances and other excluded items exceed 50 per cent of total remuneration, the excess is added back to “wages” for the Codes	Show basic pay and allowances clearly; check that PF and gratuity are computed on Code “wages”
Payment dates	Monthly wages by the 7th day of the following month; on resignation, removal or retrenchment, within two working days (section 17, Code on Wages)	State the pay date and the full and final settlement timeline
Working hours	Not more than 8 hours a day and 48 hours a week; overtime at twice the ordinary rate (OSH Code)	Write normal hours and the overtime rule; State rules may allow different daily spread
Annual leave	One day for every 20 days worked, for workers who have worked 180 days or more in a calendar year (OSH Code)	Your policy can be more generous, never less
Fixed-term employment	Fixed-term employees get the same hours, wages and benefits as permanent staff doing similar work, and gratuity on a pro rata basis without the five year condition (Code on Social Security, section 53)	Use a separate fixed-term contract with a clear end date
Worker or not	“Worker” excludes managerial and administrative staff, and supervisors earning more than Rs 18,000 a month (Industrial Relations Code, 2020)	Senior staff rely mainly on their contract, so draft notice, confidentiality and IP clauses carefully
Termination and retrenchment	Retrenchment of a worker with one year’s service needs one month’s notice (or pay) and compensation, plus 15 days’ wages to the worker re-skilling fund	Keep statutory protections intact; contract terms cannot reduce them
Personal data	The DPDP Act, 2023 and Rules, 2025 apply to employee data; core duties begin on 13 May 2027	Add a short employee privacy notice now

Free checklist: appointment letter skeleton

Use this order for a permanent employee’s letter. Put it on letterhead and keep a signed copy.

Reference number, date, employee name and address.
Appointment: designation, department, place of posting, date of joining.
Nature of employment (regular) and probation period, with how confirmation happens.
Statutory particulars schedule: skill category, wages break-up, wage period, UAN and ESI, maternity benefit applicability.
Working hours, weekly off, overtime.
Leave entitlement and holidays.
Social security: PF, ESI where applicable, gratuity, maternity benefit.
Notice period for resignation and termination, and full and final settlement within two working days of separation.
Code of conduct and POSH policy acknowledgement.
Confidentiality and intellectual property.
Personal data notice (what employee data is collected and why).
Governing documents: standing orders or service rules, if any.
Signature of authorised signatory; employee’s acceptance with date.

Need the complete, editable set? The Lexfolio Employment Documents Set includes an offer letter, a Labour Code compliant appointment letter with a statutory particulars schedule, a fixed-term contract, a manager’s employment agreement, a consultant agreement, NDAs, and experience, relieving and full and final settlement letters, with a guide to the four Codes.

Offer letter, appointment letter and employment agreement

Offer letter: a short conditional offer with CTC and joining date. It can say that the appointment letter will contain full terms.
Appointment letter: the statutory document under the OSH Code. Issue it on or before joining.
Employment agreement: a longer contract signed by both sides, useful for senior, technical or sales roles. It does not replace the statutory appointment letter; attach the statutory schedule or issue both.

Note that an agreement signed by both parties may attract stamp duty under your State’s stamp law, while a letter signed only by the employer usually does not.

Common mistakes

Issuing no letter, or a letter without the particulars in the State form.
Keeping basic pay artificially low, so that allowances exceed 50 per cent and the PF and gratuity base is wrong.
Using fixed-term contracts to deny benefits that permanent staff doing the same work get.
Writing a notice or non-compete clause that tries to override statutory rights. Post-employment non-competes are generally unenforceable in India under section 27 of the Indian Contract Act, 1872.
Forgetting to give the employee a signed copy and record its delivery.
Not updating letters for employees who were in service before 21 November 2025.

Update your HR documents in one go. The Employment Documents Set is drafted around the Labour Codes and the 2026 Central Rules, with shaded notes telling you where your State form may need extra fields.

Running a workplace with women employees? Read our POSH compliance checklist. Collecting employee or customer data online? See our guide to a privacy policy under the DPDP Act.

Frequently asked questions

Is an appointment letter mandatory under the new Labour Codes?

Yes, for establishments covered by the OSH Code. Section 6(1)(f) requires it for every employee, in the prescribed form.

Do existing employees also need appointment letters?

Yes. Employees already in service when the Code commenced on 21 November 2025 were to receive letters within three months. If that has not happened, issue them now.

Which form should a private company use?

Usually the form under your State’s OSH rules, because the State is the appropriate Government for most private establishments. Central Government establishments use the Central Rules.

Can a company with fewer than ten employees skip the appointment letter?

The OSH Code may not technically apply, but State shops and establishments laws may still require written terms, and a letter protects both sides. Issue one anyway.

Does the 50 per cent wages rule mean basic pay must be 50 per cent of CTC?

Not exactly. If excluded components exceed half of total remuneration, the excess is treated as wages for the Codes. Many employers restructure so that basic pay plus dearness allowance is at least half.

Should the appointment letter be signed by the employee?

The employer issues and signs it. Get the employee to sign an acceptance on a copy, which is your proof of delivery.

*This article is general information, not legal advice.*

18 October 2026