'Privacy policy' and 'privacy notice' get used interchangeably — but under the DPDP Act they do different jobs, and confusing them leaves gaps. Here's the distinction and why it matters.
The privacy notice: what the Act requires
The notice is the Act's specific, legal requirement (Section 5): given at the point of collecting consent, it must contain an itemised description of the data and purpose, how to withdraw consent, how to exercise rights, and how to complain to the Board — available in English or a listed Indian language.
The privacy policy: the broader document
A policy is your fuller public statement of how you handle data overall — useful for transparency and trust, but it is not a substitute for the just-in-time notice the Act requires at the moment of collection.
Why the difference matters
Relying on a single long policy buried in the footer doesn't meet the notice obligation. You need the specific, contextual notice where and when you collect data — at the form, the signup, the banner.
Getting both right
- Specific, itemised notices at each collection point.
- A clear overall privacy policy for transparency.
- Both versioned and consistent with your real data map.
How DPDP Bridge helps
DPDP Bridge generates compliant, itemised notices for each collection point — and keeps them consistent with your broader privacy policy. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.