Skip to main content
All rules

PRV-009

Potential DPDP readiness gap

LowDefault severity · Privacy / Legal · Legal, privacy and consent

Last reviewed

What it checks

For India-facing sites (₹ prices, +91 numbers, .in domains): grievance contact, data-principal rights, consent withdrawal, retention and breach wording in the privacy policy.

Why it matters

India’s Digital Personal Data Protection Act expects a clear notice and grievance contact. Gaps are a potential compliance risk.

Recommended fix

Review the privacy policy against DPDP expectations and add the missing sections. This is not legal advice.

How to verify

Open the privacy policy and confirm each topic listed in the evidence now has its own section.

Example fix prompt

Generic prompt (your report adds the evidence)
Please fix this production issue in my app.

Issue PRV-009: Potential DPDP readiness gap
Site: https://your-app.example

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Update the privacy policy page with sections for: how to withdraw consent, the rights users have to access, correct and erase their data, a named grievance officer contact, how long data is kept, and how users will be told about a data breach. Mark the new text as a draft for legal review.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Open the privacy policy and confirm each topic listed in the evidence now has its own section.

References

Potential compliance risk only. This is not legal advice.