Writing Clear Policies and Procedures

DPDP Privacy Notice is not a UX nice-to-have It is a statutory object. Compliance hinges on the consent screen, not on how long your privacy policy is. If mandatory elements are missing, you are non-compliant—full stop. What DPDP actually requires at the notice stage, in real product language: 1. What data + why (specified purpose) Your notice must clearly itemise which personal data you collect and the specific purpose(s) for processing. Vague lines like “to improve our services” fail Section 5. Example “We collect your name, mobile number, PAN and bank account details to open and operate your trading account, verify your identity, and comply with KYC/AML.” Avoid: “to improve our services.” 2. Rights & withdrawal: the “how”, not just the “what” You must explain how users can withdraw consent and raise grievances—via specific links and usable channels. If users have to hunt, the notice fails. Example “Withdraw consent or raise a grievance via Settings → Privacy, or email privacy@company.in” 3. Escalation route to the Data Protection Board The notice must state how a Data Principal can approach the Data Protection Board of India if dissatisfied with grievance handling. No future URLs required—just the statutory route. Example “If your grievance is not resolved to your satisfaction, you may complain to the Data Protection Board of India in the manner notified by the Government.” 4. Language and clarity are compliance requirements The notice must offer an option to access it in English or any Eighth Schedule language, and be standalone, clear, and plain. Example Short screen at collection + language toggle: English | हिंदी | বাংলা | தமிழ் Practical takeaway Build a reusable DPDP notice component that always carries: data + purpose, rights/withdrawal route, Board complaint route, language option. If you mapped every sentence of your notice to a DPDP provision, would it survive scrutiny? Relevant provisions DPDP Act, 2023: Sections 5(1)–(3), 6(4), 11–13 DPDP Rules, 2025: Rule 3 My view Most DPDP non-compliance will not come from missing policies. It will come from weak notices that look fine to designers but fail legally. #DPDP #DataProtection #ProductCompliance

As a lawyer who often dives deep into the world of data privacy, I want to delve into three critical aspects of data protection: A) Data Privacy This fundamental right has become increasingly crucial in our data-driven world. Key features include: -Consent and transparency: Organizations must clearly communicate how they collect, use, and share personal data. This often involves detailed privacy policies and consent mechanisms. -Data minimization: Companies should only collect data that's necessary for their stated purposes. This principle not only reduces risk but also simplifies compliance efforts. -Rights of data subjects: Under regulations like GDPR, individuals have rights such as access, rectification, erasure, and data portability. Organizations need robust processes to handle these requests. -Cross-border data transfers: With the invalidation of Privacy Shield and complexities around Standard Contractual Clauses, ensuring compliant data flows across borders requires careful legal navigation. B) Data Processing Agreements (DPAs) These contracts govern the relationship between data controllers and processors, ensuring regulatory compliance. They should include: -Scope of processing: DPAs must clearly define the types of data being processed and the specific purposes for which processing is allowed. -Subprocessor management: Controllers typically require the right to approve or object to any subprocessors, with processors obligated to flow down DPA requirements. -Data breach protocols: DPAs should specify timeframes for breach notification (often 24-72 hours) and outline the required content of such notifications, -Audit rights: Most DPAs now include provisions for audits and/or acceptance of third-party certifications like SOC II Type II or ISO 27001. C) Data Security These measures include: -Technical measures: This could involve encryption (both at rest and in transit), multi-factor authentication, and regular penetration testing. -Organizational measures: Beyond technical controls, this includes data protection impact assessments (DPIAs), appointing data protection officers where required, and maintaining records of processing activities. -Incident response plans: These should detail roles and responsibilities, communication protocols, and steps for containment, eradication, and recovery. -Regular assessments: This often involves annual security reviews, ongoing vulnerability scans, and updating security measures in response to evolving threats. These aren't just compliance checkboxes – they're the foundation of trust in the digital economy. They're the guardians of our digital identities, enabling the data-driven services we rely on while safeguarding our fundamental rights. Remember, in an era where data is often called the "new oil," knowledge of these concepts is critical for any organization handling personal data. #legaltech #innovation #law #business #learning

Most legal disasters don’t start with fraud. They start with silence. A regulator opens your website. • They don’t see a license. • They don’t see how you handle data. • They don’t see what you actually do. When that happens, they assume the worst. I see this with Fintech founders all the time. You think “it’s obvious.” But if it’s not written, it’s not obvious. Big problems don’t explode overnight. They build slowly from unspoken assumptions: • One side thinks one thing. • The other assumes another. • No one checks. No one clarifies. Then - boom. If you want to avoid that boom, communicate. Not once. Not casually. Clearly. Consistently. In writing. Here’s a tight disclosure checklist I suggest every Fintech should follow: 1/ Website landing page - must-show items • Company name, CIN, registered address, contact, grievance officer • Clear regulatory status and license numbers (RBI / SEBI / IRDAI if applicable) • Short plain-language description of your business model 2/ Terms & Conditions - role and risk clarity • Exactly what service you provide and what you don't • Who does what in the transaction chain (platform vs principal) • Data use, liability limits, force majeure, and continuity plans 3/ Privacy policy - data controls you can actually prove • What data you collect, why, retention, deletion rules • Consent mechanisms and user rights under DPDP 2023 • Breach notification procedure and timelines 4/ Product disclosures - customer-facing clarity • KFS and APR for lending (per RBI formats) • Fees, penalties, and party roles for origination and servicing • Risk statements and suitability notes for investment products 5/ Partnership disclosures - who does what, exactly • Full list of LSPs/payment partners and their functional roles • Fund-flow and settlement mechanics, escrow if used 6/ Grievance redressal - easy, visible routes • Grievance officer contact, escalation matrix, tracking link • Links to RBI ombudsman/CMS and other regulatory complaint channels 7/ Operations & resilience - prove you can run safely • Financial summaries (where required), business continuity, and cyber incident response • Third-party risk management and periodic reviews Common mistakes that invite scrutiny - avoid these: • Vague service descriptions • Missing or buried license disclosures • Copy-paste privacy policies that don’t match practice • Hidden fees or unclear partner roles • Weak or missing grievance channels The bottom line: transparency is not optional in Fintech. If regulators can’t find clear information, they assume non-compliance. Make your compliance visible. Make your risks plain. Make your communications consistent. Reply with "Fintech” and I'll share a short checklist to help fintech teams spot red flags. --- ✍ Share with everyone below: What’s the biggest gap you see on fintech websites today - Licensing / Privacy / Disclosures?

Stop explaining privacy using privacy language. Please. Every time you mention "legitimate interest balancing tests" or "data protection by design principles," you are bound to lose the room. Almost no one you will encounter cares about the esoteric 7 principles of privacy by design. They care about not getting fired. Over and over I’ve watched privacy professionals present to their executive teams with dense slides, perfect regulatory citations and flawless legal reasoning. I was one of those professionals early in my career. Then questions like this emerge: "What does this mean for our Q4 launch?" Silence. Because we spent most of our energy on the compliance explanation and almost no energy on the business translation. Learning to do this takes time. It doesn't develop overnight. Here’s what can be effective: Instead of saying: "We need to implement proper consent mechanisms to comply with state privacy laws." Start saying: → "This will reduce spam complaints and improve your email deliverability rates." Instead of saying: "We need data minimization controls in scope." Start saying (to IT): → "This eliminates a manual process and reduces security exposure." Instead of saying: "We should respect data subject rights." Start saying (to Sales): → "This helps us avoid wasting time on prospects who are unlikely to convert anyway." You’re not hiding privacy requirements behind business benefits. You’re finding the genuine alignment between good privacy practices and outcomes they already care about. The Friction Reality: Most people who bypass privacy controls aren’t malicious. They’re busy. Under pressure. Measured on speed to market. If privacy means friction, they WILL find workarounds. I’ve seen this 100s of times and it’s not an attack on your work. It’s an invitation to build better systems. Real Talk: Your job isn’t to be the smartest person in the room about US Privacy Laws, GDPR or India’s DPDPA. Your job is to make privacy compliance as easy to understand as possible and efficient to implement so that people can’t accidentally get it wrong. What’s your best example of translating privacy into business language? Share below 👇

Many years ago, I made a mistake that I see security leaders and security consultants repeat over and over again. I sent a beautifully written & crafted security policy to the executive team with a polite request for their approval. And then… crickets, nothing. Silence. Ghosted. No replies. At first, I thought, “They’re too busy.” But the reality was simpler... I gave them homework. I asked leaders who think in terms of growth, market share, and revenue to read 30 pages of controls and definitions. That was on me. The breakthrough came when I stopped asking them to read policies and instead asked them to own the intent of each policy. I boiled each policy down to its TLDR essence... one clear statement of leadership intent. I tied that intent directly to business goals, like revenue protection, operational resilience, customer trust. I framed the ask as consensus, not compliance... “Does this policy align with how we want to run the business?” Then I shared the resource requirements... the tools, headcount, and budget needed to make it real. Now, when I walk back in and say, “This tool satisfies these controls, which enforces this policy, which you agreed supports your business goals”… the budget discussion shifts. It’s no longer a security plea. It’s a business decision they’ve already committed to. Ok, so what's the lesson? Stop emailing policies. Stop giving executives homework. AND start having business conversations about intent, goals, and the resources to achieve them. #cybersecurity #policies #ciso #vciso #fciso

Data Protection Provisions in Contracts: Why They Matter and What to Include In today’s digital landscape, data has become one of the most valuable assets for businesses. However, with great value comes great responsibility. Ensuring robust data protection measures in contracts is no longer optional—it’s a necessity. Why Data Protection Provisions Matter Every transaction, partnership, or engagement that involves data sharing carries risks—ranging from unauthorized access to potential data breaches. Effective data protection provisions safeguard the interests of both parties, ensure compliance with regulations like GDPR, HIPAA, or India's DPDP Act, and establish clear accountability. Key Provisions to Include When drafting or reviewing contracts, consider these critical data protection clauses: 1. Definitions and Scope Clearly define key terms such as "personal data," "data processing," and "data breach." Specify the scope of data usage to avoid ambiguity. 2. Compliance Obligations Require parties to comply with relevant data protection laws applicable in the jurisdictions where they operate. 3. Data Processing Agreements (DPA) If third-party processors are involved, include a separate DPA outlining the roles, responsibilities, and safeguards. 4. Data Security Measures Detail the technical and organizational measures to protect data, such as encryption, access controls, and regular audits. 5. Data Breach Management Include provisions on breach notification timelines, reporting requirements, and steps to mitigate damage. 6. Data Retention and Deletion Specify how long data will be retained and ensure proper protocols for secure deletion. 7. Cross-Border Transfers Address how data will be handled if transferred to another jurisdiction, including the use of standard contractual clauses (SCCs) or equivalent safeguards. 8. Indemnification and Liability Outline the liability for data breaches, fines, and non-compliance, along with indemnification clauses to protect affected parties. Emerging Trends in Data Protection With evolving technologies like AI and IoT, contracts are increasingly focusing on provisions for algorithmic transparency, cybersecurity risks, and privacy by design. Businesses must stay updated to address these challenges proactively. Final Thoughts A well-drafted data protection clause is not just about legal compliance—it builds trust with stakeholders. As data protection regulations tighten worldwide, having these clauses in place demonstrates accountability and commitment to ethical practices. What other provisions do you think are essential in contracts involving data? Let’s discuss in the comments! Mind Merchants #DataProtection #ContractManagement #PrivacyLaws #GDPR #DataSecurity #LegalCompliance #DigitalPrivacy #Cybersecurity #ContractDrafting #LegalInsights #RiskManagement #DataBreach #PrivacyByDesign #LegalTech

A few months ago, I was helping a fintech company prepare for DPDPA compliance. Their website looked modern — clean interface, great UX, everything polished. But their consent banner? Total chaos. It popped up with a cheerful line: “By using this website, you agree to our privacy policy.” That was it. No mention of the law, no clarity on what data was being collected, no easy way to withdraw consent later. It looked fine from a design perspective — but from a compliance and trust perspective, it was completely broken. This is what went wrong under GDPR too. Everyone had the freedom to make consent banners their own way — different colors, formats, and wording. The result? Confusion. People stopped reading, and consent became a routine click. The Digital Personal Data Protection Act (DPDPA) decided to take a smarter route. It didn’t copy GDPR — it learned from it. The BRD–CMS framework now gives Indian organizations a clear and practical playbook for consent — what to include, how to design, and how to actually make it user-friendly and compliant. Here’s how that fintech company rebuilt its consent notice — step by step 👇 1. Mention the law upfront. They started the notice with a simple line: “This notice is issued under the Digital Personal Data Protection Act, 2023.” That instantly changed the tone. It looked official, trustworthy, and transparent — not like another random pop-up trying to sell cookies. 2. Tell people who you are and why you need consent. Instead of generic text, we wrote: “FinFlow requests your consent to process your data for secure account creation and communication.” It’s short, plain, and honest — no fancy legal jargon. Users could finally understand why their data was needed. 3. Give control back to users. We added simple, visible buttons — Give Consent, Manage Consent, Withdraw Consent. Everything in one place. Because consent isn’t a checkbox — it’s a continuing choice. 4. Be upfront about what you collect. We listed it clearly: Name (for account creation) Email (for communication) Mobile number (for authentication) No vague “we may collect personal information” lines. Users appreciate straight talk — not fine print. 5. Match data with purpose. Each data field was mapped to a clear purpose. No more “we’ll use this to improve services” kind of blanket statements. If you collect it, say why. That’s how you earn trust. 6. Add expiry to consent. We set it for 365 days. After that, the user gets a reminder to re-consent. No indefinite “we’ll keep it forever” attitude. It’s clean, responsible, and user-centric. 7. Remind people of their rights. We added a short section — easy to read, no legal tone: “You can withdraw consent or request correction of your data anytime from your profile settings.” It showed the company respected user rights — not just compliance checkboxes. 8. Make it a real action. No pre-ticked boxes. No “By using this site, you agree…” tricks. Users had to choose.

Develop And Write A Great Policy And Then Assume No One Will Read It Standards and controls, including policies, are an important part of an effective ethics and compliance program. While I have many other #SundayMorningComplianceTip posts that address policy development and writing, there is one important assumption I think policy owners should make when it comes to policies: assume no one will read your policy. Hopefully the relevant employees will read the policy, but the point is to recognize that your busy employees are probably subject to scores of policies and have equally little amounts of time and interest in reading new policies. If we assume that employees are not going to read a new policy, we force ourselves to think a bit more about how to bring the policy to your employees and help them understand the requirements. Here are some examples of how to apply this assumption in practice: 1. Engage Leaders, Managers & Supervisors: You can do this through Compliance Manager Toolkits (a one page summary that helps managers understand their role with respect to the policy and how they can support employees with the new policy) and providing them short Compliance Tips of the Month so they can talk with their teams about some key points about the policy that are relevant to their team and will resonate with them. 2. Marketing Campaign: Embrace the marketing principle of the “Rule of 7” - you need to have multiple messages and communications for the relevant employees to help ensure that they are aware of the policy and the key policy requirements. 3. Help People Learn: This can include training (online or live), engaging them during the policy development stage, providing real life (or at least realistic) FAQs that provide realistic scenarios that relate to the policy, and advising employees on how to deal with any challenges or awkward situations that the new policy might create for them (e.g., how do you decline a gift that violates your new gifts and entertainment policy without burning important business relationships). Even if your employees are going to read all your policies, applying this assumption will only help support both your employees and your ethics and compliance program. Policy documents are just the written version of the policy - there are many other ways that we can communicate a policy to employees and help ensure the words on the page are reflective of the policy in practice. My #SundayMorningComplianceTip series is taking a break for the next few weeks and will return in January. _____ #SundayMorningComplianceTip #EthicsAndComplianceForHumans 📚 Want to get more compliance ideas and suggestions like this? Connect with me here on LinkedIn or get your copy of my book called Ethics & Compliance For Humans (published by CCI Press and available in print and kindle format on Amazon and various other online book stores)

Never assume people are reading your policies the way you wrote them I once rolled out an updated data classification policy for an organization that handled regulated financial data. I had worked with legal and information security to make sure the policy was accurate, aligned with regulatory requirements, and covered all use cases. It defined four data categories, from public to restricted, with clear handling rules. I published it on the intranet, announced it through a company-wide email, and moved on. A few months later, during a routine vendor risk review, we found out that several departments had been emailing spreadsheets with confidential client data to third-party vendors without encryption. These files should have been labeled “restricted” under our policy, but no one had marked them, and no protections were in place. When we followed up, the response was the same across multiple teams. They had read the policy, but they had different interpretations of what qualified as restricted. One team thought it only applied to personally identifiable information. Another believed the rules only applied to formal reports, not ad hoc files. A few people admitted they were still using the old classification from a previous policy version. That incident created a serious risk exposure. We had to contact the vendors, implement new controls, and retrain multiple business units. We also had to report the issue to our internal risk committee. That experience taught me something I should have realized earlier. Publishing a policy is not the same as landing it. Just because something is written clearly to you does not mean it is clear to your audience. Now, every time I roll out a policy or a control, I schedule short walkthroughs with key stakeholder groups. I ask how they interpret the requirements, and I explain exactly how the policy maps to their work. I include examples that reflect real scenarios from their environment. I also check back a few weeks later to confirm the message stuck. The hardest part was realizing that my job was not just to write the right thing. It was to make sure people understood it, remembered it, and followed it. That change in mindset has made every policy more effective and every rollout more trusted. #GRC