Which policies does a business need for the DPDP Act?

At a minimum: a notice for the people whose personal data it collects, a way to obtain and record consent where consent is relied on, security safeguards, a procedure for responding to personal data breaches, rules on retention and erasure, a process for individuals’ requests and grievances, and written contracts with its data processors. Most of the Act’s obligations apply from 13 May 2027.