Free Cookie Policy Generator for Restaurant / Food — DPDPA Compliant

🇮🇳 Key DPDPA Requirements

India's Digital Personal Data Protection Act (DPDPA) 2023 is India's first comprehensive data protection law. It applies to processing of digital personal data within India and to processing outside India if it involves offering goods or services to individuals in India. Significant Data Fiduciaries face enhanced obligations, and the Data Protection Board can impose fines up to ₹250 crore.

• Obtain free, specific, informed, and unconditional consent before processing personal data
• Provide a clear and plain-language privacy notice before collecting data
• Process personal data only for specified lawful purposes
• Implement security safeguards and notify the Data Protection Board of breaches
• Honor data principal rights: access, correction, erasure, and grievance redressal
• Significant Data Fiduciaries must appoint a Data Protection Officer and conduct audits
• Parental consent required for processing data of children under 18

Restaurant / Food — Specific Considerations

Food businesses with online ordering, delivery apps, or loyalty programs collect customer contact information, order history, location data, and payment details. Allergy information is particularly sensitive — treating it as health data means it may require heightened protection under GDPR and other regulations.

Data typically collected by Restaurant / Food businesses: name, delivery address, phone number, payment details, order history, dietary preferences and allergy information

• Allergy and dietary data as sensitive data
• Third-party delivery platform data sharing (DoorDash, Uber Eats)
• Loyalty program data and expiry
• Location tracking for delivery
• Marketing preferences and opt-out