DPDP Compliance Help
for Indian Companies

MagicBricks operates a high-volume platform handling sensitive financial and property data. Its current policy is a legacy document built for the IT Act 2000. It lacks the 'granular consent' and 'right to erasure' frameworks mandated by the DPDP Act 2023. The absence of an escalation path to the Data Protection Board of India (DPBI) and the lack of a 'Notice' in languages specified in the Eighth Schedule are significant compliance liabilities.

Licious has a transparent list of what they collect, but their legal framework is stuck in the year 2000. Their 'agree-by-default' approach to consent is high-risk under the new DPDP Act requirements.

JioCinema's privacy policy remains largely structured around the legacy IT Act 2000 (SPDI Rules). While it excels in identifying 'what' is collected, it fails the 'how' and 'why' requirements of the DPDP Act 2023. Specifically, its handling of users under 18—a massive demographic for OTT—does not meet the 'verifiable parental consent' standard, and the lack of a consent withdrawal mechanism that is 'as easy as giving consent' poses significant legal risk.

ICICI Lombard has made significant strides in DPDP Act 2023 readiness compared to its peers, formally initiating a 'DPDP Compliance Roadmap' and updating its Information Security framework as of April 2026. However, its public-facing privacy policy remains legacy-heavy, particularly regarding consent architecture and the new 'Right to Nominate.' While its security posture is top-tier, the transition from 'regulatory compliance' (IRDAI) to 'data principal empowerment' (DPDP) is still a work in progress.

Disney+ Hotstar’s privacy policy remains heavily influenced by the IT Act 2000 and global GDPR-style frameworks. While it offers strong security disclosures and clear data categorization, it falls short of the DPDP Act 2023’s stringent requirements for granular consent, specific retention limits, and the unique Indian statutory rights like the Right to Nominate. Its handling of 'Children’s Data' is particularly high-risk given the Act’s 18-year threshold vs. the platform's current 'Kids Mode' protections.

HDFC Ergo maintains a high standard of data security dictated by the IRDAI, but its privacy policy is legally outdated. It remains tethered to the 2011 SPDI Rules. To achieve DPDP 2023 compliance, the company must decouple its consent architecture, introduce the right to nominate, and explicitly integrate the Data Protection Board into its grievance hierarchy.