Data Sharing Clauses Questions to Ask Before You Accept
You open a new app, scroll past a wall of text, and tap I Agree. Most people in India do this dozens of times a year without reading a single line. But buried in those terms is almost always a data sharing clause that decides exactly who else gets to use your phone number, location, Aadhaar-linked details, or payment history.
India’s Digital Personal Data Protection Act DPDPA, passed on 11 August 2023, and its Rules notified by MeitY in November 2025, give every Indian user more control over personal data than any law before it. Still, the law only protects you if you take the first step. Here are the questions that matter.
Why You Should Read a Data Sharing Clause Before Agreeing
Companies that collect personal data in India are now legally required to tell you what they collect, why they collect it, and who they share it with. If a company fails to protect your data, it can face fines of up to ₹250 crore under the DPDPA Schedule. That is not a small number, and it signals how seriously the law treats data misuse.
But those fines go to the government, not to you. The only way to protect yourself before a problem starts is to ask the right questions before you agree.
Questions to Ask About Data Sharing Clauses
What exactly is being collected?
The privacy policy should list the specific types of data the service takes from you. Name, phone number, and email are expected. But many apps also collect device ID, IP address, location, contacts, browsing history within the app, and microphone or camera permissions.
If the policy says something vague like information you provide to us without listing it out, treat that as a warning sign. Ask yourself does this app actually need all of this to work?
Who will get your data?
This is the core of any data sharing clause. Scan the document for phrases like third-party partners, affiliated entities, service providers, or advertisers. Some platforms share your data with dozens of outside companies, including ad networks based abroad, before you finish registration.
Check specifically:
- Does the service sell your data, or only share it for limited purposes?
- Does it pass data to group companies or subsidiaries automatically?
- Can it hand over your data to law enforcement or government agencies, and if yes, under what conditions?
Will your data leave India?
When a company stores or processes your data on servers outside India, your information ends up in a jurisdiction with different rules. The DPDP Act covers cross-border transfers, but you still want to know where your data goes.
This matters for loan apps and fintech platforms especially. Several lending apps operating in India are owned by companies registered in Southeast Asia or China. The fine print may allow sending Aadhaar-linked or bank account data to servers abroad.
How do you withdraw consent?
Under Section 6 of the DPDPA, withdrawing your consent must be as easy as giving it. If the only way to opt out involves emailing a legal team, posting a letter to a registered office in another city, or calling a helpline with no clear response time, the company is not meeting its obligations.
Look for an in-app consent settings page or a clearly marked link to manage your choices. If you cannot find one before signing up, that tells you something.
How long will they keep your data?
Many policies say data is kept as long as required or for a reasonable period. Those phrases are not useful. A clear policy should name a specific retention window, for example, two or three years after your last activity, and commit to deleting your data when you close your account.
If the terms allow the company to keep your data indefinitely even after you delete your account, you are essentially handing over information with no expiry.
What happens after a data breach?
The DPDP Rules 2025 require companies to notify both the Data Protection Board and affected users within 72 hours of discovering a breach. Check whether the privacy policy mentions this at all. If there is no breach notification process described, the company may not have thought carefully about your security.
A Simple Comparison
| Question | Red Flag | Good Sign |
|---|---|---|
| What data is collected? | Any information we may need | Specific list: name, phone, location |
| Who receives it? | Trusted partners (unnamed) | Named categories of recipients |
| Does data leave India? | No mention of server location | States servers are in India or approved countries |
| Can you withdraw consent? | Only via written request | Clear in-app opt-out option |
| How long is data kept? | As long as necessary | Fixed period stated, e.g., 3 years |
| Breach notification? | Nothing mentioned | States user notification within a set timeframe |
Before You Download Any App
These questions become especially important for apps that handle financial information, health data, or account-level identity details. Before you install any gaming or entertainment platform, check what data is collected during registration, gameplay, and payment. Look for whether the app shares your KYC documents, payment history, or personal profile with advertisers or analytics companies.
For example, before downloading the lotus365 apk or any similar platform that requires account creation, go to the data policy section and confirm specifically which categories of data are shared with third parties and whether you can delete your account and all associated data.
If you are exploring a product like lotus365 blue, look for whether the privacy policy names the entities your data might be shared with, and whether there is a clear process to withdraw consent or request data deletion later.
A note on online gaming: Platforms that involve real money gaming operate under regulations that vary by Indian state. Check the applicable laws in your state before registering on any such platform and consult a legal professional if you have doubts about what is permitted where you live.
Your Rights Under the DPDP Act, 2023
Once you have agreed to terms, these rights still apply:
- Right to know: You can ask what personal data a company holds about you.
- Right to correct: You can request that outdated or incorrect data be fixed.
- Right to erase: After a purpose is fulfilled, you can ask for your data to be deleted.
- Right to file a complaint: If a company violates your rights, you can approach the Data Protection Board of India.
These are not optional features that companies choose to offer. They are legal obligations.
If the Policy Does Not Answer These Questions
Send an email to the Data Protection Officer listed in the privacy policy before you register. The DPDPA requires Significant Data Fiduciaries to appoint a DPO located in India.
If no contact details are given, if the policy is deliberately unclear, or if the company does not respond, you have every reason to look for an alternative service. There are usually competitors with cleaner, more transparent policies.
Taking five minutes to review a data sharing clause can save you months of trouble if something goes wrong.
