This repository contains an independent privacy and compliance analysis of Groww's publicly available Privacy Policy. The study evaluates the platform's consent architecture, profiling practices, third-party data sharing mechanisms, transparency obligations, and accountability measures from the perspective of India's Digital Personal Data Protection (DPDP) Act, 2023.
The purpose of this review is to identify potential privacy and compliance concerns and assess whether the policy aligns with key data protection principles, including informed consent, purpose limitation, transparency, accountability, and user control.
- Consent Architecture
- Third-Party Data Sharing
- Affiliate and Group Company Disclosures
- Behavioural Profiling Practices
- SMS Data Access and Processing
- Marketing and Personalisation Activities
- Data Processor Accountability
- Business Transfer Data Sharing
- Security and Liability Disclaimers
- User Rights and Control Mechanisms
The analysis identifies several potential privacy red flags, including:
- Bundled and implied consent structures
- Broad third-party and affiliate data sharing
- Extensive behavioural profiling provisions
- Limited transparency regarding processing activities
- Accountability and security disclaimer concerns
- Digital Personal Data Protection Act, 2023 (India)
- Privacy Governance Principles
- Data Protection and Compliance Standards
This report is an independent academic and policy analysis based on publicly available privacy policy language. It does not constitute legal advice or a formal determination of non-compliance.
Ankita Kumari