Privacy Policy Recommendations

Privacy notice for citizens

We recommend that you include the privacy notice in the platform. This information should be shared by implementing countries with their citizens. The privacy notice should have the following sections:

1. Purpose of processing

2. What information is collected

3. Retention of information

4. Grievance officer details

5. Sharing of information with third parties

6. Usage of cookies, what information is stored in cookies

7. Security measures taken for processing/storing information

8. Rights of individuals

Privacy policy guidelines for an implementing country

We recommend that the following guidelines should be followed by a country that is implementing DIVOC:

• A citizen's consent should be collected against the privacy notice and a centralised database should be maintained to log consent provided by the citizen (wherever applicable).

• The privacy notice should ask people to connect with the privacy officer/grievance officer to exercise his/her right to withdraw their consent.

• Personal data should only be accessible to limited individuals. In case third parties require access to the application for administrative purposes, we recommend you de-identify personal information.

• Organisations should not retain the information for longer than it is required for the purpose for which the information was originally collected.

• A formal document should be created to define the roles and responsibilities of personnel having access to personal data stored in the application.

• Document an access matrix for the application. Ensure that regular reviews are conducted on the access matrix.

• Review user access rights vis-à-vis the roles defined regularly.

• Platform end-users (citizens) should be informed about the mechanisms to update their information through the privacy notice.

• Platform end-users (citizens) should be informed about the mechanisms to update their information through the privacy notice.

• Perform security testing on the application regularly. We also recommend that you fix all the vulnerabilities after the testing is performed, on-time.

• Sign agreements/contracts with third parties, wherever applicable, including relevant security and privacy clauses.

• Obtain explicit consent against the privacy notice from the individuals whenever sensitive personal data is processed.

All content on this page by eGov Foundation is licensed under a Creative Commons Attribution 4.0 International License.