Overview
Games24x7 is one of India’s biggest gaming companies, famous for brands like RummyCircle and My11Circle. They act as a Data Fiduciary — that’s the legal term for a company that decides why and how your data is collected.
Since they handle everything from your name and email to your gaming habits and potentially financial data, they have a huge responsibility. If you use their site, you are the Data Principal (the person the data belongs to). This policy is the “contract” between you and them, and right now, it looks very outdated.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Consent & Notice 🔴
This is the biggest red flag. Games24x7 uses what we call “bundled consent.” They assume that just because you are on their website, you agree to everything.
What the policy says: “By visiting our Website, you accept this Privacy Policy. If you disagree… please do not use the Website.”
What the law requires: Under the DPDP Act, consent must be free, specific, informed, and unconditional. You can’t just say “if you’re here, you agree.” You have to give them a clear “Notice” first, explaining exactly what you are collecting and why, in plain language.
The problem: You can’t give a user an all-or-nothing choice. They should be able to play a game without necessarily agreeing to be tracked for ads.
Section 7 — Certain Legitimate Uses ⚠️
The law allows companies to process data without consent in very specific cases, like medical emergencies or court orders.
What the policy says: They claim they can use your data to “protect and defend our rights” and “conform with the law.”
The problem: Games24x7 uses very broad language here. While “complying with the law” is a Legitimate Use, using data for “marketing” or “remarketing” (which they mention) is NOT a legitimate use. For marketing, they must get your explicit permission.
Section 8 — Obligations of Data Fiduciary ⚠️
As a Data Fiduciary, Games24x7 is responsible for keeping your data safe, even if they hire another company to handle it.
What the policy says: “These entities… are under a legal obligation… to maintain the confidentiality and security of any personal information.”
What the law requires: It’s not enough to just sign a contract with a vendor. Games24x7 is legally on the hook if their partners leak your data. They must ensure “reasonable security safeguards” are in place.
The problem: The policy mentions third parties are restricted, but it doesn’t explain what security standards Games24x7 itself uses to protect your data from hackers.
Section 9 — Data Retention 🔴
This is a major “failing” grade.
What the policy says: Absolutely nothing. The policy is silent on how long they keep your data.
What the law requires: This is a big change in the new law. A company must delete your data as soon as the purpose for collecting it is over. If you stop playing their games, they shouldn’t keep your data forever.
The problem: Without a clear “Retention Policy,” your data could be sitting on their servers for a decade, increasing your risk in case of a data breach.
Section 11 — Rights of Data Principal 🔴
The DPDP Act gives you, the Data Principal, “superpowers” over your data. You have the right to see what they have, correct mistakes, and ask them to delete it.
The problem: Games24x7’s policy doesn’t mention a single one of these rights. There is no mention of:
- Right to Correction: Fixing a wrong phone number.
- Right to Erasure: Asking them to delete your account and data.
- Right to Nominate: Picking someone to manage your data if you pass away.
Section 12 — Right of Grievance Redressal 🔴
If you’re unhappy with how your data is handled, you need a clear way to complain.
What the policy says: “Questions and comments regarding this policy should be directed to contactus@games24x7.com”
What the law requires: You must appoint a specific Grievance Officer. This person’s name and contact details must be published. If they don’t solve your problem, the law says they must tell you how to escalate it to the Data Protection Board of India.
The problem: A generic “contact us” email doesn’t meet the legal requirement. It’s too easy for your complaint to get lost in the customer support queue.
Section 16 — Cross-Border Data Transfer ✅
What the policy says: They mention using third parties for things like analytics and marketing, which often means sending data to servers in the US or Europe.
What the law requires: You can send data abroad unless the Indian government specifically “blacklists” a country.
Strength: For now, Games24x7 is likely safe here as long as they aren’t sending data to restricted regions, but they should eventually list where the data actually goes.
Risk Assessment
| Category | Risk Level | Potential Impact |
|---|---|---|
| Illegal Consent | High | The entire database could be deemed “illegally collected” |
| Missing Rights | High | Fines for not allowing users to delete or correct data |
| Grievance Handling | Medium | Users can complain directly to the govt if no officer is found |
| Data Retention | Critical | Keeping data indefinitely is a direct violation of Section 9 |
Recommendations
If you are a business owner looking at this policy, here is what you should learn:
- Stop using “By using this site…” as a way to get consent. Use a clear pop-up that asks for a “Yes” or “No.”
- Add a Deletion Clause. Tell your users, “We keep your data for 2 years after your last login, then we delete it.”
- Name a Human. Don’t use “info@company.com.” Assign a Grievance Officer and list their actual work email.
- List the Rights. Explicitly tell your users they have the right to access, correct, and erase their data. It builds trust!
- Check your vendors. Ensure your contracts with marketing firms actually hold them accountable for privacy.