This is broader than the Data Safety form's accuracy: it requires a posted privacy policy link, limits data collection to what's necessary for the app's function, prohibits selling data to third parties, and requires reasonable security around how collected data is stored and transmitted.
A common cause is a valid Data Safety form paired with a privacy policy link that's broken, outdated, or doesn't actually describe the data practices in enough detail to satisfy the policy's own requirements.
"Your app's privacy policy is missing, inaccessible, or does not adequately disclose how user data is collected, used, and shared, per the User Data policy."