9 min read
Privacy policy for a website in India: what the law, Razorpay and the app stores actually require
Do you need a privacy policy for your website in India? Yes. Here is what the IT Act, DPDP Rules, Razorpay, Google Play and Apple require, and a skeleton outline.
A student running a small subscription website asked r/LegalAdviceIndia whether his terms, refund policy and privacy policy would actually hold up. He had written them "mostly based on templates and general research". That is how most Indian small businesses get a privacy policy, and it is usually the wrong way.
The short answer: yes, if your website collects any personal information, even a name and phone number in a contact form, you need a privacy policy for your website in India. The IT Act rules require one today, the DPDP Act raises the bar from May 2027, and Razorpay, Google Play and Apple will not let you go live without one.
This guide explains what it must cover in plain language. It is not legal advice. Use it to brief a lawyer, not to replace one.
Why you need a privacy policy for your website in India#
1. The IT Act rules apply right now#
Rule 4 of the SPDI Rules 2011, made under the IT Act 2000, says a business that collects personal information must publish a privacy policy on its website. It has to state its practices, the types of data collected, why, who it is disclosed to, and the security practices followed. The same rules require a Grievance Officer whose name and contact details are published on the site, and who resolves complaints within one month.
Section 43A of the IT Act lets people claim compensation if a business is negligent with sensitive data such as passwords, financial details or health records.
2. The DPDP Act and Rules phase in until May 2027#
The Digital Personal Data Protection Act 2023 is India's main privacy law. Its Rules were notified in November 2025 with an 18-month phase-in. According to SCC Online's summary, the timeline is:
| Date | What applies |
|---|---|
| November 2025 | Definitions and the Data Protection Board |
| 13 November 2026 | Consent Manager registration |
| 13 May 2027 | Notices, consent, security safeguards, breach reporting, user rights, penalties |
On that same May 2027 date, section 43A is due to be removed from the IT Act and the DPDP regime takes over. Penalties go up to ₹250 crore for failing to keep reasonable security safeguards, according to the PIB backgrounder linked above. There is no exemption based on size. A clinic in Indore with a booking form is covered just like a large app.
3. Platforms check for it before you launch#
| Platform | What it asks for |
|---|---|
| Razorpay | Links to your About, Contact, Pricing, Terms, Privacy and Refund pages during website activation. Without them you get no live API keys. |
| Google Play | A privacy policy link in Play Console and inside the app, matching your Data safety form (User Data policy) |
| Apple App Store | A policy link in App Store Connect and inside the app, under guideline 5.1.1 of the App Store Review Guidelines |
| Google Analytics | The Analytics terms say you must post a policy that discloses cookies and your use of Analytics |
| Google Ads Customer Match | Your policy must disclose that you share customer data with third parties |
| Meta lead ads | Adding a policy URL is optional but recommended, and it cannot be a PDF |
If you are setting up payments, our guide to choosing a payment gateway for your website covers the rest of the onboarding checklist.
What a DPDP-ready privacy notice must contain#
The Act talks about a "notice", not a "privacy policy". In practice most businesses meet it with a clear privacy page plus a short notice at the point of collection, such as beside a signup form. Section 5 of the Act and Rule 3 of the Rules set the minimum:
- An itemised list of personal data. Not "we collect certain information" but name, mobile number, email, delivery address, order history, device data.
- The specific purpose for each, and the goods or services it enables. "To deliver your order and send WhatsApp updates about it" is specific. "To improve our services" is not.
- How to withdraw consent, and it must be about as easy as giving it was. If signing up took one tick, withdrawing should not need a registered letter.
- How to exercise your rights: access a summary of your data, correct or erase it, raise a grievance, and nominate someone to act for you.
- How to complain to the Data Protection Board.
- A contact who can answer questions about your processing (Rule 9). Larger, "significant" businesses need a Data Protection Officer.
- Your grievance response time. Rule 14 caps it at 90 days.
- Language. People must have the option to read the notice in English or any of the 22 languages in the Eighth Schedule. That does not mean publishing 22 versions on day one, but it should be on your lawyer's list.
Two more things belong in the policy even though they are about behaviour. Under section 8(7) you must erase data once the purpose is served or consent is withdrawn, unless another law requires you to keep it, such as GST records. So say how long you keep each kind of data. And if children might use your service, you need verifiable consent from a parent.
Privacy policy for an ecommerce website in India#
Online stores have an extra layer. The Consumer Protection (E-Commerce) Rules 2020 require you to display the name, designation and contact details of a grievance officer, acknowledge complaints within 48 hours and resolve them within a month. Your policy should also name the categories of partners who receive customer data: the payment gateway, courier, WhatsApp provider and ad platforms.
Cookies, analytics and ad pixels#
India has no separate cookie law. But Google Analytics, the Meta Pixel and similar tools collect identifiers that can link back to a person, which makes them personal data under the DPDP Act. The careful reading, and the one we would follow, is that non-essential tracking should wait for consent through a banner that offers a real "reject" option. Essential cookies, like the one that keeps a cart full, can run without it.
Whatever you decide, the policy must list the tools you actually run. Most policies fail here: six tracking scripts on the site, none in the policy.
Why a US template or a generator is risky#
A r/indianstartups post reviewed about 20 Indian startup websites and found most had "a copy-pasted GDPR template that doesn't cover Indian requirements". The most useful reply made the deeper point: "a lot of DPDPA is about what you do, not just what you write."
Common problems with templates and a free privacy policy generator for an Indian website:
- US and EU concepts that do not apply here, like CCPA "Do Not Sell" links or GDPR's "legitimate interests". The DPDP Act relies on consent plus a short list of legitimate uses.
- Missing Indian items: the Grievance Officer, the Data Protection Board, the response time and the language option.
- Generic data lists that include things you never collect and miss things you do.
- No connection to the product. Promising deletion within 30 days when nobody can actually delete a customer from your database is worse than saying nothing.
Generators are fine for a first draft that lists your tools. They do not know your business.
A skeleton outline to take to your lawyer#
This is a structure, not legal text. Fill in the facts and have a lawyer write the wording.
PRIVACY POLICY: [Business name] Last updated: [date]
1. Who we are
Legal name, address, contact email, website and app covered.
2. What personal data we collect
Itemised, grouped by source: forms, checkout, account,
WhatsApp, cookies and analytics.
3. Why we collect it
One purpose per data group, and the service it enables.
4. Consent and how to withdraw it
Where consent is taken, and a simple way to withdraw.
5. Who we share it with
Payment gateway, courier, hosting, email/WhatsApp provider,
analytics and ad platforms. Note any storage outside India.
6. Cookies and tracking
Tools used, what each does, how to refuse.
7. How long we keep it
Retention period per data group, and legal holds (e.g. tax).
8. How we protect it
Security practices in plain words.
9. Your rights
Access, correction, erasure, grievance, nomination,
and how to request each.
10. Grievance contact
Name, designation, email, phone, response time.
11. Complaints to the Data Protection Board of India
12. Children's data
13. Changes to this policy, and how we tell you
Health data needs extra care. If you run a clinic, our guide to building a website for a doctor's clinic covers booking forms and patient details. For apps, add the policy to your app requirements document so it is part of the build, not a scramble before app store submission.
Common questions#
Is a privacy policy mandatory for a website in India?#
Yes, if you collect personal information. Rule 4 of the SPDI Rules requires a published privacy policy today, and from 13 May 2027 the DPDP Act requires a detailed notice before collecting personal data.
Can I use a free privacy policy generator for my Indian website?#
As a starting point, yes. Choose one that mentions the DPDP Act, then edit the data list and third parties to match your site, add your grievance contact and have a lawyer review it.
Is there a sample privacy policy for a website in India I can copy?#
Reading two or three published policies helps you see the structure. Copying one creates a policy for their business, not yours, and may infringe their copyright. Use the outline above instead.
Do I need a privacy policy for my app?#
Yes. Google Play and Apple both require a policy link in the store listing and inside the app, even if the app collects very little.
The short version#
If your website collects names, phone numbers, payments or analytics data, you need a privacy policy for your website in India today under the IT Act rules. From 13 May 2027 the DPDP Act adds specific notice, consent, rights and grievance requirements. Razorpay, Google Play and Apple already check for one. List the data you actually collect, the tools you actually run and how long you keep things, then have a lawyer turn that into the final text.
If you are building or rebuilding a site and want the forms, consent banner and tracking set up so your policy is accurate, book a call with us.
