Website Privacy Policy and Terms of Service: What Indian Law Requires
Any Indian website or app that collects personal information — even just an email address via a contact form — must publish a privacy policy under the IT Act's reasonable security practices rules and the newer DPDP Act (Digital Personal Data Protection Act). A separate terms of service document governs the legal relationship with users, covering liability, conduct and dispute resolution.
What a compliant privacy policy must cover
- What personal data is collected (name, email, phone, payment info, cookies, location, etc.)
- The purpose of collection and how the data will be used
- Whether data is shared with third parties (payment gateways, analytics, marketing tools) and why
- How users can access, correct, or request deletion of their data
- Data retention period and security measures
- Grievance/contact details for privacy-related complaints
DPDP Act obligations beyond the policy itself
The DPDP Act requires actual, demonstrable consent mechanisms (not just a buried policy link), the ability to honour data-deletion and correction requests, and breach notification obligations — a privacy policy alone doesn't satisfy the law if the underlying consent and data-handling practices don't match what it describes.
What a terms of service should cover
- Acceptable use policy and prohibited conduct
- Intellectual property ownership (your content vs user-generated content)
- Limitation of liability and disclaimers
- Governing law and dispute resolution (jurisdiction, arbitration clause if preferred)
- Account termination conditions, for platforms with user accounts
Why a generic template isn't enough
A copy-pasted privacy policy that doesn't reflect your actual data practices — the specific tools you use, the specific data you collect — creates legal exposure precisely because it misrepresents your practices, which is itself a compliance violation.
Our legal/compliance team drafts privacy policies and terms of service matched to your actual website and data practices.