Privacy Policy for a Website in India: What to Include
By Neha
A boutique owner adds a contact form to her website. Name, phone number, a message box. Enquiries start arriving. One day she tries to connect a payment gateway, and the application asks for a link to her privacy policy. Then Google asks for the same thing when she applies to show adverts. Then a customer asks, quite reasonably, "What do you do with my number?"
She does not have a privacy policy. She did not know she needed one.
If your website collects anything about a visitor, even a phone number in a form, you should have a privacy policy for website visitors to read. This guide explains in plain words why, what the policy must say, how India's data protection law changes things, and the mistakes that make a policy worthless. It is general information, not legal advice.
What a privacy policy is
A privacy policy is a page that tells people, honestly and clearly:
- what information you collect about them,
- why you collect it,
- who else gets to see it,
- how long you keep it, and
- what they can do if they want it corrected or deleted.
That is all. It is not a magic shield and it does not need legal language. A good one reads like an honest answer to a customer's question.
Do you really need one?
Almost certainly. "Personal data" is any information about a person who can be identified, and most websites collect more of it than the owner realises.
| If your website has... | You are collecting... |
|---|---|
| A contact or enquiry form | Names, phone numbers, emails, messages |
| A WhatsApp or call button | Phone numbers, once people contact you |
| Online orders or bookings | Addresses, order history, payment references |
| A newsletter sign-up | Email addresses |
| Google Analytics | Device details, rough location, pages viewed |
| Adverts or a Facebook pixel | Browsing behaviour, shared with ad companies |
| Embedded maps or videos | Data sent to Google or others when the page loads |
The website technology checker shows which tracking and advertising tools are running on your site. Owners are often surprised by what a previous developer installed.
There are three separate reasons to have a policy:
- The law expects it. More on this below.
- Other companies require it. Payment gateways, Google AdSense, Google Analytics, app stores and most advertising platforms make a published privacy policy a condition of use.
- Customers trust it. People are wary of handing a phone number to an unknown website. A short, readable policy and a secure site are part of looking legitimate.
India's data protection law in plain words
The main law is the Digital Personal Data Protection Act, 2023, usually shortened to the DPDP Act. The detailed rules under it were notified in November 2025, and its duties are being brought into force in stages, with the main obligations on businesses expected to apply fully by 2027. Until then, older rules under the Information Technology Act still ask businesses that handle sensitive personal information to publish a privacy policy.
The dates and details are still settling, so check the current position with a lawyer. The principles, though, are clear and worth following now.
Tell people before you collect. At the point of collecting data, you must give a notice saying what you are collecting and for what purpose. The notice should be clear and available in English or an Indian language the person understands.
Get real consent. Consent must be given freely, for a specific purpose, by a clear action. A box already ticked does not count. Neither does a line hidden at the bottom of a page.
Use data only for the stated purpose. A phone number given for a delivery cannot be added to your promotional broadcast list unless the person agreed to that as well.
Let people change their mind. Withdrawing consent must be as easy as giving it.
Respect their rights. A person can ask what data you hold, ask you to correct it, ask you to delete it, and complain to you. You must name someone they can contact.
Keep it safe. You must take reasonable steps to protect the data, and you are responsible even when a software provider handles it for you.
Report serious leaks. If personal data is leaked or stolen, the law expects you to inform the Data Protection Board and the people affected.
Take extra care with children. A child, under this law, is anyone below 18. Processing a child's data needs the verifiable consent of a parent, and tracking or targeting adverts at children is restricted. Schools, coaching centres and children's brands should take advice.
Do not keep it forever. Delete data when the purpose is served and no law requires you to keep it.
Penalties under the Act can be very large on paper, reaching hundreds of crores for the most serious failures. A small shop is not the main target, but the direction is plain: collecting people's details now comes with duties.
What to put in your policy
Use these ten headings. Short, true answers under each are better than long borrowed ones.
1. Who you are
Your business name, address and how to reach you.
2. What you collect
List it honestly: name, phone, email, address, order details, messages. Add what is collected automatically, such as device type and pages viewed.
3. Why you collect it
Give each purpose: to reply to enquiries, deliver orders, send invoices, send offers to those who asked for them, and understand how the site is used.
4. Cookies and tracking tools
A cookie is a small file a website saves on a visitor's device to remember them. Name the tools you use, such as Google Analytics, advertising pixels and embedded maps or videos, and say what each is for.
5. Who you share it with
Courier companies, payment gateways, your email or WhatsApp service, your accountant, your website host. State clearly that you do not sell personal data, if that is true.
6. How long you keep it
For example: enquiry messages for one year; invoices for as long as tax law requires; newsletter addresses until the person unsubscribes.
7. How you protect it
A secure connection, limited staff access, strong passwords. Do not promise "100% security". Nobody can deliver it.
8. People's rights and how to use them
Say that people can ask to see, correct or delete their data and withdraw consent, and give an email address or phone number for these requests.
9. Who to complain to
Name a person or role, with contact details, and say how quickly you will respond.
10. Changes and date
Say that you will update the page when things change, and show the date of the last update.
Five mistakes that make a policy worthless
- Copying another company's policy. It describes their business, not yours. It will mention things you do not do and miss things you do. A false statement in your policy is worse than a short honest one.
- Promising what you do not do. "We never share your data with anyone" is untrue the moment you use a courier or a payment gateway.
- Hiding it. The policy should be linked from the footer of every page and next to every form.
- Bundling consent. "By using this site you agree to receive marketing" is not consent. Use a separate, unticked box for offers and newsletters.
- Writing it once and forgetting it. Added a chat tool or a new advertising pixel? The policy must be updated.
Privacy is more than a page
A policy describes what you do. You also have to do it.
- Collect less. If you do not need a date of birth, do not ask for it. Data you never collected cannot leak.
- Secure the site. The padlock in the browser bar is the minimum. The domain and SSL checker confirms your certificate is valid and when it expires. The security headers checker grades the settings that protect visitors and gives the exact line to add for each fix. Our guide to website security basics explains the rest.
- Limit who can see customer data. Not every staff member needs the full customer list on their phone.
- Clean up. Delete old enquiry spreadsheets and exported contact lists you no longer use.
- Email only those who agreed. Our guide to email marketing for small business covers building a list with consent.
- Be careful with WhatsApp broadcasts. A customer's number given for an order is not permission for daily promotions. See WhatsApp Business for small business.
- Have a plan for a leak. Know who you would call, and how you would inform customers.
Where to put it
- A link in the footer of every page, labelled "Privacy Policy".
- A line beside every form: "We use these details only to reply to your enquiry. See our privacy policy."
- At checkout and on sign-up pages.
- In your app store listing, if you have an app.
Make one for free
The privacy policy generator asks a few questions about your business and what you collect, then writes a plain-English privacy policy and terms page with India's DPDP Act in mind. Read every line before publishing and remove anything that is not true of your business.
For a clinic, school, lender or any business handling health, financial or children's data, treat the generated policy as a first draft and have a lawyer review it.
Frequently asked questions
Is a privacy policy mandatory in India?
If your website collects personal data, publishing one is expected under Indian law and required by most payment, advertising and analytics services. The DPDP Act adds a duty to give a clear notice whenever you collect data.
Can I copy a privacy policy from another website?
You should not. It is someone else's copyrighted text, and it describes their practices, not yours. An inaccurate policy can cause more trouble than a short accurate one.
Do I need a cookie banner in India?
Indian law does not prescribe a specific banner, but it does expect clear notice and consent for collecting personal data. If you use advertising or tracking tools, telling visitors and offering a choice is the safe course. Visitors from Europe have stricter rules.
Do I need separate terms and conditions?
They do different jobs. The privacy policy explains what you do with people's data. Terms and conditions set the rules for using your site and buying from you, such as refunds, delivery and liability. An online shop needs both.