Last updated: 18 October 2026
Short answer: An Indian website or app that collects personal data needs a privacy policy today, and will need a fuller, DPDP-style notice by 13 May 2027, when the main duties under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 begin. Until then, section 43A of the IT Act and the SPDI Rules, 2011 still require a published privacy policy and a grievance officer. A DPDP-ready policy must give an itemised list of the personal data you collect with the specific purpose for each, explain how users can withdraw consent as easily as they gave it, exercise their rights and complain to the Data Protection Board, and publish a contact person. Write it in clear language, available in English or any Eighth Schedule language the user chooses.
The timeline: what applies now and what applies later
The DPDP Rules, 2025 were notified on 13 November 2025 and come into force in three stages.
| From | What comes into force | What it means for your website |
|---|---|---|
| 13 November 2025 | Definitions and the Data Protection Board | Start mapping what personal data you hold |
| 13 November 2026 | Registration and duties of Consent Managers | Relevant only if you will accept consent through a Consent Manager |
| 13 May 2027 | Notice, consent, security safeguards, breach intimation, erasure, children’s data, rights and grievances, cross-border transfer; section 43A of the IT Act is omitted | Your DPDP notice, consent flows, vendor contracts and breach plan must be live |
In early 2026 the Ministry of Electronics and Information Technology consulted industry on shortening some of these periods. As on 18 October 2026 no change to the commencement dates has been notified. Do not wait: data mapping, consent screens and vendor contracts take months.
Until 13 May 2027: a body corporate handling “sensitive personal data or information” (passwords, financial details, health data, biometrics and similar) must publish a privacy policy, take written consent for sensitive data, use reasonable security practices, and appoint a grievance officer who redresses grievances within one month (SPDI Rules, 2011). A policy written for the DPDP Act can satisfy both regimes if you add a short transitional paragraph.
Who the DPDP Act covers
The Act applies to digital personal data of individuals processed in India, and to processing outside India in connection with offering goods or services to people in India. It covers data collected online, and data collected on paper and later digitised. It does not apply to an individual processing data for personal or domestic purposes, or to data that a person has made public herself.
| Term | Meaning |
|---|---|
| Data Principal | The individual the data is about: your user or customer. For a child (under 18), it includes the parent or lawful guardian. |
| Data Fiduciary | You: the business deciding why and how data is processed. |
| Data Processor | A vendor processing data for you: hosting, e-mail, CRM, payment gateway, courier, call centre. |
| Consent Manager | A registered entity through which a person can give, manage and withdraw consent. |
What a DPDP-compliant privacy notice must contain
Section 5 and rule 3 require the notice that accompanies or precedes a request for consent to:
- Be understandable on its own, independently of your other terms.
- Give, in clear and plain language, an itemised description of the personal data and the specified purpose of processing, with a description of the goods, services or uses enabled.
- Give the specific link on your website or app, and any other means, by which the person can withdraw consent, exercise her rights and complain to the Board.
Add these items as well, because other provisions require them or users will look for them:
- Contact details of a Data Protection Officer or of a person who can answer questions about processing (section 8(9), rule 9).
- Grievance process and timeline: respond within a reasonable period not exceeding 90 days (rule 14).
- Rights: access to a summary of data and the identities of those it was shared with, correction, completion, updating, erasure, grievance redressal and nomination (sections 11 to 14).
- Sharing: categories of processors and other fiduciaries you share data with.
- Retention: how long you keep each category, and that you will erase it when the purpose is served or consent is withdrawn (section 8(7)). Rule 8 also requires keeping certain logs and associated data for at least one year.
- Security: a short description of safeguards such as encryption, access control and logging (rule 6).
- Children: whether you serve users under 18 and how you obtain verifiable parental consent (section 9, rule 10).
- Cookies: what you use and how to change choices.
- Language: the notice must be available in English or any Eighth Schedule language, at the user’s option.
Free sample: itemised notice table
This table is the heart of a DPDP notice. Adapt the rows to what your site actually collects.
| Personal data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, e-mail, mobile number | Creating and managing your account; sending order and service messages | Consent | Until you delete your account, plus [ ] months |
| Delivery address | Delivering your order | Voluntarily provided for this purpose (section 7(a)) | [ ] years for tax and accounting records |
| Payment status and transaction ID (card details are handled by our payment gateway) | Confirming payment, refunds and accounting | Consent and compliance with law | As required by tax law |
| IP address, device and log data | Security, fraud prevention and keeping logs | Compliance with law and security obligations | At least one year (rule 8) |
| Analytics cookies | Understanding how the site is used | Consent through the cookie banner | [ ] months |
| Marketing preferences | Sending offers and newsletters | Separate, optional consent | Until you withdraw consent |
How to withdraw consent or exercise your rights: Visit [link to your rights page] or write to [privacy e-mail]. Withdrawing consent is as easy as giving it. We will respond within [ ] days and in any case within 90 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.
Contact person for personal data questions: [Name or designation], [e-mail], [address].
Need the complete, editable set? The Lexfolio Website Legal Pack includes a DPDP-ready Privacy Policy and Notice, consent and checkbox wording, a cookie policy and banner text, terms of use, refund and shipping policies, a contact and grievance officer page, a rights request form, breach intimation formats and a short data processing agreement.
Consent done right
- Consent must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action” (section 6(1)). Pre-ticked boxes, silence or continued browsing are not consent.
- Ask for separate consent for optional purposes such as marketing. Do not bundle it with the terms of use.
- Users must be able to withdraw consent as easily as they gave it (section 6(4)), and you must then stop processing within a reasonable time.
- For some uses, consent is not needed: section 7 lists “certain legitimate uses”, such as where a person voluntarily gives data for a specified purpose (a phone number for delivery) and does not object.
Security, breaches and penalties
- Security safeguards: reasonable measures including encryption or masking, access control, monitoring and logs, backups, and security clauses in processor contracts (section 8(5), rule 6).
- Breach intimation: inform affected users and the Board of every personal data breach; a detailed report to the Board is due within 72 hours of becoming aware (rule 7).
- Penalties (Schedule to the Act): up to Rs 250 crore for failing to take reasonable security safeguards; up to Rs 200 crore each for failing to report a breach or breaching children’s data duties; up to Rs 50 crore for other breaches.
Common mistakes
- Copying a foreign (GDPR or US) policy that does not mention the DPDP Act, the Board or Indian grievance timelines.
- A vague list such as “we may collect information” instead of an itemised table with purposes.
- No working link for withdrawal of consent and rights requests.
- Cookie banners with “Accept” but no equally visible “Reject”.
- Forgetting vendors: you remain responsible for processing by your processors (section 8(1)), so sign data processing agreements.
- Allowing under 18 users without a parental consent step, or running targeted advertising at children.
Get ready before May 2027. The Website Legal Pack is written for both the current IT Act regime and the DPDP Rules, with a launch checklist and shaded notes telling you what to delete after 13 May 2027.
Handling employee data too? See our guide to the appointment letter under the new Labour Codes and the POSH compliance checklist.
Frequently asked questions
Is a privacy policy mandatory for a website in India?
Yes, if you handle personal data. Under the SPDI Rules a body corporate handling sensitive personal data must publish one now, and from 13 May 2027 the DPDP Act requires a detailed notice before seeking consent.
When does the DPDP Act fully apply?
The main duties of Data Fiduciaries apply from 13 May 2027 under the DPDP Rules, 2025. Consent Manager provisions apply from 13 November 2026.
Can I use a privacy policy generator?
You can start with one, but make sure it has an itemised data and purpose table, Indian grievance timelines, a withdrawal link and the Board complaint route. Generic templates often miss these.
Do small businesses and blogs need to comply?
Yes. The DPDP Act has no general small business exemption, though the Government may notify exemptions for certain classes. A blog with a contact form or newsletter collects personal data.
What age counts as a child under the DPDP Act?
Anyone below 18. You need verifiable consent of a parent or lawful guardian, and you must not track, behaviourally monitor or target ads at children.
Do I need a separate cookie policy?
India has no separate cookie law, but cookies that collect personal data fall under the DPDP Act. A short cookie policy with a consent banner is the practical approach.
*This article is general information, not legal advice.*