Privacy policy for an Indian website? The DPDP Act uses other words

Most Indian websites carry a page called “Privacy Policy”. The DPDP Act and the DPDP Rules do not use that term. They list what you must tell people, and what you must publish, in four places. A privacy page that covers all four, plus a notice shown where you ask for consent, rests on the text of the law rather than on a generic template.

Four things the law asks you to put in front of people

1. A notice with each request for consent. It comes with the request or before it.
2. A contact for questions about their data. Published on your website or app.
3. How to make a request. The ways a person can ask to use their rights, published on your website or app.
4. A grievance response period. Published, and not longer than 90 days.

1. The notice that comes with each consent request

Whenever you ask for consent, whether on a sign-up form, at checkout or in an app permission screen, a notice must come with the request or before it. The Rules set the minimum content. The notice must give:

• an itemised description of the personal data, item by item;
• each specific purpose, and a specific description of the goods or services, or the uses, that the processing provides or enables;
• the link to your website or app, or both;
• a description of the other means, if any, by which the person can withdraw consent, use their rights under the Act, and make a complaint to the Board.

The Rules also say the notice must be understandable independently of any other information you make available. That matters for the privacy page. A link to a long policy does not replace the notice: the notice itself has to make sense on its own, in clear and plain language. The person must also be able to read it in English or in any language listed in the Eighth Schedule to the Constitution.

2. A contact for questions about their data

You must publish, prominently on your website or app, the business contact information of your Data Protection Officer, if the law requires you to have one, or of a person who can answer on your behalf the questions people raise about the processing of their personal data. The Rules add that you must mention this contact in every response to a communication in which someone exercises a right. A request for consent must also carry the contact of a Data Protection Officer, where applicable, or of another person you have authorised to respond.

3. How a person makes a request

Publish, prominently, the details of the means a person can use to make a request to exercise their rights, and any particulars you need to identify them under your terms of service, such as a username or other identifier. The Rules treat any sequence of characters you issued to identify the person as an identifier, for example a customer identification file number, an application reference number, an enrolment ID, an email address or a mobile number.

The rights the page should point to are the ones the Act gives: a summary of the personal data you process and who it was shared with, correction, completion, updating and erasure, a grievance process, and nominating another person to act in the event of death or incapacity. The Rules also let a person nominate others using the means you provide.

4. The grievance response period

Publish, prominently, the period within which you respond to grievances under your grievance redressal system. The Rules say it must be a reasonable period not exceeding ninety days, and that you must put technical and organisational measures in place so that you can respond within it. State the number of days you commit to on the page. The 90 days is the outer limit for grievances. It is not a deadline for every rights request.

The Act asks a person to use this process first: they must exhaust your grievance redressal before approaching the Board. A clear path on the page makes that possible.

A checklist for the page

What a page cannot do on its own

A privacy page is not the consent notice. The notice comes with the request for consent and lists the data item by item. Consent itself must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the purpose. A page cannot fix a request that asks for more data than the purpose needs. If you are building both, write the notice first and let the page repeat its contents. See what a consent notice must contain.

The page also cannot promise what you do not do. If you say you erase data when it is no longer needed, make sure the retention schedule behind that line exists. The retention article sets out the rules.

When this applies

The notice, contact, request and grievance duties start on 13 May 2027, eighteen months after the notifications published on 13 November 2025. You can publish the page earlier. If people have already given consent before 13 May 2027, when section 5 comes into force (counted from 13 November 2025), the Act expects a notice to them as soon as reasonably practicable. The timeline article explains the dates.

What this article covers

This article covers the DPDP Act and the DPDP Rules only. Cookie banners, sector rules and other laws that may bind your site are outside it, so ask counsel what else belongs on the page. If you run an online store, DPDPA for online stores lists the personal data a typical store holds. To check whether the Act applies to your business at all, use the processing map.