In this article · 5 sections
If your site has a contact form, booking form, newsletter signup, analytics or online payments, it collects personal data. A clear privacy policy for your website is expected under Indian law and builds trust with customers, payment gateways and ad platforms.
Legal background (brief)
- IT Act, 2000 and the SPDI Rules, 2011 require bodies handling sensitive personal data to publish a privacy policy
- The Digital Personal Data Protection (DPDP) Act, 2023, with its Rules notified in 2025 for phased implementation, requires clear notices, consent and security safeguards. See DPDP Act for small business websites
- Google Ads, Meta, payment gateways and app stores also require a privacy policy
What to include
- Who you are: business name, address, contact
- What you collect: names, phone numbers, emails, addresses, booking details, payment references, IP/device data, cookies
- How you collect it: forms, WhatsApp, calls, analytics, cookies
- Why: responding to enquiries, bookings, invoices, marketing (only with consent), security
- Sharing: payment gateways, hosting, email/SMS providers, analytics, legal requirements
- Retention: how long you keep it
- Security: HTTPS, access controls, backups. See SSL for every website
- User rights: access, correction, erasure, withdraw consent, grievance redressal
- Cookies and analytics. See cookie consent in India
- Contact / grievance officer details
- Changes to the policy
Common mistakes
- Copying another site's policy that mentions services you don't use
- Not mentioning WhatsApp, Google Analytics or Meta Pixel
- Hiding the link; put it in the footer and next to forms
- Saying you "never share data" while using third-party tools
Keep it in sync
Update the policy whenever you add a new form, tool, pixel or payment method.
Pair it with clear website terms and conditions.
FAQs
Is a free template enough?
It's a starting point. Edit it to match what your website actually does.
Does a small business really need one?
If you collect any personal data online, yes. It's also required by most ad and payment platforms.
This article is general information, not legal advice.
Was this article helpful?
Your answer helps us improve our guides