Website Terms & Privacy Policy Drafting: Stay Compliant With India's DPDP Act
Running a website or app without a proper Privacy Policy and Terms of Use exposes you to compliance notices under the Digital Personal Data Protection Act, 2023 (DPDP Act), and leaves your business without legal protection against user disputes. This guide covers what these documents must contain and how KanoonPe drafts a compliant, business-specific set for you.
Quick summary
- What it is: Two documents - Terms of Use (governs how users may use your site/app) and Privacy Policy (discloses how you collect and use personal data).
- Governed by: Digital Personal Data Protection Act, 2023 (DPDP Act); Information Technology Act, 2000 and IT Rules, 2011; Indian Contract Act, 1872 for enforceability of terms.
- Best for: Any website, e-commerce store, app, or SaaS platform collecting user data.
- KanoonPe price: Flat, all-inclusive quote on a free callback · Delivery: 2–4 working days.
Quick facts
| Detail | Information |
|---|---|
| Governing law | DPDP Act, 2023; IT Act, 2000 & IT Rules, 2011 |
| Registration required | Not required to publish; must be hosted on the website/app |
| Applicability | Any entity processing personal data of users in India |
| KanoonPe price | Flat, all-inclusive quote - request a free callback |
| Delivery timeline | 2–4 working days |
| Who needs it | Websites, e-commerce, apps, SaaS platforms, blogs collecting data |
What is a Website Terms & Privacy Policy?
Terms of Use (also called Terms & Conditions) is a contract between a website/app operator and its users that sets rules for usage, liability limits, intellectual property, and dispute resolution. A Privacy Policy is a mandatory disclosure document explaining what personal data you collect, why, how it is stored, shared, and how users can exercise their rights over it.
Under the DPDP Act, 2023, any entity that determines the purpose and means of processing personal data (a "Data Fiduciary") must give users clear notice of what data is collected and obtain consent before processing it - a Privacy Policy is the primary vehicle for this notice.
Key clauses these documents should contain
Terms of Use
- Eligibility and account registration conditions
- User conduct and prohibited uses
- Intellectual property ownership (content, trademarks, logos)
- Payment, refund, and cancellation terms (for e-commerce/SaaS)
- Limitation of liability and disclaimers
- Termination and suspension rights
- Governing law and dispute resolution/jurisdiction
Privacy Policy
- Categories of personal data collected (name, contact, payment, device/location data)
- Purpose of collection and legal basis (consent)
- Data sharing with third parties/processors
- Data retention period and deletion process
- User rights - access, correction, grievance redressal, and withdrawal of consent under the DPDP Act
- Cookie and tracking technology disclosures
- Grievance Officer / Data Protection Officer contact details
- Cross-border data transfer disclosures, if applicable
Who needs a Website Terms & Privacy Policy
- E-commerce websites collecting payment and shipping data.
- SaaS platforms and apps processing user accounts, usage data, or analytics.
- Blogs and content sites using cookies, newsletters, or third-party ad networks.
- Any business website with a contact form that captures visitor data.
- Startups preparing for app store listing, since Google Play and Apple App Store mandate a published privacy policy link.
Information needed to draft it
- Nature of the website/app (e-commerce, SaaS, blog, marketplace)
- Types of personal data collected (name, email, phone, payment, location, cookies)
- Third-party tools used (analytics, payment gateways, ad networks, CRM)
- Whether data is shared with or stored by third parties/outside India
- Refund, cancellation, and subscription terms (if applicable)
- Company name, registered address, and grievance/contact details
Ready to get started? Talk to a verified expert → - get a transparent, all-inclusive quote for your Website Terms & Privacy Policy within one business hour.
Drafting and delivery process
- Share your requirements. Fill a questionnaire about your website/app type, data collected, and third-party integrations.
- Lawyer drafts both documents. A privacy-law specialist prepares DPDP-compliant Terms of Use and Privacy Policy tailored to your business model.
- Review and revisions. You review the draft; one round of revisions is included to reflect your exact data flows.
- Finalisation and publishing guidance. You receive the final documents ready to publish, with guidance on where to link them (footer, checkout, signup).
Cost of Website Terms & Privacy Policy in India
| Cost component | What drives it |
|---|---|
| Lawyer drafting fee | Business type, complexity of data collected, number of third-party integrations |
| Number of documents | Terms of Use + Privacy Policy bundled |
| Revisions | One round included |
KanoonPe offers a flat, all-inclusive quote - both documents drafted together, DPDP-Act aligned, with no hidden charges.
Delivery timeline
| Stage | Typical time |
|---|---|
| Requirement gathering | Same day |
| First draft (both documents) | 1–2 working days |
| Review & revisions | 1 working day |
| Final copy | 1 working day |
| Total | 2–4 working days |
Compliance notes
Neither document requires government filing or registration, but they must be published and easily accessible on your website/app (typically footer links and at checkout/signup). Under the DPDP Act, 2023, businesses that process significant volumes of personal data may also need to appoint a Data Protection Officer and register a grievance redressal mechanism - KanoonPe can advise if your business crosses that threshold.
Common mistakes and risks
- Copy-pasting a policy from another website - it will misstate what data you actually collect and create false compliance.
- No grievance/contact mechanism - the DPDP Act requires a clear channel for users to raise data concerns.
- Ignoring cookie disclosures - most websites use analytics or ad cookies that must be disclosed.
- Outdated policy after adding new features - a Privacy Policy must be updated whenever data practices change.
- Treating Terms of Use as optional - without it, you have no contractual protection against liability or IP misuse by users.
Why choose KanoonPe
- Transparent flat pricing - one number for both documents, no per-clause add-ons.
- Filed-on-time or refund - every drafting order ships with a written delivery SLA.
- One accountable case owner - a dedicated lawyer manages drafting and revisions end to end.
- Live status tracking - track drafting progress in your dashboard.
Trusted by 50,000+ businesses, rated 4.7/5, with 500+ verified CAs, CS and lawyers.