What a website privacy policy needs to say and why
Learn what a privacy notice on an Indian website is for, which disclosures it carries, and why a copied policy creates more exposure than it removes.
The page nobody reads and everybody copies
Almost every Indian business website has a privacy policy link in the footer. A large share of those pages were copied from another site and never edited. They mention cookies that the site does not set and jurisdictions the business has never traded in. Some still name the original company further down the page.
A privacy policy is not decoration and it is not a disclaimer. It is a notice that describes what personal data the business collects why it collects it and what the person whose data it is can do about it. Under the Digital Personal Data Protection Act 2023 the notice is the document that makes consent meaningful. A notice that does not describe your actual processing is not performing that function.
What a policy does not do and what writing one costs
A privacy policy does not make your data handling lawful. If the business collects data it does not need or keeps it longer than the stated purpose requires then the policy simply documents that. It also does not protect you from a breach. A notice is a disclosure instrument not a security control.
The cost is mostly time rather than money. Someone inside the business has to list every place personal data enters. Contact forms enquiry chats WhatsApp numbers CRM records payment gateway handoffs analytics tags advertising pixels mailing lists and resumes sent to a careers address all count. That inventory is the actual work. Drafting the page afterwards is comparatively quick. Reviews by a lawyer carry professional fees and GST at 18 per cent applies to those fees.
Who needs a considered policy and who needs a short one
A considered policy is necessary for any site that takes payments holds accounts runs a loyalty programme collects health or financial information or sends data to advertising platforms. Volume and sensitivity both raise the stakes. A business processing children's data or acting as a platform for other sellers sits at the higher end of obligation.
A short plain notice is enough for a five page brochure site with one enquiry form and no tracking beyond basic analytics. Businesses in that position often buy a long template full of clauses about international transfers and automated decision making that do not apply to them. The long document is worse than the short one. It makes promises nobody in the business knows about and it invites questions you cannot answer.
The disclosures the notice carries
The structure follows the flow of the data. The notice identifies the business and gives a working contact point. It states what categories of personal data are collected and separates what the person provides from what is gathered automatically. It states the purpose for each category in specific terms rather than as a general reference to business purposes.
It then covers who else receives the data. Payment processors hosting providers email platforms CRM tools and advertising networks are all third parties and the notice should say that data reaches processors of that kind. It explains how long data is kept or the basis on which that period is decided. It describes the rights available to the person including access correction and withdrawal of consent and it explains the route for exercising them.
Finally it gives a grievance route with a named contact and a method that works. A form that nobody monitors is a failure of the mechanism rather than a technicality. The DPDP framework is being brought into force in stages through rules so the obligations that attach to a given business depend on timing and on the nature of the processing.
Judging whether the policy matches reality
The flattering measure is that the page exists and loads. Every site passes that test.
The measure that matters is the gap between the notice and the data flows. Open the tag manager and the list of connected tools and check each one appears in the policy. Send a test request to the grievance address and see whether anyone replies. Ask whoever handles enquiries where the form submissions go and for how long they stay there. A notice that survives those three checks is doing its job. One that fails them documents a problem rather than solving it.
The mistake that turns a safeguard into an admission
The expensive mistake is copying a policy that describes a different business. The copied page typically overstates what you do. It promises deletion within a period nobody tracks. It names a data protection officer who does not exist. It claims certifications the business has never held. Each of those statements is a written representation made to every visitor.
That matters because the policy is the first document anyone looks at when there is a complaint a notice or a diligence exercise ahead of a funding round or an acquisition. A mismatch between the page and the practice is easy to demonstrate and hard to explain. A shorter accurate notice carries far less risk than a long borrowed one.
This guide describes how the notice works and what it normally discloses. It is not legal advice on your obligations. A qualified lawyer should confirm what applies to your business before you publish or rely on a policy.
This guide explains how something works. It is not legal, tax or financial advice, and rules change. Confirm anything regulatory with a qualified professional before you act on it.