# Privacy Policy, Terms of Use & Refund Policy

> Websites and apps that collect personal data need a privacy policy, terms of use and, for e-commerce, return and refund policies plus a grievance officer under the Consumer Protection (E-Commerce) Rules, 2020. The Digital Personal Data Protection Act, 2023 and its Rules (notified in November 2025) phase in core obligations — notice, consent, security, breach reporting and data-principal rights — by May 2027.

Practice: Legal Documents & Agreements — https://www.industax.com/services/legal-documents/

Generic policies copied from other sites usually describe data practices you don't follow, which creates liability rather than reducing it. We map what data you actually collect, why, where it is stored and who it is shared with, and write policies that match.

With the DPDP Rules' 18-month runway ending in May 2027, now is the time to build consent notices, retention schedules and breach processes into your product rather than retrofitting them.

## Key facts

| Item | Detail |
| --- | --- |
| Current law | IT Act 2000; IT (Reasonable Security Practices) Rules 2011 |
| DPDP Act 2023 | Core obligations apply from May 2027 |
| E-commerce | Return/refund policy and grievance officer mandatory |
| Children's data | Verifiable parental consent under DPDP |

## Who needs this

- Startups launching websites and apps
- E-commerce and D2C brands
- SaaS companies processing customer data

## What's included

- Data mapping questionnaire
- Privacy policy and terms
- Refund and cancellation policy
- DPDP readiness notes

## Documents

- Website/app details
- Data collected and vendors used
- Business model and refund practices

## Process

1. **Map** — Data flows and practices captured.
2. **Draft** — Policies written to match.
3. **Publish** — Policies and consent flows implemented.

## FAQs

### When does the DPDP Act apply to my business?

The Data Protection Board was set up when the Rules were notified in November 2025; the main obligations for businesses — notice, consent, security safeguards, breach reporting and rights handling — apply from May 2027.

### Is a privacy policy mandatory for a small website?

Yes, if it collects personal information such as names, emails or phone numbers through forms. The IT Rules require a published privacy policy for bodies corporate handling such information.

### Do e-commerce sites need a grievance officer?

Yes. The E-Commerce Rules require marketplaces and inventory e-commerce entities to appoint a grievance officer and display their details, and to acknowledge complaints within 48 hours.

## Official sources

- MeitY — Digital Personal Data Protection: https://www.meity.gov.in/

---
Canonical page: https://www.industax.com/services/legal-documents/privacy-policy-terms
Publisher: Indus Tax — CA-led tax and compliance firm (https://www.industax.com). Contact: info@industax.com, 9059139258.
This is general information, not advice for your specific facts.