Terms of Service & Privacy Policy

Every Indian website, app, SaaS product, marketplace, fintech, edtech and D2C brand needs two public-facing legal documents: Terms of Service (the contract the user accepts when they use the product) and a Privacy Policy (the disclosure of how personal data is collected, processed, shared and retained). By 2026, these are no longer cosmetic legal pages — they are the front line of regulatory exposure under the Digital Personal Data Protection Act 2023 (DPDP Act), the IT Act 2000 and its Rules (including the IT Rules 2021 and 2023 amendments), and where applicable the EU GDPR and UK GDPR for users in those jurisdictions.

The DPDP Act 2023, with its rules notified, has changed the operating model. Every Indian business that processes personal data is now a Data Fiduciary; users are Data Principals with enforceable rights (access, correction, erasure, grievance redressal, nomination); a Consent Manager framework allows users to manage consents centrally; significant data fiduciaries face additional obligations including a Data Protection Officer; and a designated Grievance Officer must be named, contactable, and respond within statutory timelines. Consent must be free, specific, informed, unconditional and unambiguous — and capable of being withdrawn as easily as it was given. Penalties run up to INR 250 crore per breach.

We draft Terms of Service and Privacy Policies that are DPDP-compliant, IT Act / IT Rules compliant, GDPR / UK GDPR aligned where global users are involved, sector-specific (fintech, healthtech, edtech, marketplace, SaaS), and designed to hold up under regulator scrutiny and consumer-court challenge. Same team also drafts the cookie banner, the data processing agreement (DPA) for sub-processors, the data deletion / retention policy and the breach response plan.

What a DPDP-Grade Terms of Service Locks Down

• Acceptance, Eligibility & Age-Gating:: Click-wrap or browse-wrap acceptance, age-gating for minors (verifiable parental consent under DPDP Act for users under 18 in defined contexts), eligibility, KYC where applicable.

Service Description, Pricing, Refunds & Cancellation:
Scope of service, pricing, taxes (GST), refunds and cancellation, subscription roll-over, free trial conversion — drafted to consumer-court standards and sector-specific (RBI for fintech, IRDAI for insurance, SEBI for capital markets).

• User Conduct, IP & Content Licence:: Permitted and prohibited use, intellectual property ownership, user-generated content licence, takedown mechanism (Section 79 IT Act safe harbour where intermediary), content moderation under IT Rules 2021.

• Limitation of Liability & Indemnity:: Liability cap, exclusion of indirect / consequential damages, user indemnity for breach of terms, force majeure.

• Governing Law & Dispute Resolution:: Indian law, jurisdiction (typically Mumbai / Delhi / Bangalore), arbitration where applicable, consumer-court carve-outs respected.

What a DPDP-Grade Privacy Policy Locks Down

• Data Categories & Purposes:: What personal data is collected, from whom, for what purposes, on what legal basis (consent under DPDP Act, legitimate uses for limited cases) — written in plain language as the DPDP Act requires.

• Data Principal Rights:: Right to access, correction, erasure, grievance redressal, nomination — with workflow described and timelines stated. Grievance Officer name, designation and contact published.

• Consent & Withdrawal:: Mechanisms for granular consent capture, consent manager integration where applicable, easy withdrawal, audit trail of consent and withdrawal events.

• Cookies, Tracking & Cross-Border Transfer:: Cookie consent banner aligned with DPDP and ePrivacy / GDPR standards; cross-border data transfer disclosures (Schedule III negative list under DPDP Act); sub-processor list with country and safeguards.

• Retention, Deletion & Breach Notification:: Retention period per data category, automated deletion workflow, breach notification protocol to Data Protection Board within statutory timelines, user notification process.

• Children's Data & Sensitive Categories:: Verifiable parental consent for processing of children's data under DPDP Act, additional safeguards for sensitive personal data (health, financial, biometric).

• Global Users — GDPR / UK GDPR Add-On:: Where the product has EU / UK users, GDPR / UK GDPR add-on covering legal basis (Article 6), data subject rights (Articles 12–22), DPO appointment, cross-border transfer mechanisms (SCCs, adequacy decisions), supervisory authority.