Every website, app and WhatsApp business that collects a name, a phone number or an order address now has a legal duty to say what it does with them. The Digital Personal Data Protection Act, 2023 and the DPDP Rules notified in 2025 require a clear notice, a stated purpose, a way to withdraw consent and a grievance contact — and Google, Meta and payment gateways will not approve accounts without a privacy policy URL. This generator drafts a plain-language privacy policy tailored to what your business actually collects, aligned to the DPDP framework, with the standard sections international services expect, exported as HTML or text for your site.
What the DPDP Act expects from a small business
| Requirement | What your policy must do |
|---|---|
| Notice | Tell people what personal data you collect and for what purpose, in clear language (and in the languages of the Eighth Schedule if you serve those users) |
| Consent | Explain how consent is given and withdrawn — cookie banner, form checkbox, WhatsApp opt-in |
| Purpose limitation | Use data only for the stated purpose; delete it when the purpose ends |
| Rights | Access, correction, erasure and grievance redressal; nomination |
| Grievance officer | A contact (name/role and email) and response timeline |
| Security | A statement of reasonable safeguards |
| Children | Verifiable parental consent for under-18s; no tracking or targeted ads to children |
| Breach notification | Tell affected users and the Data Protection Board |
The Rules are being implemented in phases; the practical checklist for small websites, apps and WhatsApp businesses is in DPDP Rules 2025: the compliance checklist.
How to use the generator
- Enter your business name, website/app, contact email and the grievance officer.
- Tick what you collect: contact details, order and delivery data, payment (via a gateway), account logins, location, device/analytics, cookies, marketing preferences, employee/applicant data.
- Tick what you use: analytics (Google Analytics, Meta Pixel), payment gateways, courier partners, email/SMS/WhatsApp providers, cloud hosting; the policy names each category of "data processor".
- Set retention periods (order data for tax records: 8 years; marketing consent until withdrawn) and whether you serve children.
- Generate, read it once, edit the parts that are specific to you, and publish at
/privacy-policy. Link it from the footer, forms, the cookie banner and your app-store listing.
Sections the generated policy contains
Who we are · What we collect and why · Legal basis (consent / legitimate uses) · Cookies and analytics · Sharing with processors · Retention · Security · Your rights and how to exercise them · Children · Cross-border transfers · Grievance officer and Data Protection Board · Changes to this policy.
Companion documents
A privacy policy sits with Terms & Conditions (the contract) and, for sellers, a Refund/Return Policy (mandatory under the Consumer Protection E-Commerce Rules). Marketing consent should also match what you say in messages — see TRAI's new anti-spam rules. If your site runs on WordPress, harden it as well: WordPress security checklist.
Related tools
- Terms & Conditions generator — the agreement that goes with the policy.
- Refund / return policy generator — for shops and marketplaces.
- Robots.txt generator — control crawling of account pages.
- Meta tag generator — canonical and noindex for policy pages.
- Word counter — keep the policy readable.