Web · 5 min read · October 2026
Your website's privacy policy, explained
If your website has a contact form, a WhatsApp button that logs clicks, analytics or a booking system, it collects personal information. That brings responsibilities. A privacy policy is the page where you explain, honestly, what you collect and what you do with it.
This is a practical overview, not legal advice. India's Digital Personal Data Protection Act, 2023, and the rules under it, set out obligations for organisations handling personal data, and the details matter. For your own policy, especially if you handle sensitive information or many customers, have it reviewed by a lawyer.
01
Why most business websites need one
A contact form collects names, phone numbers and emails. Analytics tools collect information about visitors' devices and behaviour. Payment and booking systems collect more. Under Indian law, organisations handling personal data have obligations around notice, consent, purpose and security. A clear privacy policy is a central part of meeting the notice requirement and showing customers you take their data seriously.
Platforms also expect it. Google, Meta and payment gateways commonly require a privacy policy link for ads, apps and merchant accounts.
02
What it should cover
In plain language: who you are and how to contact you; what personal information you collect (form details, analytics, cookies, payment information); why you collect it; who you share it with (email provider, analytics, payment gateway, courier); how long you keep it; how you protect it; and how people can ask to see, correct or delete their information, or withdraw consent.
03
Be specific to your business
A policy should describe what your website actually does. If you only have a contact form and Google Analytics, say that. If you take bookings and payments, explain how. A long, generic policy listing data you do not collect is not more protective; it is inaccurate, and it confuses people who read it.
04
Why copied templates cause trouble
Many small business sites copy a privacy policy from another website or a free generator. These often refer to foreign laws, mention services you do not use, or omit things you do. Some even keep the other company's name. A copied policy can be worse than none, because it makes promises you are not keeping.
If you use a generator as a starting point, edit every section to match your actual practices.
05
Consent on forms
On contact and booking forms, say briefly why you are collecting the details and link to the privacy policy. If you want to use the details for marketing, such as WhatsApp offers or newsletters, ask for that separately with a clear, unticked checkbox. Do not add people to marketing lists just because they asked a question.
06
Keep only what you need
The simplest way to reduce risk is to collect less. Does the form need a date of birth, an address or a company size? If not, remove those fields. Delete old enquiries you no longer need, and make sure form submissions are not sitting in an unsecured spreadsheet shared with half the office.
07
Link it everywhere it matters
Put a link to the privacy policy in the website footer on every page, beside forms, and in any booking or payment flow. Keep it up to date: when you add a new tool, such as a chat widget or booking system, update the policy to mention it, and change the "last updated" date.
Honest beats long
A good privacy policy for a small business can be a single page in plain English. Customers rarely read the whole thing, but when they do, they should find a clear and accurate description of what happens to their information.
Write down what you actually do with people's data, then do what you wrote.
If your website collects sensitive information, such as health details for a clinic or financial documents for an accounting firm, take professional legal advice. The obligations and risks are higher.
Privacy basics for a small business site
- Policy page. Specific, plain-language, dated, linked in the footer.
- Forms. Only necessary fields, with a short notice and link.
- Marketing consent. Separate, unticked, optional.
- Storage. Enquiries kept securely and deleted when no longer needed.
- Contact. A named way for people to ask about their data.
Review this list once a year, or whenever you add a new tool to the website. Most problems appear when sites grow by adding plugins and widgets nobody documents.
Quick answers
Does a small business website in India need a privacy policy?
If it collects personal information through forms, analytics, bookings or payments, a clear privacy policy is strongly advisable and supports obligations under Indian data protection law. Take legal advice for your specific situation.
Can I copy a privacy policy from another website?
It is not recommended. Copied policies often refer to the wrong laws, services or company, and may promise things you are not doing. Write or adapt one that matches your actual practices.
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023, is India's law on handling digital personal data. It sets out obligations for organisations around notice, consent, purpose, security and individuals' rights.
Related reading
Forms that collect only what you need.
Every website I build includes a privacy page placeholder tailored to the tools actually used, short forms and clear consent wording for you or your lawyer to finalise. Tell me what your site needs to collect.