Do I need a separate Privacy Policy and Terms of Use, or can one document cover both?

Keep them separate. A data-protection notice needs to be standalone and specific to count as proper notice under the DPDP Act's notice requirements, and burying it inside a general terms document is a common reason consent flows fail to hold up later.

Does the Consumer Protection (E-Commerce) Rules 2020 apply to my B2B SaaS product?

Usually not, for sales to other businesses buying for business use. The Rules apply based on the Consumer Protection Act 2019's definition of consumer, which excludes commercial-use purchases. The moment you sell to an individual, including one buying for self-employment, that specific transaction falls back inside the Rules.

Do I need a Refund Policy for a subscription product with no physical goods involved?

Yes. Taking payment is what triggers the requirement, regardless of the product type. Subscription cancellation and refund terms need to be stated just as clearly as they would for a physical order.

What's the difference between my own Privacy Policy and a Data Processing Agreement?

Your Privacy Policy is your promise to your own users about how you handle their data. A DPA is a separate contract with a vendor or processor who touches that data on your behalf, making your security, breach-notification, and erasure obligations binding on them too.

What Your Website Legally Needs in India: Terms, Privacy, Refunds, and the E-Commerce Rules

Buildwright Team26 July 20264 min read

website-termsprivacy-policydpdpe-commerce-rulesconsumer-protection

Need help with website terms? We can handle it for you.

Most founders build the product first and treat the legal pages as something to paste in before launch. The pages that actually get pasted in are usually the wrong ones for the business, copied from a template built for a different country or a different kind of customer.

Key takeaway

A live Indian website needs Terms of Use, a DPDP-compliant Privacy Policy, and a Refund/Cancellation Policy if it takes payment. If you sell to individual consumers, the Consumer Protection (E-Commerce) Rules 2020 add disclosure and grievance-redressal obligations, but they exclude purchases made for commercial or business use, so a purely B2B platform is usually outside their scope for that transaction.

The four baseline documents every live website needs

Terms of Use, a Privacy Policy, a Refund/Cancellation Policy where you take payment, and, if you sell to consumers specifically, compliance with the Consumer Protection (E-Commerce) Rules 2020. Each one answers a different question, and a template built for one doesn't answer the others.

Terms of Use: what it actually has to cover

Terms of Use is the contract between you and anyone who uses your site or product: what they're allowed to do, what you're not liable for, and how the relationship ends if it has to. It sits alongside the Privacy Policy rather than inside it. Bundling the two into one document is one of the most common reasons a consent flow later fails to hold up, because a data-protection notice buried inside a general terms page usually isn't standalone or specific enough to count as proper notice.

Privacy Policy: governed by the DPDP Act

A Privacy Policy discloses what personal data you collect, why, and what rights a user has over it. It is governed by India's Digital Personal Data Protection Act, 2023, there is no separate privacy statute sitting behind it. If you want the full compliance depth on notice, consent, retention, breach notification, and the current DPDP commencement timeline, BuildWright's own DPDP Compliance Checklist tool covers that ground directly rather than repeating it here.

This article is general information, not legal advice. If you need advice for your specific situation, contact Buildwright directly.

Get it done for you

Hand it to Buildwright — we handle the drafting, filing and compliance end to end.

Website Terms, Privacy & Refund Policy Drafting

We take your product details: what you collect, how you use it, and whether you sell to consumers or businesses. Then we produce a customized Terms of Use, DPDP-compliant Privacy Policy, and Refund Policy set, reviewed against the Consumer Protection (E-Commerce) Rules 2020 where applicable.

Do it yourself, faster

Use our guided tool to generate what you need in minutes.

DPDP Compliance Checklist

A generic AI checklist will default to GDPR and miss what's actually different here. Answer a few real questions about how your product handles user data and get a status check against India's actual Digital Personal Data Protection Act, 2023 and Rules, 2025.

Get new templates and compliance updates by email.

What Your Website Legally Needs in India: Terms, Privacy, Refunds, and the E-Commerce Rules

The four baseline documents every live website needs

Terms of Use: what it actually has to cover

Privacy Policy: governed by the DPDP Act

Refund/Cancellation Policy: mandatory once you take payment

The Consumer Protection (E-Commerce) Rules 2020: what they require

The B2B exclusion founders get wrong

Data Processing Agreements: the document B2B SaaS founders skip