Privacy Policy
Privacy Policy drafting covering data collection, use, sharing, storage, security, user rights, cookies, and legal compliance for startups.
- Estimate Cost
- ₹5,000 – ₹30,000
- Typical duration
- 5 days
Service overview
- Legal drafting and advisory assistance for preparing a Privacy Policy explaining how a business, website, application, or digital platform collects, uses, stores, shares, protects, and otherwise processes personal data of its users
- The Privacy Policy is intended to provide users with clear information about data practices and to support compliance with applicable privacy and data-protection requirements
- In India, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 establish the current framework for processing digital personal data and impose obligations on organisations processing such data
Who needs it? / When is it needed?
- Startups, companies, websites, mobile applications, SaaS platforms, e-commerce businesses, digital service providers, online marketplaces, and other organisations that collect or process users' personal data
- The service is particularly relevant when launching a new website or application, introducing new data-collection practices, processing customer or employee information, using cookies or analytics tools, sharing information with vendors or third parties, expanding into new markets, or reviewing an existing Privacy Policy for legal compliance
What to expect from the WCP Professionals
WCP professionals support you with:
- Review of the business model, website or application, categories of personal data collected, purposes of processing, collection methods, storage arrangements, third-party service providers, cookies and tracking technologies, data-sharing practices, user rights, security measures, retention practices, and applicable legal requirements
- Identification of privacy risks and compliance gaps
- Preparation or revision of the Privacy Policy
- Guidance on implementing the policy consistently with the organisation's actual data-processing practices.
Key deliverables
Deliverables cover:
- Draft or revised Privacy Policy
- Description of personal data collected and purposes of processing
- Provisions concerning data sharing and third-party service providers
- Data retention and deletion provisions
- Security and protection provisions
- User or Data Principal rights and grievance mechanisms
- Cookie and tracking disclosures where applicable
- Children's-data provisions where relevant
- Cross-border data-transfer provisions where applicable
- Contact and grievance information
- Implementation or compliance recommendations.
- The DPDP Rules, 2025 provide for clear notices to Data Principals and specify implementation requirements relating to notices, security safeguards, breach intimation, and mechanisms for exercising rights.
Standard turnaround time
- Initial drafting may generally be completed within an agreed professional timeline after receiving complete information regarding the business, website or application, data flows, users, third-party providers, and processing activities.
- The timeline depends on the complexity of the platform, number and types of data collected, jurisdictions involved, number of third-party integrations, existing compliance documentation, and revisions required.
Government fees, timelines & key outcomes
- No standard government fee is ordinarily applicable merely for drafting or publishing a Privacy Policy.
- Separate statutory, registration, certification, professional, or regulatory costs may arise where a specific compliance process or approval is separately required.
- Key outcomes include a Privacy Policy tailored to the organisation's actual data-processing activities, clearer disclosure to users, identification of privacy obligations, and a documented framework supporting compliance with applicable data-protection requirements.
- The DPDP Rules, 2025 were notified in November 2025 and provide for phased implementation of different provisions, rather than making every obligation effective on the same date.
Forms & filings involved
- No standalone government filing is ordinarily required merely to prepare or publish a Privacy Policy.
- Depending on the organisation and applicable legal framework, related compliance documentation may include consent notices, grievance-redressal mechanisms, personal-data processing records, vendor or processor agreements, data-processing clauses, breach-related documentation, and other internal privacy or security records.
- The DPDP Rules, 2025 contain specific requirements relating to notices, security safeguards, breach intimation, and mechanisms for Data Principals to exercise their rights.
Documents required
- Existing Privacy Policy or privacy notices
- Website or application details
- List of personal data collected
- Sources and methods of collection
- Purposes of processing
- User registration and account processes
- Cookie and analytics information
- Third-party service-provider details
- Data-storage arrangements
- Retention practices
- Security measures
- Consent mechanisms
- Grievance-redressal process
- Terms of service
- Relevant contracts with vendors or processors
- Information regarding international users or transfers
- And details of any existing privacy complaints
- Breaches
- Regulatory communications
What we need from you
- Complete details of the business and digital platform, categories of users, types of personal data collected, purposes for which data is processed, methods of collection, data-storage locations, third parties receiving or processing data, cookies and tracking technologies used, retention periods or deletion practices, security measures, user-rights mechanisms, grievance contact details, children's data processing where applicable, international operations or transfers, and any existing Privacy Policy or privacy notice.
- You should also identify the jurisdictions in which the platform operates and any specific compliance requirements applicable to the business.
Important conditions
- A Privacy Policy should accurately describe the organisation's actual data practices and should not contain commitments that the business does not implement operationally.
- The applicable obligations depend on the nature of the organisation, type of personal data processed, purpose and manner of processing, users and jurisdictions involved, and applicable exemptions or sector-specific requirements.
- The DPDP Act, 2023 establishes obligations for Data Fiduciaries and rights for Data Principals, while the DPDP Rules, 2025 provide detailed implementation requirements including notice, security safeguards, breach-related obligations, and mechanisms for exercising rights.
- The Rules also provide for phased commencement of different provisions, so the compliance position should be assessed against the applicable effective date rather than assuming that every provision is immediately operative.
- CADP
Additional information
- Privacy compliance should extend beyond simply placing a Privacy Policy on a website or application.
- The policy should correspond with the organisation's actual data lifecycle, including collection, consent or other lawful processing basis, use, sharing, storage, security, retention, deletion, and handling of user requests.
- The DPDP Rules, 2025 establish a framework for clear notices and responsible processing of digital personal data and provide an eighteen-month phased implementation period for several substantive provisions.
- Where a startup operates internationally, additional privacy laws such as the GDPR or other jurisdiction-specific regimes may also apply depending on the users, activities, and territorial scope involved.
- The Privacy Policy should therefore be reviewed whenever the startup materially changes its products, data practices, technology stack, third-party vendors, geographic operations, or applicable regulatory requirements.
The estimated cost covers indicative professional fees only. Government fees, stamp duty and taxes are payable at actuals.
How it works
- 1. Raise a service enquiry describing your requirement.
- 2. A Relationship Manager reviews it and opens it for bidding.
- 3. Pay into escrow and assign the professional you select.
- 4. Track progress to completion, then accept and release payment.
Frequently asked questions
Is a privacy policy mandatory?
Yes, if you collect personal data — the DPDP Act, 2023 requires clear notice of the data collected and how it is used.
Can I copy another company's privacy policy?
No. It must reflect your own data practices, and copying can also infringe copyright.
What must a privacy policy include?
What data is collected, why, how long it is kept, who it is shared with, user rights and how to contact the grievance officer.
Do app stores require a privacy policy?
Yes. Both major app stores require a privacy policy for apps that handle personal data.