Skip to content
safelaunch
← All markets

Asia-Pacific · 6 laws · 31 requirements

India: the laws your website or app must follow

If your customers are in India, these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.

Coming up in India

  • 2026-11-13 · DPDP Act 2023 & DPDP Rules 2025: Board and procedural rules in force; consent-manager rules from 13 Nov 2026; notice, consent, security, breach, children and rights obligations from 13 May 2027.
  • 2027-05-13 · DPDP Act 2023 & DPDP Rules 2025: Board and procedural rules in force; consent-manager rules from 13 Nov 2026; notice, consent, security, breach, children and rights obligations from 13 May 2027.

Every upcoming date, with a calendar you can subscribe to

How a SafeLaunch audit checks each one
  • CheckedChecked automatically on every scan
  • AI reviewLooked for by the AI analysis, reported only with evidence
  • Your answersDecided from your answers to the audit questions
  • PreparedPrepared for you in the report's compliance pack
  • You confirmA scan can't see this; you need to confirm it

DPDP Act 2023 & DPDP Rules 2025

Rules notified 13 Nov 2025.

Who it covers: Processing of digital personal data in India, and outside India when offering goods or services to people in India.

What it requires of a website or app (10)

  • Be able to prove that notice was given and consent obtained (if if you rely on consent)Checkeds. 6(10)
  • A standalone notice before consent: itemised data, purposes, how to withdraw consent, exercise rights and complain to the Board (if from 13 May 2027)Checked§5; Rule 3
  • Free, specific, informed, unambiguous consent, as easy to withdraw as to giveChecked§6
  • Verifiable parental consent for under-18s; no tracking, behavioural monitoring or targeted ads to children (if if under-18s use the product)Your answers§9; Rule 10
  • Reasonable security safeguards (encryption, access control, logs kept for a year)Checked§8(5); Rule 6
  • Breach intimation to the Board and affected people without delay, with a detailed report within 72 hoursChecked§8(6); Rule 7
  • Rights to access, correction, erasure, grievance redressal and nominationChecked§11–14
  • Publish the contact of a person who answers data questions (DPO for significant data fiduciaries)Checked§8(9); Rule 9
  • Grievances answered within 90 daysPrepared§13; Rule 14
  • Transfers abroad allowed except to countries the government restrictsChecked§16

Sources:DPDP Rules 2025 (PIB) MeitY data protection framework

IT Act 2000 & SPDI Rules

In force; the SPDI Rules will be superseded as DPDP obligations commence.

Who it covers: Bodies corporate handling sensitive personal data in India; all service providers for CERT-In.

What it requires of a website or app (5)

  • A published privacy policy covering the types of data, purposes and disclosureCheckedSPDI Rule 4
  • A grievance officer named on the website, resolving complaints within a monthCheckedSPDI Rule 5(9)
  • Written consent for sensitive personal data (passwords, financial, health, biometrics)Your answersSPDI Rule 5(1)
  • Reasonable security practices (ISO 27001 or equivalent)CheckedIT Act s. 43A; SPDI Rule 8
  • Report cyber incidents to CERT-In within 6 hours; keep logs for 180 days in IndiaCheckedCERT-In Directions 2022

Sources:MeitY

Consumer Protection (E-Commerce) Rules

In force since July 2020; Guidelines for Prevention and Regulation of Dark Patterns 2023 (13 practices); CCPA self-audit advisory June 2025.

Who it covers: E-commerce entities offering goods or services to consumers in India.

What it requires of a website or app (6)

  • Show legal name, address, customer care and grievance officer details prominently (if if you sell online in India)AI reviewRule 4(2), 4(4)
  • Acknowledge complaints within 48 hours and resolve within one month (if if you sell online in India)PreparedRule 4(5)
  • Explicit, affirmative consent for purchases: no pre-ticked boxes (if if you sell online in India)AI reviewRule 4(9)
  • Clear prices, return, refund, exchange, warranty and delivery terms; country of origin (if if you sell online in India)CheckedRule 5–6
  • No dark patterns: false urgency, basket sneaking, confirm-shaming, subscription traps, drip pricing and othersAI reviewDark Patterns Guidelines 2023
  • Terms give the seller's name and address, return, refund, exchange and cancellation terms, and a grievance officer (if if you sell to consumers)Checkedr. 4(2)–(5) & 5(3)

Sources:Department of Consumer Affairs

IT Rules 2021 (Intermediary Guidelines)

In force since 25 Feb 2021.

Who it covers: Intermediaries: any service that stores or transmits users' content in India.

What it requires of a website or app (6)

  • Terms tell users not to post obscene, pornographic, harmful-to-child, infringing, false or unlawful content (if if users can post content)Checkedr. 3(1)(b)
  • No sexually explicit material; obscene and sexually explicit publishing is an offence (if if the product shows adult content)CheckedIT Act s. 67, 67A, 67B
  • Unlawful content removed when ordered by a court or the government, within 3 hours (if if users can post content)Your answersr. 3(1)(d)
  • A grievance officer is published, complaints are acknowledged within 24 hours and resolved within 7 days (36 hours for removal requests; 2 hours for intimate-image complaints) (if if users can post content)AI reviewr. 3(2)
  • Copyright complaints are acted on (if if users can post content)Checkedr. 3(1)(d); Copyright Act s. 52(1)(c)
  • AI-generated or altered content is labelled prominently as synthetic and carries permanent metadata or a unique identifier where technically feasible; labels can't be removed (if if you provide generative AI)AI reviewr. 3(3) (as amended by G.S.R. 120(E), 10 Feb 2026)

Sources:MeitY: IT Rules 2021, consolidated text updated to 10 Feb 2026

Dark Patterns Guidelines 2023

In force since 30 Nov 2023 (Central Consumer Protection Authority).

Who it covers: All platforms offering goods or services to consumers in India.

What it requires of a website or app (3)

  • No false urgency, basket sneaking, confirm-shaming, forced action or naggingAI reviewAnnex 1 (1)–(5), (9)
  • No subscription traps: cancelling is as easy as signing up, and payment details aren't forced for free trials (if if you sell subscriptions)CheckedAnnex 1 (6)
  • No drip pricing or disguised advertisementsAI reviewAnnex 1 (8), (10)

Sources:CCPA Guidelines for Prevention and Regulation of Dark Patterns, 2023

Promotion and Regulation of Online Gaming Act 2025

Enacted Aug 2025.

Who it covers: Anyone offering, advertising or processing payments for online games in India.

What it requires of a website or app (1)

  • No online money games (games played for money or prizes) offered, advertised or paid for in India (if if you offer real-money games)CheckedPromotion and Regulation of Online Gaming Act 2025

Sources:MeitY

Licensed professionals in India

These regulators' advertising and conduct rules apply on top of the laws above, only to sites of that profession.

Check your site against India's rules

A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.

Check my site free

One free fix in your inbox each week

A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.

By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.

A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.