Coverage, in plain language
Every rule below is written for founders, not lawyers. One sentence on what it requires, who it applies to, and what actually happens if you skip it.
Filter by area, or tap any rule for the detail.
You must ask for clear, specific permission before collecting someone's personal data, and let them withdraw it just as easily.
Ministry of Electronics and IT (MeitY)
You must publish a plain-language notice saying what data you collect, why you need it, and how someone can complain or ask for deletion.
Ministry of Electronics and IT (MeitY)
You must publish a named contact who handles user data complaints, and respond within a set time.
Ministry of Electronics and IT (MeitY)
If personal data leaks, you must tell both the Data Protection Board and every affected user — without waiting to finish your investigation.
Data Protection Board of India
All payment transaction data must be stored on servers physically located in India.
Reserve Bank of India
If you collect money on behalf of others, you need authorisation — and your checkout must never expose secret payment keys.
Reserve Bank of India