LEGALWEBSITE.in

Reference library

Indian digital compliance, explained from the text of the law.

Each note cites the section, rule or guideline it comes from. Where a rule is not yet in force, or the position is unsettled, the article says so rather than filling the gap.

Data protection 8 min read

The DPDP Act, 2023: what it actually requires

The obligations the Act places on anyone who decides why and how personal data is processed — notice, consent, security, breach reporting, children's data and grievance redressal.

Read the note
Data protection 5 min read

Writing a consent notice that meets Section 5

The four items a DPDP notice must contain, the language requirement, and the drafting habits that cause a notice to fail.

Read the note
Cookies 6 min read

Cookies and trackers: what Indian law actually says

India has no dedicated cookie law. The obligation comes from the DPDP Act where a cookie processes personal data, and from the dark-pattern guidelines where the banner is designed to push a choice.

Read the note
Intermediaries 7 min read

IT Rules, 2021: what an intermediary must publish and when it must act

Publication duties, the Grievance Officer, the timelines as amended in 2026 (24-hour acknowledgement, 7-day disposal, 2- and 3-hour removals), and the take-down obligations that attach to a website hosting third-party content.

Read the note
Data protection 5 min read

SPDI Rules, 2011: the older regime that still applies

Section 43A of the IT Act and the 2011 Rules on sensitive personal data — the privacy-policy contents, written consent, disclosure and the ISO 27001 security benchmark.

Read the note
Security 5 min read

CERT-In Directions, 2022: six hours to report, 180 days of logs

The reporting, log-retention, clock-synchronisation and KYC directions issued under Section 70B(6) of the IT Act, and who they bind.

Read the note
Consumer 6 min read

E-commerce disclosure and the 2023 dark-pattern guidelines

What an online seller must display, the consumer grievance timelines, and the thirteen specified dark patterns a platform may not use.

Read the note
Security 5 min read

A personal data breach in India: who you must tell, and how fast

Two separate reporting duties run in parallel — CERT-In within six hours and the Data Protection Board under the DPDP Act — plus sector rules for regulated entities.

Read the note
AI 9 min read

AI on your website: the 2026 synthetic-content rules and what else applies

India has no standalone AI statute. What binds you today is the IT Amendment Rules, 2026 on synthetically generated information, the MeitY governance guidelines, sector frameworks and the DPDP Act.

Read the note

See how your own site measures up

The audit checks a live website against the same provisions these notes describe.

Run a free audit