Website legal requirements in India

The Digital Personal Data Protection Act creates the Data Protection Board of India to oversee compliance and inquire into personal data breaches.

The Digital Personal Data Protection Rules, 2025 include rules on notice, security safeguards, breach intimation and most other Data Fiduciary duties that come into force on 13 May 2027. Plan your site or app’s notices and security safeguards with those duties in mind.

From 1 January 2027, the Consumer Protection (E-Commerce) (Amendment) Rules, 2026 require e-commerce entities to show the prior price next to any announced price reduction. They must also comply with the Guidelines for Prevention and Regulation of Dark Patterns, 2023, including a yearly self-audit. Plan space for the prior price in your product and promotion layouts.

Since 1 August 2023, GST e-invoicing has applied to taxpayers whose aggregate turnover exceeds ₹5 crore. Check whether this threshold applies when planning your invoicing process.

From 1 April 2025, businesses with annual aggregate turnover of ₹10 crore or more must report their e-invoices to the Invoice Registration Portal within 30 days of the invoice date. Your invoicing process needs to account for that deadline if it applies to you.

Under the Reserve Bank of India's Master Direction on Regulation of Payment Aggregators (15 September 2025), non-bank entities that aggregate customer payments for merchants, including online payment aggregators, must be authorised by the RBI. Check the authorisation of a non-bank payment aggregator when choosing one for your checkout.

The .in country-code domain is run by the .IN Registry. The Government of India has authorised the National Internet Exchange of India (NIXI) to operate it since January 2005. You can consider .in when choosing a domain for your site.

Under the Consumer Protection (E-Commerce) Rules, 2020, every e-commerce entity must prominently display its legal name, principal geographic address, website details and contact details for customer care and its grievance officer. Give these details prominent space on your site or app.

GST on intra-state supplies comprises central GST plus state or union territory GST; integrated GST applies to inter-state supplies. Use the checklist below when planning your site or app.

• Plan your data notices and security safeguards.
• Display your legal name, principal geographic address, website details and required contact details prominently.
• Make space for the prior price next to announced price reductions from 1 January 2027.
• Plan a yearly self-audit under the dark-pattern rules.
• Check whether the GST e-invoicing threshold applies to your business.
• Account for the e-invoice reporting deadline if it applies to you.
• Check a non-bank payment aggregator’s RBI authorisation before choosing it for checkout.