By country

Refund Policy Generator India

The Digital Personal Data Protection Act 2023 and its Rules - consent notices, Consent Managers and verifiable parental consent.

Generate your refund policy Read the refund policy guide

Indian refund obligations come from the Consumer Protection (E-Commerce) Rules rather than a cooling-off statute: the seller must publish the return, refund and exchange policy up front, and must not refuse a return where the goods were defective, deficient or misdescribed.

India’s Digital Personal Data Protection Act 2023 replaced the older IT Rules framework with a consent-centric statute. It applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India.

The Act is structurally different from GDPR. There is no legitimate interests basis: processing rests on consent or on a defined set of "legitimate uses". Notices must be standalone, plain, and available in English or any of the languages in the Eighth Schedule of the Constitution. A new intermediary role, the Consent Manager, is registered with the Data Protection Board.

The children’s rules are unusually strict. Verifiable parental consent is required for anyone under eighteen, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited outright rather than merely restricted.

What a refund policy in India has to cover

The return, refund, exchange and warranty position published before purchase, as the e-commerce rules require
That defective, deficient or misdescribed goods must be accepted back
Refund timelines, and the requirement to refund within the period you state
Seller identity and grievance officer details, which the rules require alongside the policy
Any charges, restocking fees or non-returnable categories, disclosed pre-purchase

How India actually moves personal data

Consent notices as standalone artefacts

The DPDP notice cannot be buried in a longer policy - it must be a clear, standalone communication itemising the data, the purpose and the rights, presented alongside the request for consent.

Multilingual delivery

Data principals may require the notice in any Eighth Schedule language, which turns translation into a compliance obligation rather than a nicety.

Consent Managers

A registered intermediary through which people can give, manage, review and withdraw consent. If you integrate with one, that relationship needs describing.

Grievance redressal

Both the DPDP Act and the IT Rules require a route to raise a complaint with the business before escalating - the Act to the Data Protection Board, the Rules to a named grievance officer.

Cross-border transfers

Permitted by default except to countries the Government restricts by notification, which inverts the GDPR model of default prohibition with exceptions.

Third parties the draft will ask you about

Razorpay · PayU · Paytm · UPI rails · AWS ap-south-1 · Zoho · Delhivery · MSG91 · Google Workspace

The rules that apply

DPDP Act 2023

Consent or legitimate uses as the only bases, itemised notice requirements, and penalties up to ₹250 crore for failures to prevent a breach.

DPDP Rules

Operational detail on notice content, Consent Manager registration and obligations, breach reporting to the Board, and retention limits for classes of data fiduciary.

Verifiable parental consent

Required for all users under eighteen, with tracking and targeted advertising to children prohibited.

Significant Data Fiduciaries

A designation bringing extra duties: a Data Protection Officer based in India, independent audits and algorithmic due diligence.

IT Rules 2021

Intermediary obligations that continue to apply, including a published privacy policy, grievance officer and takedown timelines.

What the generated refund policy contains

The statutory right, stated separately
Consumer cancellation rights exist whatever your policy says, so they are set out first and your goodwill terms second.
Time limits and how they are counted
When the clock starts, whether it runs in calendar or working days, and what stops it.
Condition and evidence requirements
What state goods must come back in, and what proof of purchase you accept.
Who pays return postage
Split between faulty and change-of-mind returns, because the law treats them differently.
Refund method and timing
Original payment method, and the deadline you commit to once goods or notice are received.
Exclusions, stated lawfully
Perishables, personalised goods, unsealed hygiene items and downloaded digital content - the exclusions the law actually permits.

DPDP implementation order

Rebuild consent capture around itemised notices
One notice per purpose, standalone, in plain language, with a withdrawal route as easy as the grant.
Set the age gate to eighteen
And build a verifiable parental consent flow that does not itself over-collect.
Name a grievance officer and publish response times
Required by the IT Rules and expected under the Act’s redressal duty.
Assess whether you are a Significant Data Fiduciary
If designated, appoint an India-based DPO and schedule independent audits.
Plan for multilingual notices
At minimum English plus the languages of your largest user bases.

Where this usually goes wrong

Relying on legitimate interests

There is no such basis in the DPDP Act. A GDPR-shaped policy that leans on legitimate interests describes a basis Indian law does not recognise.

Age-gating at thirteen

The Indian threshold is eighteen, with verifiable parental consent below it. This is the widest child-protection band of any major regime.

Burying the notice inside the privacy policy

The Act requires a standalone, itemised notice presented with the consent request.

No grievance officer named

The IT Rules require the name and contact of a grievance officer to be published, with response timelines.

Behavioural advertising to under-eighteens

Prohibited, not merely consent-gated. Ad targeting stacks that rely on age-agnostic profiling are non-compliant by default.

Frequently asked questions

Does the DPDP Act apply to companies outside India?

Yes, where the processing relates to offering goods or services to data principals in India. Physical presence is not required.

Is there a legitimate interests basis in Indian law?

No. Processing rests on consent or on the enumerated legitimate uses - employment, emergencies, legal obligations and similar. The GDPR balancing test has no equivalent.

What is a Consent Manager?

A registered intermediary that lets people give, manage, review and withdraw consent across services through a single interface. It is a distinctive feature of the Indian regime.

What age counts as a child under the DPDP Act?

Under eighteen. Verifiable parental consent is required, and tracking and targeted advertising directed at children are prohibited.

Can I run a no-refunds policy?

Not against statutory rights. In the UK and EU a consumer’s cancellation and faulty-goods rights apply regardless of what your policy says, and advertising "no refunds" is itself treated as a misleading practice.

Do digital products have to be refundable?

The cancellation right can be waived for digital content, but only if the customer gave express consent to immediate delivery and acknowledged losing the right. That acknowledgement has to be captured at checkout, not assumed.

How long do I have to issue a refund?

In the UK and EU, within 14 days of receiving the goods back or of the customer proving they returned them. Card scheme rules and marketplace policies often impose something tighter.