Beardo Privacy Policy 2026: Your Data Rights Cite a Repealed UK Law

Beardo's privacy policy has a section headed "Controlling your personal information". It is the part of any privacy policy that matters most, because it is where a company tells you how to get at what it holds about you. Here is the sentence:

"You may request details of personal information about you that we hold under the Data Protection Act 1998. A small fee will be payable."

The Data Protection Act 1998 is an Act of the United Kingdom Parliament. It was repealed and replaced by the UK's Data Protection Act 2018. It has never applied in India, and it has not been in force anywhere since 2018. The fee is the second tell: charging a small fee for a subject access request was a specifically British practice under that 1998 Act, and it was abolished in 2018 along with the Act itself.

India's own law on this is the Digital Personal Data Protection Act, 2023, and it is not mentioned anywhere on the page. Neither is the Information Technology Act, 2000, which Minimalist's policy cites by name. None of this means Beardo will refuse you your data — the sentence is an offer to provide it, and the email address given works. It means the page is quoting a dead foreign statute to frame an Indian customer's rights, and attaching a charge to a request that Indian law does not permit a charge for.

This is a template, and it is worth saying so plainly because it explains the anomaly rather than condemning it. The cookie section opens: "A cookie is a small file which asks permission to be placed on your computer's hard drive", and continues "We use traffic log cookies to identify which pages are being used." That is boilerplate which circulated widely on British small-business websites in the 2000s, and the 1998 Act reference travels with it.

We checked how far it has travelled. Of four Indian D2C privacy policies read the same morning — Minimalist, Dot & Key, SuperBottoms and Neemans — Minimalist's carries the identical cookie paragraphs. Dot & Key and SuperBottoms wrote their own, and both are substantially longer and more specific about who receives the data. Two of four is a shared template, not an industry pattern, and this page reports it as the former.

Using a standard template is legitimate, extremely common and says nothing about a brand's products or its service. It is worth noticing only for what it predicts: a document assembled from someone else's boilerplate tends not to answer the questions specific to its own market, and that is exactly what happens below.

The commitments it does make are clear and worth crediting. "We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so." That is an unambiguous no-sale clause, and it is stronger than a policy that merely lists categories of recipients.

Third-party marketing is framed as opt-in: Beardo "may use your personal information to send you promotional information from time-to-time about third parties which might be of interest to you, provided you express the same to us." The last six words are the ones that matter, and a good many policies put that the other way round.

The correction right is unqualified: "If you believe that any information about you is incorrect or incomplete, please email us as soon as possible. We ensure a prompt action to correct the same." No form, no fee, no identity procedure — just an email.

Now the absences, which on a privacy policy are the substance. There is no retention period anywhere in this document — nothing says how long Beardo keeps your name, email or order history. There is no deletion right. The page tells you how to correct data and how to request a copy of it; it does not tell you how to have it erased. There is no list of who the data is shared with — no payment processors, no couriers, no analytics providers named, where SuperBottoms names a category it calls "Select Partners" and Neemans names device-level collection explicitly.

The one structural omission with a specific Indian counterpart is the grievance officer. Beardo's privacy policy names no grievance officer, no designation and no postal address. The only route it gives is one email address, printed in the source as support@Beardo.in, with that capital B.

Compare Minimalist's page, read the same morning and running the same cookie boilerplate: it carries a section headed "Grievance Officer" stating "In accordance with Information Technology Act 2000 and rules made there under, the name and contact details of the Grievance Officer are provided below", followed by the operating company's name, a full Jaipur address and a phone number. Two brands, one template, and only one of them added the section India expects.

Beardo does publish a customer care number and email elsewhere on the site — the footer carries +91 7435000861 and Support@beardo.in — so a customer is not without a route. The observation is narrower: the privacy policy itself does not name one, and a named officer with a designation is what an escalation under Indian IT rules is normally addressed to.

It is not part of the privacy policy, but it sits in the footer of the same page and it is the most useful privacy-adjacent text Beardo publishes. Under "Caution Notice" and "FRAUD ALERT", the site states: "Please ensure you make payments only on the Beardo website or to your delivery partner in case of cash on delivery."

Then it gets specific, which is what makes it good. "Beardo will never - (1) call asking for payments from its consumers via WhatsApp, UPI or an unverified QR code; or (2) call asking for a second payment of order you have already placed." Naming the two exact scripts a refund-fraud caller uses — the UPI or QR request, and the second-payment demand — is more practically protective than any clause in the policy above it.

Of the privacy and terms pages read across this month's D2C reads, this is the most specific fraud warning we have found, and it is worth saying so on a page that spends four sections on what the document gets wrong.

Email support@Beardo.in and ask. Do not cite the Data Protection Act 1998, because it is a repealed British statute and it gives you nothing; the relevant Indian law is the Digital Personal Data Protection Act, 2023. If you are asked to pay a fee, that fee comes from the template rather than from Indian law, and it is reasonable to ask on what basis it is being charged.

For correction, the policy's own route is the simplest one on any D2C page read this month: email, and the page commits to "prompt action". For deletion, the policy gives no route at all, so the same email address is the only address available.

None of the above is legal advice, and nothing here says Beardo has breached any law or would refuse any request. This page describes a published document as it stood on 10 October 2026. Whether a clause is valid, enforceable or compliant is a matter for a court, a consumer forum or the Data Protection Board, and not for a shopping page.