Yes, for most entities operating online in India, both are mandatory. A Privacy Policy is explicitly required for “data fiduciaries” (those processing digital personal data) under the Digital Personal Data Protection Act, 2023, and for “body corporates” handling sensitive personal data under earlier IT Rules. Similarly, Terms & Conditions (user agreement) are mandated for “intermediaries” (which include many websites, apps, and online platforms) under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Even for businesses not affected by these requirements, having both is crucial for legal protection, defining user responsibilities, and managing legal liabilities in the long-term.