DPDP Act for E-commerce & Retail: Compliance Guide
Online stores, marketplaces, quick-commerce apps and omnichannel retailers collect names, addresses, phone numbers, payment details, browsing trails and purchase histories at scale. The DPDP Act, 2023 and the DPDP Rules, 2025 decide what you may do with that data, what you must tell shoppers, and when you must let it go.
If you run a store, app or marketplace that collects personal data from people in India, you are a Data Fiduciary. Fulfilling an order is the easy part. The hard parts are marketing consent, trackers and ad technology, retention of old accounts, and the vendors that handle your customers' data. Main duties take effect on 13 May 2027, and very large platforms face an extra erasure rule.
Who this covers
Online stores and D2C brands are fiduciaries for customer, order and marketing data.
Marketplaces and aggregators are fiduciaries for buyers and sellers, and share data with sellers who are fiduciaries in their own right.
Quick-commerce, food delivery and grocery apps hold precise location and repeat-purchase patterns.
Brick-and-mortar retailers with loyalty programmes, apps, digital billing or CCTV are covered for the digital data they keep.
Payment gateways, couriers, CRM and ad-tech vendors are usually Data Processors.
Personal data you are likely to hold
Key provisions for E-commerce & Retail
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
The Act reaches foreign sellers and apps that offer goods or services to people in India.
Itemised notice, and consent that is specific, free and as easy to withdraw as to give.
Data a customer voluntarily provides to place an order can be used for that order without a separate consent step.
Accuracy, security, breach intimation, erasure and written contracts with processors.
No tracking, behavioural monitoring or targeted ads aimed at children.
Customer rights to access, correct, erase, complain and nominate.
Large platforms could be notified as Significant Data Fiduciaries.
01Orders, accounts and marketing
Fulfilling the order. A shopper who gives you a name, address and phone number to buy something has voluntarily provided that data for a stated purpose. Using it to deliver, bill and support that order is a legitimate use under Section 7. Keep to that purpose.
Marketing is a different purpose. Promotional email, SMS, WhatsApp and push notifications, cross-selling, lookalike audiences and sharing with partners need their own consent under Section 6. No pre-ticked boxes, no making it a condition of buying, and let customers withdraw as easily as they gave it. TRAI's rules on commercial communications continue to apply.
Notice. The notice under Rule 3 must be itemised: what data, which purposes, how to withdraw consent, how to use rights and how to complain to the Board. Keep it separate from your terms and conditions.
02Cookies, trackers and ad technology
The Act does not mention cookies by name, but trackers, ad pixels and SDKs collect personal data, so the same rules apply. For non-essential tracking, treat consent as the basis, ask clearly and honour refusal.
- Load analytics and advertising tags only after consent, not before.
- List the ad-tech and analytics vendors you share data with in your notice or a linked page.
- Make the consent choice easy to find again and change.
- Check every SDK in your app. Each one is a vendor handling your customers' data.
03Children and young shoppers
A child is anyone under 18. Section 9 requires verifiable parental consent and bars tracking, behavioural monitoring and targeted advertising aimed at children. If your store sells toys, school supplies or games, decide how you will know who is under 18: age declaration with checks, parental linking, restricted ad personalisation on child accounts. Rule 10 explains how a parent's identity and age are verified.
If you do not intend to serve under-18s, say so, design sign-up to discourage them, and act when you find one.
04Retention, deletion and dormant accounts
Under Section 8 you must erase personal data once the purpose is served or consent is withdrawn, unless the law requires you to keep it. Invoices and tax records have legal retention periods. Marketing profiles and dormant-account data usually do not.
Very large platforms. Rule 8 and its Third Schedule add a rule for e-commerce entities with at least 2 crore registered users in India: personal data must be erased after the retention period, generally three years from the user's last interaction, with at least 48 hours' warning first. Smaller stores are not under that rule but must still erase data when its purpose ends. Processing logs must be kept for at least one year.
05Sellers, vendors and who is responsible
Marketplaces pass buyer data to sellers, couriers and payment providers. Decide for each flow who decides the purpose. A seller using a buyer's address for their own promotions is a fiduciary in their own right and needs their own legal basis. A courier that only delivers is a processor.
Section 8 requires a written contract with every processor, and you stay responsible. Cover purpose limits, security, breach notice, sub-processors and deletion. Seller agreements should say what sellers may and may not do with buyer data.
06Security, breaches and large platforms
Rule 6 sets baseline safeguards. Credential stuffing, leaked customer databases and exposed storage buckets are the usual retail incidents. A breach means telling each affected customer and the Board, with a detailed report within 72 hours (Rule 7).
Large platforms could be notified as Significant Data Fiduciaries (Section 10): a Data Protection Officer in India, an independent data auditor, and annual impact assessments, including checks on recommendation and pricing algorithms (Rule 13).
07How the Act sits with other retail rules
The Consumer Protection (E-Commerce) Rules, 2020, payment regulations and tax record-keeping all continue. Section 38 makes the Act apply in addition to other laws. Section 17 exempts processing for preventing and detecting offences, but only for that purpose, not general profiling "for fraud".
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Delete the account and marketing profile. Keep invoices and tax records, and tell the customer what you kept and why.
Orders alone do not create marketing consent. Send only to those who opted in, with an unsubscribe link.
That is outside the order purpose. Your seller contract should ban it and you should act on complaints.
Switch off tracking and targeted ads on the account, then obtain verifiable parental consent or close it.
Contain it, investigate, tell affected customers and the Board, and file the detailed report within 72 hours.
Compliance checklist
Common mistakes to avoid
One tick-box that covers terms, marketing and sharing with partners.
Loading ad pixels and analytics before the visitor chooses.
Keeping every customer profile forever "for analytics".
Letting sellers and vendors use buyer data for their own purposes.
Ignoring teenagers because the app is "not for kids".
Common questions
Do small online stores have to comply?
Yes. The Act has no small-business exemption. It applies to any business that processes digital personal data of people in India. The Central Government can exempt classes of fiduciary, including start-ups, only by notification.
Do we need consent to send order updates?
No separate marketing-style consent is needed for messages that are part of delivering the order, such as confirmation and delivery status. Promotions need consent.
Is a cookie banner enough?
Only if it genuinely lets visitors refuse non-essential tracking and you then do not track them. A banner that sets trackers first and asks later does not meet the consent standard.
Does a customer get to see their data?
A customer can ask for a summary of the personal data you process, the processing activities and the other fiduciaries and processors you shared it with, and can ask for correction and erasure.
What if our servers or tools are overseas?
The Act allows transfers abroad unless the Central Government restricts a country. You remain responsible for the data, and stricter sector rules, such as payment data storage, still apply.
Does the 3-year erasure rule apply to everyone?
No. It applies to the classes in the Third Schedule, which for e-commerce means entities with at least 2 crore registered users in India. Everyone else must still erase data once the purpose is served.