- Home
- Industries
- DPDP for e-commerce
Industry
DPDP for e-commerce
Every order carries a name, phone number and address through your checkout, sellers, couriers and support desk. DPDP asks you to map that chain and keep marketing choices apart from buying.
Short answer
Online retailers and marketplaces are Data Fiduciaries for the customer data they decide to process, with notice, security and breach duties starting 13 May 2027 (Rule 3, Rule 6, Rule 7). Marketing consent must be free, specific and given by a clear affirmative action (s.6), so keep it apart from checkout. E-commerce entities with at least 2 crore registered users in India fall in the Rule 8 Third Schedule: personal data is erased three years after the user last approached them or exercised rights, with at least 48 hours' notice first.
Where personal data sits in e-commerce
- Accounts and checkout: name, mobile number, email, delivery addresses with PIN codes, and GSTIN for business buyers.
- Payments: UPI IDs and card tokens handled by payment partners, and bank details for refunds.
- Orders and returns: purchase history, return reasons, and photos of damaged items.
- Marketing: email and push campaigns, abandoned-cart reminders, and customer lists uploaded to ad platforms.
- Website and app trackers: analytics, ad pixels and SDKs that collect device identifiers and browsing behaviour.
- Sellers and couriers: buyer names, phone numbers and addresses passed on to fulfil each order.
- Support: chat logs, call recordings and tickets.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Separate marketing consent | s.6 | Checkout needs delivery data; marketing does not. Do not make a marketing opt-in a condition of buying. A pre-ticked box is hard to square with a clear affirmative action. |
| Itemised notice | s.5, Rule 3 | At sign-up and checkout, list the data and purposes, with links to withdraw consent, use rights and complain to the Board. |
| Withdrawal | s.6(4), s.6(6) | Unsubscribing must be as easy as subscribing, and ad platforms and other processors must stop within a reasonable time. |
| Rights at scale | s.11 to s.14, Rule 14 | Publish how customers make requests and which identifier they need, then route each request to every system that holds their data. |
| Third Schedule erasure | Rule 8 | For entities with at least 2 crore registered users in India: erase three years after the user last approached you or exercised rights, with at least 48 hours' notice before erasure. |
| Log retention | Rule 8(3) | Keep personal data, traffic data and processing logs for at least one year for the Seventh Schedule purposes. |
| Breach intimation | Rule 7 | Intimate affected customers and the Board without delay, and give the Board a detailed report within 72 hours. |
Roles: fiduciary or processor
The platform is the fiduciary for its customers. Couriers, payment partners, email tools and cloud hosts that process customer data on your behalf are processors and need valid contracts (s.8(2)).
Marketplace sellers are the hard case. A seller that receives a buyer's address only to ship the order may be acting on your instructions; a seller that uses the buyer's data for its own marketing decides a purpose, which makes it a fiduciary for that use. Set the rule in your seller terms and check it with counsel.
Even below the Third Schedule threshold, s.8(7) requires erasure once the purpose is no longer served. A dormant account kept for years with no purpose is a retention problem, whatever your size.
A 90-day starting plan
- 01Days 1 to 30: map trackers and partners
Scan your website for trackers, list the SDKs in your apps, and list every seller, courier and tool that receives customer data.
- 02Days 31 to 60: split consent
Separate the checkout notice from marketing consent. Add a cookie banner with a reject-all option. Send a s.5(2) notice to existing customers.
- 03Days 61 to 90: build rights operations
Open a self-service channel for requests, route erasure tasks to each connected system, and, if you are in the Third Schedule class, set an inactivity-based retention rule and a process for the 48-hour notice.
How TruePrivacy helps
- Cookie consent scans your website for trackers and categorises them so they can become consent purposes. Banner text ships in English and all 22 Eighth Schedule languages, with reject-all.
- Consent management keeps a record per customer and purpose, consent receipts and a preference page. Notice campaigns send the s.5(2) notice to existing customers by email.
- Data Principal requests verify identity before work starts and fan tasks out to connected systems, and the privacy center lets customers submit and track requests.
- Retention rules keep data for N days from a date field such as last activity, then act on expiry, optionally after approval, with an executions log.
Does Rule 8's three-year erasure apply to every online store?
The Third Schedule timeline applies to e-commerce entities with at least 2 crore registered users in India. Every other fiduciary still erases when the purpose is no longer served (s.8(7)).
Can we bundle marketing consent with checkout?
Consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action (s.6). Making marketing a condition of buying is hard to square with that, so keep it a separate, optional choice.
Are marketplace sellers our processors?
Only for processing they do on your behalf and instructions. A seller that uses buyer data for its own purposes is a fiduciary for that use.
Do we need a cookie banner under DPDP?
Trackers that collect personal data need a ground under s.4: consent or a legitimate use. For ads and analytics that usually means consent, and a banner with a clear reject option is a common way to collect it.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin