Every sign-up, click, order and delivery is personal data. The Digital Personal Data Protection (DPDP) Act sets the rules for how e-commerce businesses collect it, use it and share it.
The Act and the Digital Personal Data Protection Rules, 2025 apply to every online store, direct-to-consumer brand and marketplace that processes digital personal data in India. Here is where e-commerce businesses most often fall short.
1. Consent that actually counts
Consent under the Act must be free, specific, informed, unconditional and unambiguous. Pre-ticked boxes, marketing hidden in the terms and one checkbox covering everything do not meet that standard. Ask separately for each optional purpose, such as marketing messages, personalised advertising and sharing with partners, and record each choice against the notice the customer saw.
Data a customer gives to place an order supports delivering that order. Advertising and profiling need their own basis.
2. Withdrawal as easy as giving
Customers must be able to withdraw consent as easily as they gave it, and the withdrawal must reach every channel: email, SMS, messaging, app notifications and partners. Test it regularly; it often breaks.
3. Trackers
Advertising and analytics cookies, pixels and software development kits (SDKs) process personal data. Those that are not strictly necessary should load only after the customer agrees. Keep a register of every tag and SDK, and review it with each release, because marketing and product teams add them quietly.
4. Sellers and delivery partners
Sellers and delivery agents should see only what fulfilment needs. Mask customer phone numbers and addresses where possible, limit access after delivery, prohibit other uses in seller and partner terms, and act on misuse complaints.
5. Children
The Act prohibits tracking, behavioural monitoring and targeted advertising directed at children, and processing a child’s data generally needs verifiable parental consent. Know whether children use your platform, add age checks where they may sign up, and exclude child accounts from tracking and targeting.
6. Inactive customers
Personal data must be erased once its purpose is served, unless the law requires it to be kept. Large e-commerce entities, those with 2 crore or more registered users in India, face a specific erasure period for inactive users under the Third Schedule to the Rules, with advance notice to users before erasure.
7. Account takeover and breaches
Credential stuffing and account takeover expose addresses and order history. One-time passwords or multi-factor sign-in, rate limiting and alerts help. A breach must be reported to the Data Protection Board of India and the customers affected, with a detailed report within 72 hours.
A practical starting point
- Map every flow of customer data, including tags, SDKs and partners.
- Replace pre-ticked and bundled consent with separate, unticked choices.
- Load non-essential trackers only after consent.
- Mask phone numbers for sellers and delivery partners.
- Set retention periods and erase inactive data.
- Let customers delete their account from settings.
vDPO’s free DPDP gap analysis for e-commerce asks 35 questions written for online businesses and gives you a score, the gaps found and the corrective action for each. A client workspace then gives you a customer data inventory to start from, privacy notices, DPIAs, a risk register and a breach register.
This article is general information, not legal advice.