Consent and marketing
Consent must be free, specific and unambiguous: no pre-ticked boxes, no marketing hidden in the terms, and withdrawal as easy as giving it.
E-commerce and online marketplaces
Every order, click and delivery is personal data. The DPDP Act sets the rules for all of it.
E-commerce runs on customer accounts, addresses, payments, browsing data and marketing, shared with sellers, delivery partners and advertising platforms. vDPO helps you map where it goes and fix consent, sharing and security gaps.
The DPDP Act
What it means for e-commerce businesses
The Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 apply to every organisation that processes digital personal data in India. These are the areas that need the most attention in this sector.
Tracking
Advertising and analytics trackers that are not strictly necessary should run only after the customer agrees.
Sellers and delivery partners
Share only what fulfilment needs, mask phone numbers where possible, and act on misuse.
Children
Tracking and targeted advertising directed at children are prohibited. Know whether children use your platform.
Inactive customers
Data must be erased when no longer needed. Large e-commerce entities face a specific erasure period for inactive users under the DPDP Rules.
Breaches and account takeover
A breach must be reported to the Data Protection Board of India and the customers affected, with a detailed report within 72 hours.
vDPO
What vDPO gives e-commerce businesses
Start with the free gap analysis. A client workspace then turns the gaps into an inventory, notices, assessments and registers you can keep up to date.
Gap analysis
Answer 35 questions written for e-commerce businesses and get a score, the gaps found and the corrective action for each. Free, with no login.
Start gap analysisPersonal data inventory
Start from a list of the activities, systems and recipients typical of e-commerce businesses, then confirm or edit each one.
Privacy notice and retention schedule
A plain-language privacy notice for each group of people, and a retention schedule, written from the inventory.
Data Protection Impact Assessments
Assess new systems and uses of personal data, with questions for e-commerce businesses alongside the standard ones.
Risk register
Turn gap analysis answers into risks, and add the risks e-commerce businesses commonly face as a starting list.
Breaches, requests and grievances
A breach register with the 72-hour countdown and draft notices, and a log of requests and grievances with their due dates.
What the DPDP Act Means for E-commerce
Consent, trackers, sellers and delivery partners, children and inactive customers: what India’s DPDP Act asks of online stores and marketplaces.
Read the article