Skin
Free gap analysis · E-commerce

DPDP Gap Analysis for E-commerce and Online Marketplaces

Measure your business’s compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules. You get an overall score, the gaps found and the corrective steps for each.

Applicable to online stores, direct-to-consumer brands, online marketplaces, quick-commerce and food or grocery delivery platforms, and other e-commerce businesses selling to customers in India.

35 questions 8 sections 10–15 minutes No login needed
Progress 0 of 35 answered
Yes Fully implemented Partially Implemented, but gaps remain No Not implemented Not Applicable Does not apply
1. Governance and Accountability
01 Has the business assigned clear responsibility for compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and Rules?
02 Has the business identified when it acts as a Data Fiduciary and when as a Data Processor, for example for sellers, brands and delivery partners on its platform?
03 Are data protection responsibilities defined across product, engineering, marketing, customer support, operations and seller management?
04 Does management periodically review data protection risks, compliance gaps and corrective actions?
2. Customer Data Inventory and Mapping
05 Has the business identified the personal data it collects about customers, visitors, sellers, delivery partners and employees?
06 Has the business documented the purposes for processing personal data, including orders, delivery, payments, returns, support, personalisation, advertising and fraud prevention?
07 Has the business mapped how customer data flows between the website, apps, order systems, sellers, logistics partners, payment providers and marketing tools?
08 Does the business maintain an inventory of systems, SDKs, tags and vendors that collect or process personal data?
09 Has the business identified personal data shared with sellers, logistics partners, payment providers, advertising platforms and other recipients?
3. Notices, Consent and Marketing
10 Does the business give customers a clear privacy notice explaining what personal data is processed, why, and how they can exercise their rights?
11 Has the business identified which processing relies on consent and which on data customers voluntarily provide to buy from it?
12 Is consent for marketing, personalised advertising and sharing with partners obtained separately, without pre-ticked boxes, and recorded?
13 Can customers withdraw consent and unsubscribe easily, and does the business stop the processing across all channels and partners?
14 Are cookies, pixels and tracking SDKs that are not strictly necessary used only with the customer’s consent?
4. Marketplace, Delivery and Children
15 Do sellers and delivery partners receive only the customer data needed to fulfil an order, with phone numbers masked where possible?
16 Does the business monitor how sellers and partners use customer data, and act on misuse?
17 Does the business know whether children use its platform, and avoid targeted advertising and tracking directed at them?
18 Are delivery photos, proof-of-delivery data and location tracking limited to what delivery needs and kept only as long as needed?
19 If the business has 2 crore or more registered users in India, has it assessed the DPDP Rules’ Third Schedule erasure period for inactive users?
5. Customer Rights and Retention
20 Can customers obtain a summary of their personal data, correct it and delete their account, through the app or website?
21 Does the business have documented procedures for verifying, tracking and responding to customer requests and grievances?
22 Has the business defined retention periods for accounts, order records, payment data, browsing data, chat transcripts and marketing lists?
23 Does the business erase personal data when it is no longer required and no applicable law requires its retention?
24 Can the business implement and verify deletion across its systems, analytics and advertising tools, sellers and Data Processors?
6. Data Security and Breach Management
25 Has the business implemented appropriate technical and organisational security safeguards to protect customer data?
26 Are customer accounts protected against takeover, and is staff and seller access to customer data limited and logged?
27 Does the business have documented procedures to detect, investigate, respond to and record personal data breaches?
28 Can the business notify affected customers and the Data Protection Board of India about personal data breaches within applicable statutory timelines?
7. Vendors, AI and Cross-Border Processing
29 Does the business assess the data protection practices of vendors such as cloud, payment, logistics, customer support and marketing technology providers?
30 Do contracts with Data Processors include provisions for data protection, security, breach reporting and deletion?
31 Has the business assessed the privacy risks of recommendation engines, dynamic pricing, profiling and Artificial Intelligence (AI) chat assistants?
32 Has the business identified customer data processed or accessed outside India, such as cloud hosting, support centres and marketing platforms, and assessed DPDP restrictions?
8. Training and Compliance Monitoring
33 Are employees, customer support agents, delivery staff and seller managers trained on their responsibilities under the DPDP Act?
34 Does the business assess privacy risks before launching new features, SDKs or significant changes to processing, including Data Protection Impact Assessments (DPIAs) where legally required?
35 Does the business periodically review its data protection controls, track corrective actions and maintain evidence of compliance?
Ready to see your report? Unanswered questions count as No. Your answers are used only to calculate this report. Nothing is stored.