E-Commerce
DPDP Compliance for E-Commerce Companies
Purchase histories, delivery addresses, and payment details across millions of transactions create a massive consent management challenge. Data principals can withdraw consent as easily as they gave it.
- DPDP obligations on Data Fiduciaries take effect
- 13 May 2027
- Penalty ceiling for failing to notify a breach, Section 8(6)
- 200 Cr
- Maximum penalty under the DPDP Act
- 250 Cr
Obligations
Your DPDP Obligations as a E-Commerce Company
The DPDP Act 2023 imposes specific requirements based on how your organisation processes personal data. These are the obligations most relevant to e-commerce operations.
Ref 01
High-Volume Consent Management
Section 6 requires consent for each processing purpose. With millions of customers, consent collection, storage, and withdrawal must be automated and auditable at scale.
Ref 02
Easy Consent Withdrawal
Section 6(4) mandates that withdrawing consent must be as easy as giving it. A one-click unsubscribe is not enough if the original consent covered multiple purposes.
Ref 03
Purpose Limitation
Section 5 restricts processing to stated purposes. Data collected for order fulfilment cannot be repurposed for marketing, recommendations, or third-party sharing without separate consent.
Ref 04
Data Retention Controls
Personal data must be deleted when the purpose is fulfilled. Order data retained beyond delivery completion requires a documented legal basis (warranty, tax compliance, dispute resolution).
Ref 05
Breach Notification
Section 8 mandates notification to the Board and affected customers. E-commerce platforms with millions of accounts face large-scale notification obligations in breach scenarios.
Ref 06
Third-Party Data Sharing
Logistics partners, payment gateways, and marketing platforms all receive personal data. Each third party is a data processor with its own DPDP obligations that you must govern.
Timeline
Your Compliance Roadmap
Key milestones between now and 13 May 2027, when the Act's obligations on Data Fiduciaries take effect.
Now
Map data sharing chains
Identify all third parties receiving customer personal data across payments, logistics, and marketing.
Q3 2026
Consent management at scale
Deploy automated consent collection and withdrawal for millions of customer records.
Nov 2026
Rule 4 applies
From 13 November 2026, registration with the Data Protection Board is mandatory for entities that operate as Consent Managers. A Data Fiduciary is not required to register, or to route consent through one.
Q1 2027
Retention policy enforcement
Implement automated data retention and deletion workflows aligned with business justifications.
May 2027
Obligations and penalties take effect
The maximum penalty, 250 crore, is for failing to take reasonable security safeguards under Section 8(5).
Penalty Exposure for E-Commerce Companies
Section 33 of the DPDP Act prescribes penalties based on violation type. Each amount is the ceiling for that category of breach.
Recommended Plan
Scale for E-Commerce
Scale tier handles up to 2M data principals with the automated consent and retention management e-commerce platforms require.
₹2,50,000 one-time
- Up to 2M data principals
- Compliance posture reports
- Conflict-of-law documentation register
- DPA auto-generation (Roadmap: H2 2026)
- Phone + email support
Resources
Essential Reading for E-Commerce
The DPDP provisions that bear most on your sector, in detail.
DPDP Consent Management: Technical Systems for Indian Businesses
The DPDP Act 2023 makes consent the legal foundation for data processing. This is what valid consent requires, how withdrawal works, and what your systems must support.
7 min read
Implementation GuidesDPDP Compliance Checklist: 43 Controls for Indian Businesses (2026)
Audit your DPDP Act 2023 posture against 43 controls, then sequence remediation toward the 13 November 2026 and 13 May 2027 commencement dates.
10 min read
Data Principal RightsDPDP Act 2023: The Data Principal Rights with Templates (India)
Access, correction, erasure, grievance, and nominee rights under the DPDP Act 2023: the response deadlines a Data Fiduciary must meet, with ready-to-use request templates.
7 min read
FAQ
E-Commerce compliance, answered.
Can we keep customer data after an order is delivered?
Only with documented legal basis. Order fulfilment data can be retained for warranty periods, tax compliance, or dispute resolution. Marketing-purpose retention requires separate ongoing consent.
Do logistics partners need separate DPDP compliance?
Yes. Each third party processing personal data on your behalf is a data processor under the DPDP Act. You must ensure they maintain appropriate safeguards and process data only for the stated purpose.
How does consent withdrawal work at scale?
Section 6(4) requires withdrawal to be as easy as consent, and Section 6(6) requires processing to stop once consent is withdrawn. For e-commerce, this means per-purpose withdrawal options (not just a blanket unsubscribe) with automated enforcement across all downstream systems.
Running trackers on your storefront? See what a DPDP-compliant cookie consent banner must do before a non-essential cookie fires.
Consent taken at checkout does not extend to marketing.
The free DPDP Gap Assessment takes less than ten minutes. You receive a scored compliance report with a prioritised action list.