DPDP · Ecommerce and D2C
DPDP compliance for ecommerce and D2C brands
Every order, account, review and marketing message involves personal data. We assess your store, apps and marketing tools against the DPDP Act and show you what to fix first.
What the law asks of ecommerce and d2c businesses
Ecommerce and D2C businesses collect personal data at every step: sign up, checkout, delivery, returns, reviews, loyalty programmes and marketing. Under the DPDP Act, each customer must receive a clear notice of what you collect and why (Rule 3). Marketing messages, retargeting and sharing data with advertising platforms usually need consent that is specific, freely given and as easy to withdraw as it was to give.
Large platforms have extra duties. An ecommerce entity with two crore or more registered users in India must erase a customer's personal data three years after their last interaction, after giving at least 48 hours' notice (Rule 8 and the Third Schedule). Every business must keep processing logs for at least one year (Rule 8(3)), and where a product is aimed at children, verifiable consent of a parent is needed before their data is processed (section 9).
Most D2C brands rely on many vendors: a storefront platform, payment gateway, logistics partners, customer support tools and marketing agencies. Each one that handles your customers' data is your Data Processor, and you remain responsible for what they do with it. Most obligations apply from 13 May 2027.
Where to start · Entry A
DPDP Readiness Programme
The Readiness Programme reviews how your store, apps and marketing tools collect and use customer data, scores your readiness, and gives you a lawyer reviewed report with confirmed findings and a prioritised roadmap.
₹15,000 – ₹75,000+
Lawyer reviewed. 3–5 business days after payment, complete information and any evidence requested are received.
Also relevant: Privacy Contract & Vendor Review (₹5,000 – ₹15,000+).
Your vendor contracts matter as much as your website. We can review your agreements with platforms, logistics partners and agencies for data processing terms under Privacy Contract and Vendor Review, or under a Contract Retainer if you sign them regularly.
Questions we are often asked
Do we need consent to send marketing emails and WhatsApp messages?
In most cases, yes. Consent must be given for the specific purpose and must be as easy to withdraw as it was to give. Customers who signed up before the Act applies must be given a notice as soon as reasonably practicable. The assessment checks how you collect and record consent today.
We use a hosted storefront platform. Is the platform responsible for DPDP compliance?
No. You decide why customer data is collected and how it is used, so you are the Data Fiduciary. The platform usually acts as your Data Processor. You remain responsible for processing it carries out for you, and you need a contract that covers it.
What happens if we have a data breach?
You must inform each affected customer and the Data Protection Board without delay, and send the Board a fuller report within 72 hours of becoming aware of it (Rule 7). Failing to give notice can attract a penalty of up to ₹200 crore.
A lawyer checks for conflicts and sends you an engagement letter with the exact fee, usually within one business day.
Start DPDP Readiness