How does DPDP apply to ecommerce businesses?
Marketplaces, checkout, logistics — each node carries DPDP risk. Here's the map.
Checkout and payment consent
Customers give consent to store email and address when they create an account, consent to payment processing when they check out, and separately consent to marketing. These must be separate, granular consents. Post-purchase, you may retain order history for warranty and refund purposes, but not indefinitely. A one-click retention-policy statement at checkout sets expectations.
Marketplace and co-fiduciary rules
Marketplace platforms collect customer contact data and may use it to recommend sellers, enforce policy or send promotional messages. DPDP recognises co-fiduciary relationships — both you and the platform are accountable to the customer. Marketplace terms often stipulate what you can and cannot do with customer data; stay within those bounds.
Logistics and seller networks
Customers' delivery addresses flow to courier partners, logistics networks and sometimes drop-shipping suppliers. You must have DPAs with every party that touches that data. A breach by a logistics partner (lost package data, employee photo collection) is your regulatory headache too.
Frequently asked questions
Do I need separate consent for marketing?
Yes. Checkout consent covers order fulfillment; marketing requires its own affirmative opt-in. Bundling them is not valid under the Act.
How long can I keep order history?
Order history tied to warranty, returns or refunds can be retained for those purposes. Once those ends, retention limits apply. General order analytics must be anonymised.
What is a co-fiduciary agreement?
A marketplace co-fiduciary agreement clarifies which party (platform vs seller) handles customer rights requests, breach notification and retention. Have one in writing.
Audit your ecommerce workflows
Run the DPDP for Ecommerce guide to spot checkout, logistics and marketplace consent gaps.
DPDP for Ecommerce