DPDPA for E-Commerce, Marketplaces & D2C
E-commerce platforms sit on the largest consumer data reservoirs in the economy — purchase patterns, browsing behaviour, payment data, delivery addresses. DPDPA transforms how this data can be collected, processed, shared, and retained.
E-commerce built its business model on data — personalised recommendations, behavioural advertising, dynamic pricing, credit scoring. DPDPA does not prohibit these practices, but it requires explicit, informed, granular consent for each. The era of bundled consent buried in terms of service is over.
DPDPA Challenges by E-Commerce Sub-Sector
Horizontal Marketplaces
Multi-category platforms — electronics, fashion, grocery- ›Tripartite data flows: customer → marketplace → seller — who is Fiduciary for what data?
- ›Behavioural profiling for recommendations and advertising — Section 6 consent granularity
- ›Seller personal data (proprietor KYC, bank details, GST-linked data) — separate consent track
- ›Dark pattern audit across checkout flows, cookie banners, and marketing opt-ins
- ›Cross-border data for global marketplace operations — Section 16 for international sellers/buyers
- ›SDF classification for platforms with hundreds of millions of user accounts
D2C (Direct-to-Consumer) Brands
Owned channels — website, app, WhatsApp commerce- ›Single-brand data fiduciary — cleaner compliance surface than marketplaces
- ›Customer data platform (CDP) — unified profiles from website, app, store, and social media
- ›WhatsApp Business API data processing — Meta as processor, D2C as fiduciary
- ›Loyalty programme data — purpose creep from rewards to marketing to third-party partnerships
- ›Subscription and recurring order data — ongoing consent management
Quick Commerce & Hyperlocal
Rapid delivery — grocery, food, pharmacy- ›Delivery partner location tracking — continuous GPS monitoring as personal data
- ›Customer address data at granular level (floor, apartment, landmark) — heightened privacy sensitivity
- ›Pharmacy delivery — health-adjacent data processing without DPDPA special category protection
- ›Dark store employee data — biometric attendance, performance monitoring
- ›Real-time demand prediction using order patterns — automated processing assessment
Payment & Fintech Layer
Payments, BNPL, wallets within e-commerce- ›Payment data processing — RBI PA/PG guidelines + DPDPA dual compliance
- ›BNPL (Buy Now Pay Later) credit decisions — automated processing and profiling
- ›UPI transaction data retention and sharing with e-commerce platforms
- ›Tokenisation and card-on-file data governance
- ›Wallet KYC data — purpose limitation for non-payment use of KYC information
Logistics & Last-Mile Delivery
3PL providers, warehousing, delivery networks- ›Delivery personnel data — gig worker privacy, location tracking, performance scoring
- ›Customer delivery data — name, address, phone shared by marketplace (processor vs joint fiduciary)
- ›Warehouse CCTV and access control data — employee monitoring under DPDPA
- ›Returns processing — customer identity verification and item condition documentation
- ›Multi-client data segregation in shared logistics infrastructure
5 DPDPA Compliance Pillars for E-Commerce
Granular Consent Architecture
Separate consent for: account creation, order processing, recommendations, marketing emails, behavioural advertising, seller data sharing, and analytics. No bundling. Each consent independently withdrawable.
Section 6, Rule 3-4Dark Pattern Elimination
Audit every user interface for deceptive design: pre-checked boxes, confusing toggles, hidden unsubscribe links, forced account creation. Section 6(3) read with Rule 3 invalidates consent obtained through misleading design.
Section 6(3), Rule 3Marketplace Data Segregation
Define fiduciary responsibilities clearly — marketplace for platform data, seller for order fulfilment data. Implement contractual and technical controls for data sharing between marketplace and seller under Section 8(2).
Section 8(2), Rule 6Children's Data Prohibition
No behavioural advertising or tracking directed at children (Section 9(3)). Implement age gates, parental consent flows, and advertising category exclusions for users identified or likely to be under 18.
Section 9, Rules 10-12Data Retention & Purging
Define retention periods for each data category: order data (legal requirement period), browsing data (session or consent-based), payment data (RBI requirements), account data (until deletion request). Automate purging.
Section 8(7), Section 12Related DPDPA Resources
DPDPA for Online Gaming
Shared Third Schedule thresholds
E-Commerce Data Privacy
Full e-commerce privacy guide
Consent Management
Section 6 consent deep-dive
Compliance Checklist
8-phase implementation guide
DPDPA for Startups
D2C compliance playbook
Children's Data
Section 9 deep-dive
DPDPA for BFSI
Payment layer compliance
Vendor Governance
Processor chain controls
DPDPA Consulting
Counsel-led advisory services
E-Commerce-Specific DPDPA Advisory
E-commerce compliance touches every part of the platform — from checkout consent to seller onboarding to delivery tracking. AMLEGALS brings 28 years of legal experience to DPDPA implementation for marketplaces, D2C brands, and digital retail.
Request a Confidential Briefing
Our data privacy counsel will reach out within one working day.
What practitioners and boards are asking
How does DPDPA apply to e commerce marketplaces in India?
E Commerce marketplaces are Data Fiduciaries for all personal data they collect. customer accounts, browsing behaviour, purchase history, search queries, and payment data. The tripartite relationship (marketplace, seller, logistics) creates complex fiduciary allocation questions. Section 6(3) read with Rule 3 prohibits consent obtained through dark patterns. pre checked boxes, confusing toggles, and forced account creation. Behavioural advertising requires explicit, granular consent separate from service delivery consent. AMLEGALS advises e commerce platforms on consent architecture, dark pattern elimination, marketplace data segregation, and children's data compliance under Section 9.
Which provisions of the DPDPA and the DPDP Rules, 2025 are relevant to DPDPA for Ecommerce?
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).
Who advises businesses on DPDPA for Ecommerce under India's DPDPA?
AMLEGALS, an Indian law firm, advises Data Fiduciaries, Data Processors and foreign companies on DPDPA for Ecommerce under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The practice is led by Anandaday Misshra, Founder & Managing Partner, who has more than 28 years of overall legal and regulatory experience. Enquiries: https://amlegalsdpdpa.com/contact or [email protected] or [email protected].
What should I send AMLEGALS to get a scoped proposal on DPDPA for Ecommerce?
Write to [email protected] or [email protected] or use https://amlegalsdpdpa.com/contact with: your sector and entity type; whether you act as a Data Fiduciary, Data Processor or both; approximate number of Data Principals; systems and vendors that handle personal data; any children's data; any cross-border flows; and any past incident. With these facts a partner can propose a scope for DPDPA for Ecommerce rather than a generic checklist.
How do I get a first view of my DPDPA exposure on DPDPA for Ecommerce?
Use the DPDPA Exposure Assessment at https://amlegalsdpdpa.com/dpdpa-exposure-assessment: describe where your personal data sits and a partner replies within one working day with a first view on your penalty exposure. Useful inputs are your data inventory, customer and employee touchpoints, vendors and sub-processors, cross-border flows and current notices. The principal obligations commence on 13 May 2027. Content is general legal information and not legal advice.