Digital Trust · DPDP for E-Commerce

DPDP for e-commerce: millions of consents, hundreds of partners, one register.

For CTOs, CMOs, CISOs and legal heads at online retailers, marketplaces and D2C brands. You run the highest-volume consent flows in the economy — marketing, personalisation, cookies, payments, delivery — and share data with sellers, logistics partners, payment gateways and ad platforms. DPDP requires that every one of those be explained, consented where needed, and revocable.

Marketing & personalisation consentCookies & trackingSellers & logistics as processorsPayment & returns dataRights at scale

Request a E-Commerce DPDP Assessment Run the Free Gap Assessment

Where this starts

What e-commerce teams usually discover in week one.

The privacy policy exists. The gaps are operational: what was collected under which consent, who it went to, and whether anyone can prove it. If three or more of these apply, a scoped gap assessment is the right first step.

Regulators & rule-sets in play

Consumer protection (e-commerce) rulesPayment system rules (via gateways)CERT-InData Protection Board

Sound familiar?

Account creation implies consent to marketing across email, SMS, WhatsApp and push, with unsubscribe handled channel by channel.
Third-party ad and analytics pixels fire before any consent is captured.
Sellers and delivery partners see full customer details where a masked number and address token would do.
Customer data is enriched with external datasets for targeting without notice.
Deletion requests are answered by deactivating the account while orders, reviews and analytics profiles remain.
Support and call-centre vendors retain recordings indefinitely.

Personal data in scope

The data a E-Commerce organisation actually holds.

A DPDP programme starts with an honest inventory. These are the categories we typically find across e-commerce systems — each needs a purpose, a basis, an owner and a retention period.

Identity, address and contact details
Order, payment and returns history
Browsing, search and cart behaviour
Device identifiers and cookies
Reviews, support chats and call recordings
Seller and delivery-partner data

Fulfilment warehouse with bins and shelving representing the order, delivery and returns data flows of online retail

How the Act applies

DPDP obligations, translated for E-Commerce.

The Act is sector-neutral. Its impact is not. These are the obligations that carry the most weight for your workflows.

Consent for marketing and personalisation, separately from the order

Fulfilling an order has its own basis. Marketing, profiling and cross-channel personalisation need notice and, where consent-based, specific consent with one-step withdrawal.

Cookies, pixels and tracking

Non-essential tracking needs a basis before it fires. Consent management must actually gate the tags, not just display a banner.

Sellers, logistics and gateways as processors or co-fiduciaries

Marketplaces must document the role of each seller and partner, minimise what they see, and bind them contractually on security and deletion.

Rights requests at volume

Access, correction and erasure must work for thousands of requests a month, across order systems, analytics, support and partners — with a defensible retention exception for transaction records.

Breach notification across the partner chain

A logistics partner or support vendor incident is your breach to notify. The playbook must reach them.

We keep legal specifics general on this page. Section-level analysis, penalty exposure and interpretation are worked through with your counsel during the engagement.

The hard part

Transaction records you must keep, profiles you must delete.

Tax, consumer-protection and payment rules require you to retain order, invoice and payment records. DPDP erasure applies to everything held only under consent — behavioural profiles, marketing preferences, enrichment data, recordings. The programme applies each rule automatically at deletion request and account closure.

How we resolve it

Order, invoice and payment records tagged as statutory retention with the applicable requirement recorded.
Behavioural profiles, segments, enrichment data, cookies and recordings erased or anonymised on withdrawal.
Seller, logistics and vendor copies covered by contract deletion terms and reflected in the response.
Automated erasure response stating what was retained and why.

In your workflows

Where consent, notice and rights actually show up.

Acquisition & tracking

Consent gating for tags; preference centre spanning every channel; consent versioning against the notice.

Checkout & fulfilment

Data minimisation for sellers and delivery partners; processor terms; masked contact details.

Marketing & personalisation

Purpose statements; suppression enforced in ESP, SMS, WhatsApp and ad audiences; enrichment reviewed against notice.

Support & rights

Rights-request automation across systems; call-recording retention limits; vendor contracts with deletion SLAs.

Want to know which of these is your biggest gap? The free assessment takes about ten minutes and scores seven compliance areas.

Run the Gap Assessment

Typical starting points

Three ways E-Commerce clients begin.

Scoped, time-boxed and designed to produce evidence early — so the board and the regulator see progress inside the first month.

First engagements

Tracking and consent-gating audit of web and app in two weeks
Preference centre and suppression architecture across all marketing channels
Rights-request automation with a retention-vs-erasure matrix for transaction data

How the programme runs

From gap assessment to continuous readiness.

Week 1–2 · Gap assessment

Data inventory, consent and notice review, vendor and rights-process review, breach readiness. Prioritised findings.

Week 3–6 · Remediation sprint

Notice and consent redesign, retention-vs-erasure matrix, vendor contract terms, breach playbook — highest-risk gaps first.

Week 7–12 · Operations

Rights-request workflow, consent logging and evidence store live in Avisha Trust; teams trained; first evidence pack produced.

Ongoing · Monitoring

Quarterly reviews, vendor re-assessment, AI-usage tracking and readiness reporting to the board.

Built for the Indian regulatory stack

We reconcile DPDP with the sector rules that already bind you, instead of importing a foreign template.

Security and compliance from one team

“Reasonable security safeguards” are tested by the people who run VAPT and incident response, not only described in policy.

Evidence, continuously

Avisha Trust captures consent, rights requests and attestations so the answer to “show me” is an export, not a project.

FAQ

DPDP for E-Commerce: questions we hear most

You need a basis for non-essential tracking before it runs, and a way to withdraw it. Whether that is a banner, a preference centre or both depends on your stack. What matters is that the consent mechanism actually controls the tags rather than sitting on top of them.

Map each seller relationship: for order fulfilment the seller may be a co-fiduciary or a processor depending on your model. Minimise what sellers see, bind them contractually, and give customers notice of what sellers receive. We build the seller data register and contract templates.

Records required by tax, consumer-protection or payment rules are retained for their mandated period with a documented basis. Profiles, preferences and analytics held only under consent are erased. The response to the customer explains the split.

A workflow that authenticates the requester, fans out to order, analytics, support and partner systems, applies the retention matrix, and returns a statement — automated for the common cases, with a queue for exceptions. Avisha Trust tracks the SLA and evidence.

Related sectors

Start with your sector’s pressure point.

Request a scoped E-Commerce DPDP assessment, or run the free gap assessment first.

Request a E-Commerce Assessment Free Gap Assessment