E-commerce and D2C brands collect personal data at every step — browsing, accounts, orders, payments, support, marketing. The DPDP Act touches all of it, and for large platforms the Rules add a hard retention limit. Here is the practical picture.
Consent and cookies on the storefront
Analytics, retargeting and ad pixels are personal data. You need a compliant cookie banner that loads non-essential trackers only after consent — 'by browsing you agree' does not meet the standard.
Accounts, orders and marketing are different purposes
Processing an order is one purpose; emailing offers is another. Give a clear notice, and get consent for marketing separately from the transaction. Pre-ticked 'subscribe me' boxes are out.
The 3-year retention rule for large platforms
Under the Rules, an e-commerce entity with at least 2 crore registered users must generally erase personal data three years after a user's last interaction, with limited exceptions and advance notice. Build retention in now, even if you are below the threshold.
Your vendor chain is long
Payment gateways, logistics, warehousing, marketing tools, review platforms — all processors. Contract with each under a valid processor agreement, and track any data going overseas.
An e-commerce checklist
- Compliant cookie/consent banner with granular choices.
- Separate marketing consent from checkout.
- Itemised privacy notice tied to real data flows.
- Retention schedule; prepare for the 3-year rule.
- Processor contracts across the fulfilment and martech stack.
- Rights and grievance channel for customers.
How DPDP Bridge helps
DPDP Bridge helps online brands get consent, cookies, retention and vendor contracts right — so growth does not outrun compliance. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.