The checkout is where a business collects its most sensitive data fastest — identity, address, and payment details. The DPDP Act applies, and for payment data RBI rules apply on top. Getting the flow right protects customers and reduces risk.
Collect the minimum, for the transaction
Checkout data should be limited to completing the order. Don't force account creation or marketing consent as a condition of buying — that undermines free consent.
Payment data and RBI
Card and payment-system data carry RBI localisation and tokenisation rules. Where sector rules are stricter than the DPDP Act, they prevail — and tokenisation is good minimisation anyway.
Gateways are processors
Your payment gateway and fraud tools process personal data — contract with them and know where data flows (see cross-border).
A checkout checklist
- Minimal fields; no forced marketing consent.
- Separate, optional account creation and marketing opt-in.
- Tokenise and secure payment data; follow RBI rules.
- Processor contracts with gateways and fraud vendors.
How DPDP Bridge helps
DPDP Bridge helps you design checkout flows that minimise data, keep consent free, and align the DPDP Act with your RBI payment obligations. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.