India's DPDP Act for online stores: a practical guide for D2C brands
What India’s Digital Personal Data Protection Act means for a store: consent, notices, purpose limits, security, breaches and rights. General information.
By Orvexa TeamUpdated 3 min read
- As a store you are likely a data fiduciary, responsible for how customers' personal data is collected and used
- Ask for clear consent for specific purposes, collect only what you need and let people withdraw
- Protect the data, plan for breaches and name someone to handle complaints
India's Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for handling personal data of people in India. This is general information, not legal advice. The Rules under the Act were notified in late 2025 and are being phased in, so check the current dates and requirements with a qualified adviser.
Who is who
- Data Principal: the person the data is about, such as your customer.
- Data Fiduciary: the organisation that decides why and how the data is processed. As a store, that is you.
- Data Processor: a company that processes data for you, such as your platform, payment gateway, courier or email tool.
You remain responsible for what your processors do on your behalf, so choose them carefully.
The core duties, in plain words
- Give notice. Tell people what you collect, why, and how to exercise their rights and complain.
- Get valid consent, or rely on one of the limited lawful uses the Act allows. Consent must be free, specific, informed and clear, given by a positive action, and easy to withdraw.
- Use data only for the stated purpose. Do not use order details for unrelated marketing without agreement.
- Collect only what you need.
- Keep it accurate and erase it when the purpose ends, unless the law requires you to keep it.
- Protect it with reasonable security safeguards.
- Report personal data breaches to the Data Protection Board and to affected people, as the rules require.
- Take care with children's data. Processing for people under 18 needs verifiable parental consent, and tracking or targeted advertising aimed at children is restricted.
Customer rights
People can ask what data you hold and how it is used, ask for correction and erasure, nominate someone to act for them and use your grievance process. You need a clear way to receive and answer such requests.
What it means for a store
| Area | Practical step |
|---|---|
| Checkout | Short privacy notice, separate unticked consent for marketing |
| WhatsApp and email | Record opt-ins; honour opt-outs (opt-in guide) |
| Cookies and analytics | Explain them and get agreement where needed (cookie consent) |
| Vendors | Use reputable platforms and gateways; know where data lives |
| Retention | Set how long you keep orders, accounts and leads |
| Security | Basic controls and an incident plan (checklist) |
| Contact | A named person or email for privacy requests |
Penalties
The Act provides for significant penalties, in some cases running to hundreds of crores of rupees for failures such as not taking reasonable security safeguards. The exact amounts depend on the breach, so take advice rather than relying on figures from a blog.
How a platform can help
A platform that keeps each store's data in a separate database, hosts payments with a certified provider and publishes its privacy terms makes your work easier (dedicated databases). It does not replace your own duties.
What to do next
Write a one-page data map: what you collect, where it is stored, who can see it, why you have it and when you delete it. That page is the base for your privacy notice and your answers to any request.
Frequently asked questions
Does the DPDP Act apply to a small store?
It applies to processing digital personal data, with some exemptions defined in the Act and Rules, so small size does not automatically exclude you. Ask an adviser about your situation.
Do I need a privacy policy?
You need to give people a clear notice, and a published privacy policy is the usual way to do it. Keep it accurate and in plain language.
Can I keep customer data forever?
No. Keep it only as long as the purpose requires or the law demands, and then erase it.
Keep reading
Cookie consent for e-commerce sites: what you need and how to do it well
Which cookies need consent, how to build a fair banner, what India’s DPDP Act and Europe’s rules expect, and how to keep measuring without annoying shoppers.
3 min read
GDPR for Indian D2C brands that sell to Europe
When the EU’s GDPR applies to an Indian store and how to comply: lawful basis, notices, rights, processor contracts, transfers and breach reporting.
3 min read
Dedicated database per store: what tenant isolation means for your data
Multi-tenant platforms can separate stores in three ways. Learn how a database per store compares with shared tables, what it protects and what it does not.
3 min read