DPDP Compliance for Ecommerce and D2C Brands: Data Flows, Consent and Vendor Contracts

Does the DPDP Act apply to a small D2C brand?

Yes. Under the DPDP Act, ecommerce businesses in India get no carve-out. The Act applies to the processing of digital personal data within India (section 3(a)), and to processing outside India connected with offering goods or services to people in India (section 3(b)). It has no turnover, headcount or order-volume threshold. A brand with 5,000 customers has the same core duties as one with 50 lakh. Extra duties apply only to a business notified as a Significant Data Fiduciary under section 10.

Section 17(3) lets the government exempt notified classes of fiduciaries, including DPIIT-recognised startups, from a short list of provisions: notice (section 5), accuracy and erasure (sections 8(3) and 8(7)), section 10 and the access right in section 11. As of October 2026 no such notification is known. Even if one is issued, security, breach intimation, children’s data and vendor contracts would still apply.

As of October 2026, most of these duties are scheduled to apply from 13 May 2027 under the commencement notification G.S.R. 843(E). The government has proposed shortening that eighteen-month window, so check the current notification. See our guide on the enforcement timeline.

Which ecommerce vendors are processors and which are separate fiduciaries?

A data processor processes personal data on your behalf (section 2(k)). A data fiduciary decides its own purposes and means (section 2(i)). Many large platforms are both: a processor for your store data and a fiduciary for their own products. The distinction matters because you answer under section 8(1) for your processors, while a separate fiduciary answers for itself. You still need a lawful basis to share data with it, and your notice should say you do.

The table below covers the vendors most D2C brands use. Roles depend on the actual arrangement and the vendor’s terms, so treat the “likely role” column as a starting point and confirm it against each contract.

Consent and notice for marketing

Not every use of customer data needs consent. Section 7(a) allows processing for the specified purpose for which a person has voluntarily provided her data, as long as she has not said she does not consent. The Act’s own illustration is a pharmacy sending a payment receipt. Taking an address to deliver an order fits the same pattern.

Marketing is different. A WhatsApp campaign, a cart-abandonment reminder sequence or a retargeting audience goes beyond fulfilling the order, so it should rest on consent. Under section 6(1) consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. A pre-ticked box at checkout is unlikely to meet that test. Under section 6(4) withdrawing consent must be as easy as giving it, so a one-tap opt-in needs a one-tap opt-out.

Each consent request must come with a notice under section 5 that meets Rule 3: understandable on its own, an itemised description of the personal data, the specified purpose, and links to withdraw consent, exercise rights and complain to the Board. Under section 5(3) customers must be able to read it in English or any language in the Eighth Schedule to the Constitution. For customers who opted in before the Act commenced, section 5(2) requires a notice as soon as reasonably practicable.

Keep records. Under section 6(10) the fiduciary must prove that notice was given and consent obtained if that is questioned. When a customer withdraws, section 6(6) requires you to stop, and to make your marketing vendors stop, within a reasonable time. Telecom rules on commercial messages continue to apply alongside the DPDP Act for SMS and calls.

Does the Third Schedule erasure rule (three years) apply to your store?

Probably not. Rule 8(1) and the Third Schedule require an e-commerce entity with not less than 2 crore registered users in India to erase personal data three years after the customer last approached it for the specified purpose or exercised her rights, or from the commencement of the Rules, whichever is latest. Data needed to let the customer access her account, or a stored virtual token that can be used to get money, goods or services, is excepted. Rule 8(2) requires at least 48 hours’ notice to the customer before erasure.

Two points narrow the rule further. The threshold is 2 crore registered users, which very few Indian D2C brands reach. And the Schedule’s definition of e-commerce entity excludes a seller offering goods on a marketplace e-commerce entity, so a seller who sells only through a marketplace is not within it as a seller.

Falling outside the Third Schedule does not mean you can keep data forever. Section 8(7) still requires erasure once it is reasonable to assume the purpose is no longer served, unless another law requires retention, such as tax and accounting rules for invoices. Rule 8(3) also sets a floor: personal data and processing logs must be kept for at least one year. Illustration Case 1 to Rule 8 uses an online order to show this. In short, the Third Schedule erasure rule of three years is for the largest platforms, and DPDP for online sellers of ordinary size means section 8(7) and Rule 8(3). Write a retention schedule for customer accounts, orders, support tickets and marketing lists, and apply it to vendors.

What if children buy on your site?

Under the Act a child is anyone under eighteen (section 2(f)). Section 9(1) requires verifiable consent of a parent before processing a child’s personal data, and Rule 10 sets out how the parent’s identity and age are to be checked. Section 9(3) prohibits tracking or behavioural monitoring of children and targeted advertising directed at them. Breach of section 9 carries a maximum penalty of up to ₹200 crore.

Brands selling stationery, gaming accessories, fashion or cosmetics to teenagers are most exposed. For D2C brand data protection, practical steps include an age declaration at account creation and checkout, a parental consent flow where a buyer says she is under eighteen, and excluding known minors from retargeting audiences and lookalike lists. Part B of the Fourth Schedule allows limited processing to confirm that a user is not a child, so an age check does not itself breach section 9.

What should an online seller do after a data breach?

A personal data breach under section 2(u) includes unauthorised sharing or access and loss of access, so a leaked order export, a hacked admin account or ransomware at your support vendor all qualify. Rule 7 requires you to inform each affected customer without delay, in plain language, with what happened, the likely consequences, what you are doing and what she can do. You must also inform the Board without delay and send a detailed report within 72 hours of becoming aware.

The DPDP Act and Rules give your vendors no deadline to tell you, so add a short notice period to each processor contract as recommended practice. Decide in advance who confirms a breach, who drafts the customer message and who files with the Board. See our guide on breach notification.

Cross-border tools under section 16

Most D2C stacks run on tools hosted outside India. Section 16 does not prohibit that. It lets the government restrict transfers to countries it notifies, and as of October 2026 no such restriction had been located. Rule 15 adds that the government may set requirements on making personal data available to a foreign State or its agencies. Stricter sectoral rules, such as RBI payment data localisation for payment system operators, continue to apply to your gateway. Ask each vendor where data is stored, and require notice before it moves.

DPDP compliance for ecommerce starts with your top five vendor contracts

For most brands the storefront platform, the logistics aggregator, the CRM or marketing tool, the support desk and the payment gateway hold the bulk of customer data. Under section 8(2) each processor must work under a valid contract, and Rule 6(1)(f) requires an appropriate security provision in it. For each of the five, check these points:

• Role: the vendor processes on your behalf and does not use the data for its own purposes or model training (recommended wording).
• Security: a clause on reasonable security safeguards (required by Rule 6(1)(f)).
• Withdrawal and erasure: the vendor stops processing on instruction (s.6(6)) and erases data at exit (s.8(7)(b)), keeping logs for one year (Rule 8(3)).
• Breach notice: a fixed short notice period with the Rule 7 details (recommended).
• Sub-processors and location: a list of couriers, hosts and tools, with notice before changes (recommended).

Why check your ecommerce vendor contracts with ClauseAudit before 13 May 2027?

Section 8(1) makes your brand answer for what your logistics partner or CRM does with customer data, and the Schedule allows penalties of up to ₹250 crore for a failure to take reasonable security safeguards. Many vendor contracts signed before November 2025 are likely to say nothing about DPDP, and platform terms can change during a contract’s life.

You have three honest options. An advocate’s review is thorough and right for material deals, but it is slower and costs more. A free checklist is fast, but you still have to read every clause of every contract yourself. The ClauseAudit DPDP Compliance Check reads every clause of a vendor agreement, DPA or SaaS terms, including annexures, in minutes for ₹999 per contract. Each finding is labelled as required by the DPDP Act or Rules, with the section or rule, or as recommended practice, and comes with a suggested redline and a negotiation email. You choose your side, here the customer (data fiduciary). The original document is not stored after the review.

It is an AI-assisted review and can miss things. If you process children’s data at scale, run a marketplace, or sell in a regulated category such as pharmacy, ask an advocate to review the contract.