Key points
- Every online store processing customer data in India must comply with the DPDP Act.
- Marketing consent must be separate from order processing and easy to withdraw.
- Courier, payment, CRM and support partners are Data Processors and need DPDP contracts.
- E-commerce platforms with 2 crore or more registered users must erase data of users inactive for 3 years (Rule 8).
- Users must be told at least 48 hours before such erasure.
What changes for online businesses
Every sign-up form, checkout page, WhatsApp opt-in and marketing campaign needs a clear notice and valid consent. Delivery, payment and marketing partners need DPDP contracts. And large platforms must erase data of inactive users after a set period.
Where personal data sits in an online store
| Where the data is | Examples | DPDP point to watch |
|---|---|---|
| Accounts and checkout | Name, phone, email, addresses | Notice and consent (Section 5, 6) |
| Payments | Payment tokens, transaction records | Security safeguards (Rule 6) |
| Marketing and CRM | Email, SMS and WhatsApp lists, segments | Separate, easily withdrawn consent |
| Analytics and ad pixels | Browsing behaviour, device IDs | Notice and purpose limitation |
| Logistics partners | Delivery address and phone | Processor contracts (Section 8(2)) |
| Marketplace sellers | Buyer details shared for fulfilment | Share only what is needed |
| Customer support | Chats, call recordings, returns | Retention and erasure (Section 8(7)) |
| Inactive accounts | Profiles not used for years | 3-year erasure for large platforms (Rule 8) |
Marketing consent done right
Consent for marketing must be separate from what is needed to complete an order, never pre-ticked, and as easy to withdraw as to give. Keep a record of each consent with the notice version, date and channel. Stop messages promptly when someone withdraws.
Inactive users: the 3-year rule
Under Rule 8 and the Third Schedule, e-commerce entities with at least two crore registered users in India must erase a user's personal data if the user has not interacted with them for three years, unless it is needed for specified purposes such as keeping the account accessible or complying with law. Users must be told at least 48 hours before erasure. Smaller stores should still set their own retention periods for inactive accounts.
Sellers, logistics and tech partners
Courier companies, payment gateways, CRM and email tools, analytics providers and call centres are Data Processors. Each needs a contract that limits use of customer data to your instructions, sets security and breach-notification duties, and requires erasure at the end of the contract.
10 steps for e-commerce
- Map customer data across website, app, CRM, payments, logistics and support.
- Rewrite the privacy notice and add a short notice at sign-up and checkout.
- Separate marketing consent from order processing and record every consent.
- Add a one-click way to withdraw consent and unsubscribe on every channel.
- Review ad pixels and analytics; collect only what you need.
- Add DPDP clauses to logistics, payment, CRM and support contracts.
- Set retention periods for orders, support chats and inactive accounts.
- Build a self-service way for customers to access, correct and erase data.
- Prepare breach notices for customers and the Data Protection Board.
- Train marketing and customer support teams.
Want to know where your organisation stands? Take the free 40-question DPDP Readiness Check, or see our full DPDP compliance checklist.
Frequently asked questions
Does DPDP apply to small online stores?
Yes. Any business that processes digital personal data of customers in India must comply, whatever its size. The 3-year inactive-user erasure rule applies to e-commerce entities with at least two crore registered users, but every store needs notices, consent, security and breach reporting.
Can I send marketing WhatsApp or SMS messages under DPDP?
Yes, with valid consent that is separate from order processing, recorded, and easy to withdraw. Stop messages promptly when a customer withdraws.
Do courier and logistics partners need DPDP contracts?
Yes. They process customer data on your behalf, so they are Data Processors and need a valid contract covering security, breach notification and erasure.
What is the 48-hour notice in DPDP?
Where Rule 8 requires erasure of inactive users' data, such as for large e-commerce platforms after three years of inactivity, the user must be informed at least 48 hours before the data is erased.
Official sources
- Digital Personal Data Protection Rules, 2025 (Ministry of Electronics and Information Technology)
- Government notifies DPDP Rules (Press Information Bureau, 14 November 2025)
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for operational planning. It is not legal advice; check details against the official text and with your legal counsel.