DPDP Compliance for E-Commerce: Is Your Customer Data Ready for 2027?
Introduction
It's 2:00 PM on a Monday at an e-commerce business managing 500 orders daily. Operations are running smoothly. Customers are checking out using their phone numbers, email addresses, delivery addresses, payment information, and saved preferences. But here's what you may not have documented:
- Where every customer data point is stored
- Why you're storing it
- Who has access to it
- How long you're keeping it
- What happens when a customer asks for deletion
- Whether you have proper consent
This is the reality facing tens of thousands of Indian e-commerce businesses today. And 2027 is your compliance deadline.
The Digital Personal Data Protection (DPDP) Act, 2023 is the framework governing how organisations in India handle personal data. The DPDP Rules, 2025 (as notified by the Ministry of Electronics and Information Technology) provide operational details. Full compliance implementation is creating urgent need for e-commerce businesses to audit customer data infrastructure now. Explore our comprehensive DPDP compliance assessment to identify your business's current readiness level.
Quick Answer — Is Your E-Commerce Customer Data Ready for 2027?
Most e-commerce businesses are not DPDP-ready. A privacy policy and cookie banner are necessary but insufficient. Compliance requires documented data inventory, transparent consent mechanisms, deletion workflows, vendor contracts, breach response procedures, and security controls. Without these, your business faces regulatory action, customer trust loss, and potential penalties up to ₹250 crores. Start your audit now.
What Is DPDP Compliance for E-Commerce?
DPDP compliance means implementing systems, policies, and practices that align your customer data handling with the Digital Personal Data Protection Act, 2023.
Core Concepts
Data Principals are individuals whose data you process (your customers).
Data Fiduciaries decide purpose and means of processing. In most cases, your e-commerce business is the Data Fiduciary.
Data Processors process data on behalf of the Data Fiduciary. Payment gateways, CRM platforms, logistics partners, and email services are typically processors. They must follow your instructions and meet security requirements.
Consent is the legal basis allowing you to process personal data. It must be specific, informed, clear, and freely given.
Real E-Commerce Example
When a customer visits your store:
- They browse products (analytics tracks data)
- They create account (you collect email and consent)
- They checkout (delivery address, phone, payment details)
- You send order confirmation (marketing communication)
- Logistics partner receives delivery data (third-party processor)
- Customer contacts support (support records created)
- Account remains active with order history (data retained)
Under DPDP, you must answer:
- Why collect each data point?
- Do you have consent or legal basis?
- Who else has access?
- How long keeping it?
- Can customers delete their data?
- Is data secure?
- What happens if breached?
Does DPDP Apply to E-Commerce Businesses?
Yes. The DPDP Act applies to any organisation processing digital personal data of Indian residents.
This includes:
- Online retailers and D2C brands
- Marketplaces
- Subscription e-commerce
- Food delivery businesses
- Fashion and electronics websites
- Mobile commerce apps
- Marketplace sellers
- SaaS-commerce businesses
- Shopify, WooCommerce, and custom stores
Location of your business doesn't matter—applicability depends on where customers are located. Learn more about DPDP compliance for e-commerce businesses and specific requirements.
What Customer Data Does E-Commerce Collect?
| Data Category | Example | Where Collected | Key Compliance Consideration |
|---|---|---|---|
| Identity Data | Name, email, phone | Account creation, checkout | Must inform why needed |
| Address Data | Billing, shipping address | Checkout | Linked to identity = personal data |
| Payment Data | Card, UPI, wallet | Checkout | Should use tokenisation; PCI DSS applies |
| Order Data | Products, price, date | Order processing | Shows customer preferences and patterns |
| Device Data | IP address, device type, browser | Website analytics | IP linked to behaviour = personal data |
| Behavioural Data | Pages visited, products viewed | Analytics, tracking | Tracking without consent = violation |
| Location Data | IP-based location, GPS (app) | Mobile app | High-sensitivity data |
| Communication Data | Email, chat logs, support tickets | Customer support | Customer service data = personal data |
| Marketing Preference | Email opt-in/out, SMS consent | Preference centre | Must distinguish from transactional |
| Children's Data | Age, email, preferences | Account creation | Requires verifiable parental consent |
The E-Commerce Customer Data Lifecycle
Collect → Inform → Consent → Use → Share → Store → Secure → Retain → Delete
Key Stages
Collect: Gather customer data needed for operations.
Inform: Tell customers what you're collecting via privacy notice.
Consent: Get permission for discretionary purposes (marketing, tracking, profiling).
Use: Process data only for stated purposes.
Share: Provide data to vendors/processors with contracts.
Store: Keep data in secure systems.
Secure: Implement encryption, access controls, monitoring.
Retain: Keep data only as long as necessary.
Delete: Remove data when no longer needed.
12 Core DPDP Compliance Requirements for E-Commerce
1. Identify All Personal Data
Why it matters: You can't protect what you don't know you have.
Action: Create comprehensive inventory of all customer data collected, where stored, and why collected.
2. Map Data Flows
Why it matters: Customer data moves between systems—website, CRM, payment gateway, logistics, email platform, analytics.
Action: Create data-flow diagram showing where data goes and who accesses it.
3. Establish Appropriate Processing Grounds
Why it matters: You need a legal basis to process personal data.
Action: Document why you're processing each data type (consent, contract, legitimate interest, legal obligation).
4. Build Clear Privacy Notices
Why it matters: Generic privacy policies don't satisfy DPDP requirements.
Action: Write specific privacy notice explaining all data collection points, purposes, retention, and customer rights.
5. Implement Proper Consent Mechanisms
Why it matters: Consent must be freely given, specific, informed, and clear.
Action: Separate consents for separate purposes; no bundling; no pre-ticked boxes; easy withdrawal.
6. Enable Customer Data Rights
Why it matters: Customers have rights under DPDP (access, deletion, correction, withdrawal).
Action: Create documented processes for handling rights requests within 30 days.
7. Establish Grievance Handling
Why it matters: Customers need way to lodge data protection complaints.
Action: Create documented grievance process with clear contact and timelines.
8. Protect Children's Data
Why it matters: DPDP has special protections for children.
Action: If collecting children's data, implement parental consent processes and restrict profiling.
9. Implement Security Safeguards
Why it matters: Data breaches cause significant harm.
Action: Implement HTTPS, encryption, access controls, monitoring, regular audits. Modern data protection solutions streamline these security controls.
10. Prepare Breach Response
Why it matters: If breached, you must respond appropriately.
Action: Create documented breach response plan with notification timelines.
11. Govern Vendors & Processors
Why it matters: You remain responsible for vendors' data handling.
Action: Have Data Processing Agreements with all processors; conduct security reviews.
12. Establish Retention & Deletion Controls
Why it matters: Holding data indefinitely increases breach risk.
Action: Create retention schedule for each data type; automate deletion.
Is Your Consent Mechanism DPDP-Ready?
What Meaningful Consent Requires
Freely Given: No coercion, penalty for withholding, or bundling.
Specific: One consent per purpose (e-mail marketing ≠ tracking ≠ profiling).
Informed: Customer understands what they're consenting to.
Clear: Affirmative action (clicking, ticking); not pre-ticked boxes.
Weak Approach vs Better Approach
Weak: Single pre-ticked "Accept all" checkbox.
Better: Separate unchecked checkboxes:
- ☐ Transactional emails (required)
- ☐ Marketing emails (optional)
- ☐ SMS marketing (optional)
- ☐ Analytics tracking (optional)
- ☐ Behavioural advertising (optional)
DPDP and E-Commerce Marketing
Transactional vs Marketing
Transactional (no separate consent needed):
- Order confirmation
- Delivery update
- Support response
Marketing (consent required):
- Promotional emails
- SMS offers
- WhatsApp notifications
- Abandoned cart reminders
- Personalised recommendations
Critical Mistake
Many businesses send abandoned-cart campaigns, SMS offers, and email promotions without explicit consent. This is a DPDP violation.
Correct approach:
- Disclose that you track abandoned carts
- Get explicit consent for abandoned-cart marketing
- Only send reminders to opted-in customers
- Include unsubscribe link in every email
- Process opt-out immediately
DPDP Compliance for Shopify, WooCommerce & Custom Sites
Important: No platform is automatically DPDP-compliant. Compliance depends on your configuration.
Shopify Stores
Your Responsibility:
- Configure privacy policy correctly
- Enable cookie consent
- Manage third-party apps (audit for data access)
- Ensure apps have contracts
- Manage customer consent for marketing
Common Gaps:
- Apps without contracts accessing customer data
- Email marketing without consent
- Tracking without disclosure
WooCommerce Stores
Your Full Responsibility:
- All code, security, privacy
- Audit all plugins
- Manage vendor contracts
- Ensure server security
- Data retention/deletion automation
Custom-Built Sites
All compliance is your responsibility:
- Data inventory and mapping
- Privacy notice
- Consent management
- Vendor contracts
- Security implementation
- Breach response
E-Commerce Third-Party Vendors
Customer data flows to many vendors. You must manage carefully.
Common Vendors
| Vendor | Data Shared | Risk | Control |
|---|---|---|---|
| Payment Gateway | Card (limited), transaction ID | High | Contracts, PCI DSS, tokenisation |
| Logistics Partner | Name, address, phone, order | Medium | Contracts, access logs, deletion on request |
| CRM Platform | Email, phone, order history | Medium | DPA, encryption, access controls |
| Email Marketing | Email, name, preferences | Medium | DPA, consent integration |
| Analytics | IP, device, behaviour | Medium | Cookie consent, anonymised data |
| Customer Support | Chat, email, personal info | Medium-High | Retention policy, access controls |
Vendor Due Diligence
For each vendor:
- What data do they access?
- Do they need a Data Processing Agreement?
- What security practices?
- How long do they retain data?
- Can they sub-process?
- What if they're breached?
- How do you delete data when requested?
DPDP and Payment Data
Important: Both DPDP and PCI DSS apply to payment data.
Best Practice: Tokenisation
Never store full card details yourself.
- Customer enters card at checkout
- Pass directly to payment processor
- Processor returns encrypted token
- You store token, not card details
- Use token for future payments
Payment Data Security
☐ HTTPS/TLS for all transmission ☐ Encryption for sensitive data ☐ Access controls (limited employee access) ☐ PCI DSS compliance (or rely on processor) ☐ Fraud detection rules ☐ Vendor security verification
What Happens If You Suffer a Data Breach?
Response Process
- Detect & Contain: Stop the breach; isolate systems
- Assess: How much data? Which customers? What types?
- Document: Create incident record with timeline
- Notify: Customers, authorities (if required)
- Remediate: Fix vulnerability
- Learn: Update incident response procedures
Breach Notification Timeline
- Assess: 24-48 hours of discovery
- Notify customers: Within 7 days
- Notify authorities: Within 7 days (if required)
DPDP Penalties
Important Legal Disclaimer: The following is general information based on DPDP Act. Actual penalties depend on specific circumstances. Consult legal professional for precise guidance.
Penalty Framework
Penalties range from ₹50 lakhs to ₹250 crores depending on:
- Severity of violation
- Scale of impact
- Your compliance efforts
- Harm caused
- Your history
Penalties are contextual, not automatic.
2027 DPDP Readiness Checklist (30+ Items)
Governance & Policies
☐ Create/update privacy notice for your e-commerce business ☐ Document data protection practices ☐ Designate privacy owner/team ☐ Create data retention/deletion policy ☐ Create incident response plan ☐ Create vendor management policy
Data Inventory & Mapping
☐ List all personal data collected ☐ Document where each data type is stored ☐ Document why each data type is collected ☐ Create data-flow diagram ☐ Identify all systems handling customer data ☐ Identify all vendors/processors
Consent & Privacy
☐ Review current consent mechanisms ☐ Implement separate consents for separate purposes ☐ Ensure consent is affirmative (not pre-ticked) ☐ Create consent management system ☐ Implement easy consent withdrawal ☐ Update privacy notice with specific disclosures
Customer Rights
☐ Create process for data access requests ☐ Create process for deletion requests ☐ Create process for correction requests ☐ Create process for withdrawal of consent ☐ Create grievance handling process
Security
☐ Implement HTTPS/TLS on all pages ☐ Implement encryption for sensitive data ☐ Implement access controls ☐ Conduct security audit ☐ Create secure backup procedures ☐ Implement monitoring and logging
Vendors & Processors
☐ Create list of all vendors with data access ☐ Request Data Processing Agreements ☐ Verify vendor security certifications ☐ Document vendor data access ☐ Conduct vendor security reviews
Marketing Compliance
☐ Verify all marketing email addresses have consent ☐ Implement email preference centre ☐ Add unsubscribe link to all marketing emails ☐ Verify all SMS numbers have consent ☐ Separate transactional from marketing emails
Breach Response
☐ Create documented breach response plan ☐ Create breach notification templates ☐ Know how to contact customers ☐ Know how to contact authorities ☐ Conduct breach response drill
90-Day DPDP Readiness Plan
Days 1-30: Discovery
- Audit current privacy practices
- Create data inventory
- Map data flows
- List vendors/processors
Days 31-60: Build
- Rewrite privacy notice
- Redesign consent mechanisms
- Create vendor contracts
- Document retention/deletion policies
- Create customer rights processes
Days 61-90: Test & Verify
- Conduct security audit
- Test customer rights requests (data access, deletion, withdrawal)
- Verify vendor security
- Conduct breach response drill
- Train team on privacy requirements
Common DPDP Mistakes E-Commerce Businesses Make
- Treating privacy policy as compliance — Policy is necessary but insufficient
- Collecting excessive data — No defined purpose
- No data inventory — Can't protect what you don't know you have
- No data-flow mapping — Hidden data flows create blind spots
- Bundled consent — Multiple purposes in single consent
- Pre-ticked boxes — Not affirmative consent
- Ignoring vendors — No contracts, no oversight
- Keeping data forever — No retention/deletion policy
- No deletion workflow — Can't honor deletion requests
- Ignoring customer rights — Assume rights are optional
- Weak breach preparation — No incident response plan
- Ignoring children's data — No special safeguards
- Assuming platform compliance — "Shopify is compliant so we are"
- Mixing consent types — Transactional and marketing in single consent
- Copying competitor's privacy policy — Not specific to your business
Is Your Data Ready for 2027? 10-Point Test
Score yourself (0-2 points per item):
1. Privacy Notice: 0 = No/copied template; 1 = Generic; 2 = Specific to your business
2. Consent Mechanisms: 0 = None/bundled; 1 = Some granular; 2 = Granular for all purposes
3. Data Inventory: 0 = None; 1 = Partial; 2 = Comprehensive
4. Data Minimisation: 0 = Excessive; 1 = Mostly necessary; 2 = Only needed data
5. Vendor Management: 0 = None; 1 = Some; 2 = All vendors with contracts
6. Security: 0 = Basic/none; 1 = Some encryption; 2 = Strong (HTTPS, encryption, access controls)
7. Customer Rights: 0 = No processes; 1 = Partial; 2 = Complete (access, deletion, correction)
8. Retention & Deletion: 0 = Data forever; 1 = Some policy; 2 = Documented schedule with automation
9. Breach Response: 0 = No plan; 1 = Draft; 2 = Documented, tested plan
10. Team Awareness: 0 = Unaware; 1 = Leadership aware; 2 = Trained team
Your Score: __/20
- 0-5: High Risk
- 6-10: Needs Improvement
- 11-15: Moderate Readiness
- 16-20: Strong Readiness
Frequently Asked Questions
Q: What is DPDP compliance for e-commerce? A: DPDP compliance means following the Digital Personal Data Protection Act, 2023 when collecting, using, storing, and managing customer data. This includes having clear consent, transparent privacy notices, secure systems, documented retention policies, and processes to honour customer data rights.
Q: Does DPDP apply to online stores? A: Yes. Any e-commerce business collecting digital personal data of Indian residents must comply with DPDP, regardless of where the business is located.
Q: Is a privacy policy enough for DPDP compliance? A: No. A privacy policy is necessary but insufficient. DPDP compliance also requires functional consent mechanisms, data inventory, vendor contracts, customer rights processes, retention policies, security controls, and incident response procedures.
Q: Does an e-commerce website need customer consent? A: Yes, for discretionary purposes. You must get consent before marketing emails, behavioural tracking, personalisation, and cookies. You don't need consent for essential operations (order fulfillment, payment processing, delivery).
Q: What happens when a customer withdraws consent? A: You must stop processing their data for that purpose immediately. If they withdraw email marketing consent, remove them from marketing lists. Maintain withdrawal records.
Q: How should e-commerce companies handle children's data? A: Implement special safeguards: parental consent (age-dependent), no profiling, no targeted advertising, minimal collection, age-appropriate privacy notices.
Q: What is a Data Fiduciary? A: A Data Fiduciary decides purpose and means of processing personal data. Your e-commerce business is typically the Data Fiduciary.
Q: What is a Data Processor? A: A Data Processor processes data on behalf of a Data Fiduciary. Payment gateways, CRM platforms, and email services are typically processors.
Q: Does DPDP apply to Shopify stores? A: Yes. DPDP applies to your store's customer data. Shopify acts as a processor for some data, but you remain responsible for configuring privacy notices, managing consent, and ensuring compliance.
Q: How long should e-commerce customer data be retained? A: This depends on data type. Order records: 3-6 months post-delivery. Tax records: 7 years. Support tickets: 2-3 years. Deleted accounts: 30 days for active systems. Document a retention schedule for each type.
Q: What happens during a personal data breach? A: You must detect, contain, assess scope, document, notify affected customers and authorities (if required), remediate the vulnerability, and learn from the incident.
Q: What are DPDP penalties? A: Penalties range from ₹50 lakhs to ₹250 crores depending on violation severity. Penalties are contextual based on nature, scale, your compliance efforts, and harm caused.
Q: Is a cookie banner enough for DPDP compliance? A: No. A cookie banner is necessary but not sufficient. You must also have a privacy notice, opt-out mechanisms, vendor contracts, and security measures.
Q: Does DPDP affect email marketing? A: Yes. You need explicit consent before sending marketing emails. You must maintain consent records, include unsubscribe links, and process unsubscribe requests immediately.
Q: What should an e-commerce business do before 2027? A: Start DPDP readiness immediately. Create data inventory, audit current practices, redesign consent, create vendor contracts, implement security controls, document retention/deletion policies, and test everything.
Legal Disclaimer
This article is for general informational purposes only and is not legal advice. DPDP compliance is complex and context-specific. Always verify current requirements with official sources (MeitY, Data Protection Board of India, India Code).