DPDP for e-commerce and D2C brands

The order, the marketing list and the tags on every page

Delivering an order is a purpose the customer expects. Retargeting adverts, uploading customer lists to ad platforms, building lookalike audiences and abandoned-cart reminders are not part of it. Each needs consent that is specific, given by a clear action, and as easy to withdraw as to give (s. 6).

Pre-ticked boxes and consent bundled into the terms of sale do not meet that standard. The Central Consumer Protection Authority’s guidelines on dark patterns point in the same direction for online selling. Under legal review: How far the CCPA Guidelines for Prevention and Regulation of Dark Patterns, 2023 apply to consent and cookie screens should be confirmed.

The tags on a store are often the biggest gap. Analytics and advertising pixels typically load on the first page view, before the visitor has chosen anything, and send identifiers to platforms the notice may not mention.

Large e-commerce entities, defined in the Rules by number of registered users (two crore or more in India), must erase the data of users who have not been active for the period the Rules set, after warning them. Smaller stores are not bound by that specific rule, but the general duty to erase data once its purpose is served still applies (s. 8(7)).

Needed for the order

Name, address, phone, items, payment status, delivery, returns and refunds.

Needs its own consent

Marketing messages, abandoned-cart reminders, retargeting pixels, audience uploads, profiling.

Check before it loads

Every non-essential cookie, pixel and SDK.

The three roles, in a worked case

The Act gives three roles. The Data Principal is the person the data is about. The Data Fiduciary decides why and how it is used, and carries the duties. A Data Processor handles it on the fiduciary’s behalf, under a contract. The same business can be a fiduciary for some data and a processor for other data.

The case

Meera orders a kurta from a D2C brand’s website. The site runs on a hosted store platform, the payment goes through a gateway, a logistics company delivers it and later collects a return, the brand’s CRM sends her WhatsApp offers she agreed to, and an advertising pixel records her visit.

The payment gateway often acts as a fiduciary in its own right for payment data, under its own regulatory duties. An advertising platform that uses pixel data for its own purposes is also deciding its own use; the brand still needs consent before sending it.

What an online store holds, and where it goes

Where it comes in

Each is a point where consent may be asked for; where it is, a notice must come with it or before it (s. 5).

• Sign-up and guest checkout
• Cookies, pixels and SDKs on every page and in the app
• Marketing pop-ups and WhatsApp opt-ins
• Courier handover, delivery and return pick-up
• Reviews and user-generated content
• Customer support, and the grievance officer where the consumer e-commerce rules require one

Where it goes

Where online stores are most exposed

Severity follows the same rules as the assessment; your own result sets it from your answers. How severity is set.

Who else handles the data

You answer for what your processors do with the data (s. 8(1)), and you need a valid contract with each (s. 8(2)). Some vendors are fiduciaries in their own right; the table says where that is common.

46 controls written for online stores, on top of 66 common ones

Alongside the common controls, the e-commerce assessment follows the order and the tags: what checkout asks for, marketing consent per channel, cookies and pixels, audience uploads, dark patterns on consent screens, guest buyers’ rights, order-link security and account takeover, couriers, sellers and returns, store apps and plugins, and erasing inactive customers.

Each control is weighted by how critical it is and tied to the section of the Act or rule behind it. How results work.

Six of the questions you will be asked

Questions ask what you actually do, not whether you have a policy. Each answer maps to one control.

1. EC-01 High

   Is consent to marketing asked for separately from placing an order, with the box unticked by default?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Separate and unticked.

   Why it is asked: Consent must be specific and given by a clear action. Placing an order is not consent to marketing.

2. EC-02 High

   Are visitors told about tracking cookies and pixels, and asked before non-essential ones load?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Asked before they load.

   Why it is asked: Advertising and analytics tracking is a purpose needing consent; it is not needed to sell.

3. EC-16 High

   Are customer emails or numbers uploaded to advertising platforms (custom audiences) only for customers who agreed to it?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Only for customers who agreed.

   Why it is asked: Uploading a customer list shares it with the platform for advertising, a purpose of its own.

4. EC-27 High

   Have you tested that order tracking pages, invoice links and support lookups cannot be changed to show another customer's order?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Tested and fixed.

   Why it is asked: Guessable order numbers in links are a common way customer data leaks from stores.

5. EC-04 High

   Do couriers and logistics partners receive only what delivery needs, under written data terms?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Only delivery data, under terms.

   Why it is asked: Couriers usually act as your processors; they need a contract and only the data for delivery.

6. EC-03 High

   Can a customer delete their account and data themselves, or through one simple request?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Self-service or one request.

   Why it is asked: People can ask for erasure, and the request route must be easy to use.

All 46 questions written for online stores

1. EC-08 Have you agreed with sellers on your platform who is responsible for customer data in each step: the order, delivery, returns and the seller's own marketing? Organisation and role mapping
2. EC-09 Have you identified every group whose data you hold: account holders, guest buyers, gift recipients, newsletter subscribers, reviewers and people referred by customers? Organisation and role mapping
3. EC-10 Does your sign-up and checkout ask only for what the order needs, with details such as date of birth or gender optional and explained? Data inventory and purpose
4. EC-11 Do you know where customer data has been copied: order exports, spreadsheets, old store platforms, marketing tools and staff inboxes? Data inventory and purpose
5. EC-48 Does your app ask only for device permissions it needs (no contacts, call logs or constant location for shopping), and only when the feature is used? Data inventory and purpose
6. EC-12 Does your notice tell shoppers that data from your site or app goes to analytics and advertising partners, and for which purposes? Notice and transparency
7. EC-01 Is consent to marketing asked for separately from placing an order, with the box unticked by default? Consent and lawful basis
8. EC-02 Are visitors told about tracking cookies and pixels, and asked before non-essential ones load? Consent and lawful basis
9. EC-13 Is consent for WhatsApp, SMS and email marketing recorded separately for each channel, rather than assumed from a phone number given for delivery? Consent and lawful basis
10. EC-14 Are your consent, cookie and unsubscribe screens free of pre-ticked boxes, hidden "reject" buttons and guilt-tripping wording? Consent and lawful basis
11. EC-15 Are abandoned cart reminders sent only to shoppers who agreed to receive them, and stopped if they opt out? Consent and lawful basis
12. EC-16 Are customer emails or numbers uploaded to advertising platforms (custom audiences) only for customers who agreed to it? Consent and lawful basis
13. EC-47 When a customer refers a friend, do you send one invitation only, and delete the friend's details if they do not respond? Consent and lawful basis
14. EC-03 Can a customer delete their account and data themselves, or through one simple request? Data Principal rights
15. EC-17 Can people who bought as guests ask for access, correction or deletion, with their identity confirmed through the order email or phone? Data Principal rights
16. EC-19 When fraud or risk rules block an order, cash on delivery or an account, is the data checked and can the customer ask for a review? Data quality
17. EC-20 When a customer corrects an address or number, is the correction passed to the courier, seller or any partner that already has the order? Data quality
18. EC-06 Do you have a rule for erasing data of customers who have not shopped or signed in for a long time? Retention and deletion
19. EC-21 If you have two crore or more registered users in India, do you erase users who have not used the platform for three years, after telling them 48 hours in advance? Retention and deletion
20. EC-22 Are bank details collected for cash-on-delivery refunds deleted once the refund is complete and any dispute period has passed? Retention and deletion
21. EC-23 Are warehouse scanners, packing-station computers, staff laptops and support phones wiped before disposal, return or repair? Retention and deletion
22. EC-05 Do you avoid storing customers' card details yourself, leaving them with your payment gateway? Security safeguards
23. EC-24 Are your customer database and its backups encrypted, with exports password-protected and full customer lists downloadable only by named staff? Security safeguards
24. EC-26 Are customer accounts protected against takeover: limits on repeated login attempts, alerts on new devices, and confirmation before changing the phone, email or address? Security safeguards
25. EC-27 Have you tested that order tracking pages, invoice links and support lookups cannot be changed to show another customer's order? Security safeguards
26. EC-28 Are account takeovers, leaked customer exports and fraud using customer data logged and notified to the Board and the customers affected? Breach response
27. EC-04 Do couriers and logistics partners receive only what delivery needs, under written data terms? Processors and vendors
28. EC-29 Are your store platform, CRM, email, SMS and WhatsApp providers bound by written data terms? Processors and vendors
29. EC-30 Do your store platform and CRM contracts require immediate breach notice and let you export and delete all customer data when you leave? Processors and vendors
30. EC-31 Before installing a store app, plugin or tag that can read customer data, do you check what it accesses and who makes it? Processors and vendors
31. EC-32 Do sellers on your platform receive only what fulfilment needs (masking phone numbers where possible), and are they barred from using it for their own marketing? Data sharing and disclosure
32. EC-33 Is customer data sent to advertising platforms (pixels, server-side conversions) only with consent and with the purpose stated in your notice? Data sharing and disclosure
33. EC-34 Do you keep a record of the partners that receive customer data (couriers, sellers, payment, advertising), so you can tell a customer who received theirs? Data sharing and disclosure
34. EC-35 Are requests for customer data from police, consumer commissions and other authorities checked by a named person, limited to what is required and logged? Data sharing and disclosure
35. EC-07 When customers post reviews or photos, do you avoid showing more personal details than they chose to share? Data sharing and disclosure
36. EC-36 Do you know where your store platform, CRM, email, analytics and support tools store customer data? Transfer and storage location
37. EC-37 For tools that store or process customer data outside India, have you checked the countries against any government restriction? Transfer and storage location
38. EC-38 Do you keep a record of each marketing and cookie consent: when, how, the wording shown and any withdrawal? Records and evidence
39. EC-39 Do data protection complaints that arrive through your customer support or consumer grievance officer reach the person who answers data questions? Grievance handling
40. EC-40 Does every marketing email, SMS and WhatsApp message include a working opt-out, applied across all your tools? Consent withdrawal
41. EC-41 In your store admin and helpdesk, can staff, agencies and freelancers see only the customer data their work needs? Access control
42. EC-42 Is store admin, ad account and helpdesk access removed when staff, agencies or freelancers stop working with you? Access control
43. EC-43 Is two-step sign-in required for the store admin, payment gateway dashboard, ad accounts and helpdesk? Access control
44. EC-44 Do support agents confirm the customer's identity before changing an address or phone number, or sharing order details? Access control
45. EC-45 Do you review store admin users, helpdesk users and installed apps at least quarterly, removing what is no longer needed? Incident testing
46. EC-46 Is there a written policy covering customer exports, sharing customer details in chats, and contacting customers from personal phones? Policy and training

Evidence that may be asked for

A “yes” is self-declared until something shows it. These are the documents and records that usually do. Your own result lists what each control needs.

• Checkout screens showing marketing consent separate and unticked, for each channel
• Cookie and tag inventory, showing which load before and after consent
• Consent and withdrawal records for a sample customer, across email, SMS and WhatsApp
• Audience upload settings in each advertising account, limited to consenting customers
• Data terms with couriers, the store platform, the CRM and messaging tools
• Test showing order and invoice links cannot be changed to show another order
• Account deletion screen or request process, with a completed example
• Retention rule for inactive customers and its last run

What makes evidence good enough · How the Evidence Room keeps it

First actions, in the order they usually make sense

1. Unbundle and untick marketing consent at checkout, per channel

   Now

2. Hold non-essential pixels and SDKs until the visitor agrees

   Now

3. Limit ad-platform audience uploads to customers who agreed

   Now

4. Fix order and invoice links so they cannot be guessed

   Before 13 May 2027

5. Trim courier and seller data to what fulfilment needs

   Before 13 May 2027

6. Offer self-service account deletion

   Before 13 May 2027

7. Audit tags, store apps and SDKs every quarter

   Ongoing, every quarter

Your own result orders these by your answers and the law’s dates. How to plan remediation.

The reports an online store usually needs

For a store, the useful outputs are a task list the marketing and tech teams can work from, and a short summary for founders and investors.

Every report states whether the result is Self-Assessed, Evidence-Supported or Expert-Verified. None is a certificate or a statement of compliance. All six reports.