DPDP Compliance Blueprint
Retail & E-commerce
How retailers, e-commerce platforms, and loyalty programme operators must handle customer personal data under the DPDP Act 2023.
Overview
Retail and e-commerce businesses collect vast amounts of customer personal data — purchase histories, browsing behaviour, location data, payment details, and loyalty programme information. The DPDP Act 2023 requires that all this data be collected with clear consent, used only for the stated purpose, and protected against unauthorised access. Customers have the right to access, correct, and erase their data, and to withdraw consent at any time.
Key DPDP Obligations for Retail & E-commerce
Consent at Point of Collection
Obtain clear consent before collecting customer data — at account registration, checkout, loyalty programme enrolment, and newsletter sign-up. Each purpose requires separate consent.
Loyalty Programme Transparency
Loyalty programmes that profile customers based on purchase behaviour must disclose this clearly and obtain specific consent for profiling activities.
Cross-Border Transfer Controls
Customer data transferred to overseas servers, payment processors, or logistics partners must comply with cross-border transfer rules under the DPDP Act.
Customer Rights Management
Customers can request access to their data, correct inaccuracies, withdraw consent, and request deletion. Retailers must respond within the timeframe set by the DPDP Rules.
Payment Data Security
Payment card data and UPI transaction records are sensitive personal data. Retailers must implement appropriate security measures and limit retention to what is legally required.
Marketing Consent
Sending promotional emails, SMS, or push notifications requires explicit consent. Pre-ticked boxes and bundled consent are not valid under the DPDP Act.
Consent Architecture for Retail
A DPDP-compliant retail platform must present consent notices at each data collection point — not as a single sign-up form that covers all future uses. Customers must understand what data is being collected, why, and who it will be shared with.
- Separate consent for account creation, purchase history analysis, and marketing communications
- Clear opt-in for loyalty programme profiling — not bundled with programme enrolment
- Consent notices in plain language, available in the customer preferred scheduled language
- Easy-to-find consent withdrawal mechanism in account settings
Loyalty Programmes and Customer Profiling
Loyalty programmes are a significant source of personal data for retailers. The DPDP Act requires that customers understand how their purchase data is used to build profiles, and that they have the ability to opt out of profiling without losing access to basic loyalty benefits.
- Disclose clearly that purchase history is used to personalise offers and recommendations
- Provide a profiling opt-out that does not cancel loyalty membership
- Retain loyalty data only for the duration of active membership plus a defined post-exit period
- Do not share loyalty profiles with third-party advertisers without explicit consent
Cross-Border Data Transfers
E-commerce platforms frequently transfer customer data to overseas cloud providers, payment gateways, logistics partners, and analytics tools. Each such transfer must comply with the cross-border transfer framework under the DPDP Act.
- Map all data flows to identify transfers outside India
- Ensure overseas recipients are in countries notified as permissible under DPDP Rules
- Include DPDP-compliant data transfer clauses in contracts with overseas processors
- Maintain a register of all cross-border transfers and the legal basis for each
Returns, Refunds, and Data Retention
Retail transactions generate data that must be retained for legal and accounting purposes, but the DPDP Act requires that personal data be deleted once the purpose for which it was collected is fulfilled.
- Define separate retention periods for transaction records, delivery data, and marketing profiles
- Automate deletion of marketing profiles for customers who have not transacted in a defined period
- Retain financial records for the period required by tax and accounting regulations
- Anonymise historical purchase data used for aggregate analytics
Penalty Exposure
Retailers who send unsolicited marketing communications, fail to honour customer data deletion requests, or transfer customer data overseas without a lawful basis face penalties under the DPDP Act 2023. Large e-commerce platforms processing data of a significant number of customers may be designated as Significant Data Fiduciaries, attracting additional obligations.
Implementation Checklist
- Audit all customer data collection points and map to a lawful consent basis
- Implement granular consent at checkout, registration, and loyalty enrolment
- Build a customer-facing Data Principal rights portal
- Review all third-party integrations for DPDP compliance
- Map and document all cross-border data transfers
- Implement automated data retention and deletion schedules
- Update marketing consent flows to remove pre-ticked boxes
- Train customer service teams on handling data rights requests
- Translate consent notices into relevant scheduled languages
- Designate a Data Protection Officer or compliance lead
Explore other sector blueprints
Ready to implement DPDP compliance for Retail & E-commerce?
Priraksha automates consent collection, Data Principal rights workflows, and breach notification — purpose-built for the DPDP Act 2023.
Book a Demo