DPDP Compliance for Ecommerce Businesses: Customer Data and Consent

Every time customers check out, they share names, addresses, phone numbers, and payment details. India's Digital Personal Data Protection Act, 2023 (DPDP Act) makes protecting this information a legal responsibility. Here is what ecommerce businesses need to know about DPDP Compliance.

What the DPDP Act Covers

The Act applies to digital personal data processed in India and may also apply to businesses outside India offering goods or services to people in India. Selling to Indian customers can therefore bring your online store within its scope.

Who Is Who?

The customer is the Data Principal. Your business is the Data Fiduciary, responsible for deciding why and how personal data is processed. Payment gateways and courier companies may act as Data Processors when handling data on your behalf. Choose vendors carefully and establish appropriate contractual safeguards.

Consent Must Be Clear

Consent must be free, specific, informed, unconditional, and given through clear affirmative action. Pre-ticked boxes and hidden consent clauses are not appropriate. Explain why you collect data and avoid reusing order information for unrelated marketing without a valid legal basis.

Provide a Clear Privacy Notice

Before requesting consent, explain what personal data you collect, why you need it, how customers can withdraw consent, and how they can raise complaints. Notices should be accessible in English or any language listed in the Constitution's Eighth Schedule.

Make Withdrawal Easy

Customers can withdraw consent at any time, and withdrawing it should be as easy as giving it. Provide a straightforward option through account settings or another accessible channel.

Protect Children's Data

For users under 18, the Act generally requires verifiable parental or guardian consent before processing their data. It also restricts tracking, behavioural monitoring, and targeted advertising directed at children, subject to applicable exemptions.

Security and Data Breaches

Implement reasonable security safeguards to protect customer information. In the event of a personal data breach, comply with applicable notification requirements to the Data Protection Board of India and affected individuals. Maintain an incident response plan to handle breaches promptly.

Retention and Customer Rights

Do not retain personal data longer than necessary for its purpose or applicable legal obligations. Customers have rights to access information about their data, seek correction and erasure, and obtain grievance redressal, subject to the Act. Create a simple request process and publish a clear contact point.

Penalties for Non-Compliance

Under the Act's Schedule, failure to maintain reasonable security safeguards can attract penalties of up to ₹250 crore. Failure to notify a personal data breach and certain violations involving children's data can each attract penalties of up to ₹200 crore.

Where to Start

Make DPDP Compliance part of your ecommerce operations. Review your checkout consent, privacy notice, email marketing practices, analytics tools, and vendor contracts. Build clear processes for data requests, withdrawal, retention, and breach response.

Sources: Digital Personal Data Protection Act, 2023, and applicable rules and notifications published by the Ministry of Electronics and Information Technology (MeitY).

Disclaimer: This article provides general information, not legal advice. Consult a qualified lawyer for compliance decisions.