Sector guide · E-commerce and D2C
DPDP Act for e-commerce and D2C brands
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
An online store processes personal data at every step: the browse, the cart, the checkout, the delivery and the marketing afterwards. The Act requires consent before tracking, a purpose-specific notice, contracts with the payment, logistics and marketing processors, erasure when the purpose ends, and a published grievance contact. Large platforms in the Third Schedule also face a fixed three-year retention clock.
From the Gevox Readiness Index: Nineteen of twenty websites of firms that sell DPDP advice load tracking or set cookies before consent.
The order is the purpose; the marketing is another purpose
Processing an order falls under Section 7(a): the customer provided the data voluntarily for that purpose. Adding the same customer to a promotional list, retargeting them, or sharing their profile with an ad network is a different purpose that needs consent under Section 6, specific to marketing, with withdrawal as easy as the opt-in.
The pixels
A retail site typically fires an ad pixel, analytics, a heatmap tool and a chat widget before the visitor has acted. Each sends the visitor’s IP address, device and page to a third party. Section 6 requires consent before that processing. The Gevox scanner tests the load order; on the advisor edition of the Readiness Index, nineteen of twenty sites failed it.
The processor chain
Payment gateway, logistics partner, warehouse software, email and SMS providers, review platform, ad networks: each is a Data Processor or a fiduciary in its own right. Section 8(2) requires a valid contract with each processor, and the Rule 3 notice must describe the processing in a way a customer can understand, which means saying who else receives the data.
Retention has a clock
Section 8(7) requires erasure once the purpose is no longer served. For e-commerce entities with at least two crore registered users in India, the Third Schedule and Rule 8 fix that point at three years from the customer’s last approach, with a forty-eight hour warning before erasure. Smaller stores set their own period and must be able to defend it.
First five actions
- Move every pixel behind consent and make refusal one tap.
- Split consent: order processing needs none beyond Section 7(a); marketing needs its own.
- List processors and confirm Section 8(2) contracts.
- Write a retention schedule and build the erasure job.
- Publish the Section 8(9) contact on the site and in every rights response, per Rule 9.
Questions people ask
- Can we email a customer about similar products after a purchase?
- Only with consent for marketing under Section 6. The purchase gives a Section 7(a) ground for the order, not for promotions.
- Are guest checkouts covered?
- Yes. A name, address and phone number for delivery are personal data regardless of whether an account exists.
- Does the three-year retention rule apply to us?
- Only to e-commerce entities in the Third Schedule, which sets a threshold of two crore registered users in India. Everyone else must still erase when the purpose ends, on a period they set and record.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.