Online shopping has transformed how businesses collect and use customer information. An e commerce platform may process names, mobile numbers, email addresses, delivery details, account information, purchase histories, device information and behavioural data within a single customer journey. This makes e-commerce privacy compliance a significant legal and operational responsibility for online businesses in India.

The challenge is not limited to having a privacy policy. E commerce businesses need to understand why information is collected, how consent works, which vendors receive the information, how customer preferences are managed, how long information is retained and what happens when a security incident occurs. India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 provide the central privacy framework. However, e commerce businesses also operate within consumer protection, cybersecurity, payment and sector specific requirements.

Why Privacy Compliance Is More Complex for E Commerce Businesses?

An ordinary website may collect limited information. An e commerce platform often operates a much broader data ecosystem. A customer may browse products, create an account, add items to a cart, make a payment, provide a delivery address, contact customer support, leave a review and later receive personalised offers. Each interaction can create additional personal data. The information may then move between the website, mobile application, CRM platform, payment gateway, logistics provider, marketing platform, analytics service and cloud infrastructure. Personalisation adds another layer. Businesses may analyse purchase history, browsing activity and customer preferences to recommend products or target advertising. These practices can create privacy concerns if customers do not understand how their information is being used. Recent Indian analysis of the e commerce sector identifies personalisation, targeted advertising, dynamic pricing, recommendation systems and behavioural analytics as important areas of privacy risk.

Understanding the DPDP Framework for E Commerce

The Digital Personal Data Protection Act, 2023 regulates processing of digital personal data in India within its statutory scope. An e commerce platform will generally act as a Data Fiduciary because it determines the purpose and means of processing customer information. The Act recognises consent as one ground for processing and also permits certain legitimate uses. This distinction is important for e commerce businesses. Not every activity should be treated as requiring the same form of consent. Processing necessary to fulfil an order can have a different legal basis from optional marketing or other secondary uses. The Act also establishes obligations relating to notice, consent, security, personal data breaches, retention, Data Principal rights and grievance redressal. The official India Code version of the Act provides the complete statutory framework. Businesses should use the legislation itself rather than relying solely on generic online compliance checklists.

The First Challenge Is Knowing What Data the Business Collects

Many privacy problems begin with incomplete data mapping. An e commerce business may know what information its checkout page collects but have limited visibility over information generated elsewhere. For example, analytics tools may collect device identifiers. Marketing platforms may create customer profiles. Loyalty programmes may record purchasing patterns. Customer support systems may retain conversations. Delivery providers may receive addresses and contact numbers. A business should therefore map the complete customer data journey. The exercise should identify what information is collected, the purpose of collection, the system involved, the people or organisations receiving it, the processing location and the applicable retention period. Data mapping also helps identify unnecessary collection. If a checkout form asks for information which is not required for the transaction or another defined purpose, the business should question why it is being collected.

Consent and Checkout Design

Consent is one of the most important challenges for e commerce businesses. The DPDP Act provides specific requirements for consent. Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It should also be limited to personal data necessary for the specified purpose. This creates practical questions for online stores. 

• Should marketing consent be bundled with account creation?
• Can a customer be required to accept promotional communications to complete an order?
• Is a preselected marketing option appropriate? Can consent be withdrawn easily?

Businesses should separate necessary transaction processing from optional marketing preferences wherever the legal basis differs. The Act itself provides an e commerce illustration involving an online shopping service, demonstrating the distinction between processing necessary to fulfil an order and the consequences of withdrawing consent. Good privacy design should therefore begin at checkout rather than being added after the purchase journey has already been built.

Privacy Notices Must Match Actual Data Practices

An e commerce privacy notice should reflect the platform's real processing activities. A generic statement saying “we collect information to improve our services” may provide little practical understanding. Customers should be able to understand what categories of personal data are collected and why. The notified DPDP Rules, 2025 prescribe more detailed requirements for notices, including clear and plain language, an itemised description of personal data and the purpose for processing. Rule 3 is part of the eighteen month commencement phase under the Rules. Businesses should therefore review privacy notices across websites, mobile applications, checkout pages, loyalty programmes and other customer touchpoints. The notice should also remain consistent with actual technology configurations. A privacy notice is not effective if the website uses tracking tools or shares information with vendors not reflected in the organisation's documented processing practices.

Cookies, Tracking and Advertising Technologies

E commerce businesses often use cookies, pixels, software development kits and advertising technologies to understand customer behaviour. These tools may support analytics, advertising, fraud prevention and personalisation. The privacy question depends on what information is collected, how it is linked to an individual and why it is used. Businesses should understand which tracking technologies operate on their websites and applications. They should also know which third parties receive the resulting information. Marketing consent should not be treated as an afterthought. A customer agreeing to receive promotional messages does not automatically mean every advertising technology may collect and analyse information for every purpose. The consent experience should correspond with the actual processing.

Personalisation and Customer Profiling

Personalisation can improve an online shopping experience. It can also create privacy concerns when businesses build detailed profiles from customer behaviour. A platform may analyse products viewed, searches conducted, previous purchases, location information or interaction with marketing communications. Businesses should define the purpose of such profiling and assess whether the information collected is necessary for it. The customer should also receive appropriate transparency where the applicable legal framework requires it. Recent Indian legal analysis specifically identifies targeted advertising, behavioural analytics, personalisation and dynamic pricing as areas requiring careful privacy and consumer law consideration. This is particularly important when automated systems influence product recommendations or other customer experiences.

Dark Patterns and Privacy Choices

Privacy compliance is also connected with interface design. A dark pattern can influence a user's decision through confusing, misleading or manipulative design. Examples may include making acceptance easier to find than rejection or presenting privacy choices in a way which discourages meaningful choice. The Central Consumer Protection Authority has issued Guidelines for Prevention and Regulation of Dark Patterns, 2023. The Department of Consumer Affairs lists these guidelines alongside the Consumer Protection framework. E commerce businesses should therefore assess privacy interfaces alongside consumer protection requirements. The legal question is not simply whether a button exists. The overall design of the customer journey matters.

Customer Rights and Request Management

The DPDP Act provides Data Principals with rights including access to information about personal data, correction and erasure, grievance redressal and nomination. For e commerce businesses, responding to these requests can be complicated. Customer information may exist in an account database, CRM system, payment platform, customer support tool and marketing system. A request for correction or erasure may therefore require action across several systems. The business needs a process for authenticating requests, locating relevant information, assessing the request and coordinating with Data Processors. Technology can assist, but governance remains important. Automated deletion without understanding legal retention requirements can also create problems.

Retention and Deletion of E Commerce Data

Online platforms often retain information because storage is inexpensive. This does not mean indefinite retention is appropriate. The DPDP Act provides for erasure when retention is no longer necessary for the specified purpose, subject to applicable legal requirements. The 2025 Rules introduce a specific retention framework for certain large e commerce entities. Rule 8 and the Third Schedule address an e commerce entity with not less than two crore registered users in India. For specified purposes, the framework provides a three year period calculated from the relevant last interaction or commencement of the Rules, whichever is later, subject to the exceptions in the Rules. Businesses should therefore avoid applying the large platform retention rule to every e commerce business. Its scope depends on the statutory conditions. For smaller businesses, retention should still be assessed according to the applicable purpose, legal requirements and broader data governance framework.

Payment Data and Third Party Providers

Payments create another major compliance challenge. E commerce platforms may integrate payment gateways, banks, wallet providers and other payment service providers. A business should understand what payment information it actually receives and what information remains with the payment provider. The organisation should avoid collecting payment information unnecessarily when the transaction can be completed through a specialised provider. Vendor contracts should establish appropriate responsibilities concerning security, incident management, access and deletion. Payment processing can also bring sector specific regulatory requirements into the analysis. An e commerce company should therefore avoid assuming the DPDP Act is the only relevant framework.

Logistics and Delivery Partners

Privacy obligations do not stop when an order leaves the website. Delivery partners may receive names, addresses, telephone numbers, order references and other information needed to complete delivery. The e commerce business should identify which information is shared and why. Vendor agreements should define permitted processing, security expectations, incident reporting, retention and deletion. The business should also assess whether delivery providers use information for additional purposes beyond fulfilment. This becomes particularly important when several logistics providers operate across different regions.

Customer Support and Call Centre Data

Customer support systems can contain extensive personal information. Support agents may see order history, addresses, contact details, complaints and payment related information. Call recordings may create additional data protection considerations. Businesses should establish access controls and define retention periods. Employees should only access information required for their role. Training is also essential. A customer support agent forwarding an account screenshot through an unsecured channel can create a privacy incident even when the company's main systems are well protected.

Data Breach Response

E commerce platforms are attractive targets because they can hold substantial volumes of customer information. A breach may involve account credentials, contact information, transaction records or other personal data. Businesses should maintain a documented incident response process covering detection, containment, investigation, evidence preservation, legal assessment and communication. CERT In also requires specified cyber incidents to be reported within six hours of noticing the incident or being informed about it. Businesses should therefore assess CERT In obligations separately from the DPDP breach notification framework. The DPDP Rules provide their own process for personal data breach notification once the relevant provisions commence. Rule 7 provides for notification to affected Data Principals without delay and detailed information to the Data Protection Board within 72 hours, subject to the Rule. E commerce businesses should therefore prepare for potentially overlapping regulatory obligations.

Vendor and Marketplace Data Sharing

An e commerce platform rarely operates alone. Its technology ecosystem may include payment providers, delivery partners, cloud services, analytics platforms, advertising networks, customer support providers and fraud prevention services. Each relationship should be assessed. The business should know whether the vendor acts as a Data Processor or has an independent purpose for processing information. Contracts should reflect the relationship and include appropriate privacy and security controls. Recent industry guidance specifically identifies third party transfers and processor contracts as important compliance considerations for e commerce businesses. This is an area where data privacy compliance services can assist businesses with data mapping, vendor assessments, privacy notices, consent processes and compliance reviews.

Children Using E Commerce Platforms

E commerce businesses should consider whether their services are likely to be used by children. Section 9 of the DPDP Act contains specific obligations concerning children's personal data. The framework requires verifiable parental consent in applicable cases and restricts certain forms of processing involving children. Businesses selling toys, educational products, games, entertainment services or other child focused products should examine their customer journey carefully. Age related controls should not be treated as a purely technical issue. Legal, product and engineering teams should work together.

Cross Border Data Processing

International e commerce creates additional complexity. A platform may be hosted by an overseas cloud provider. Customer support may operate from another country. Analytics and advertising tools may process information outside India. Section 16 of the DPDP Act provides a framework for processing personal data outside India and permits the Central Government to restrict transfers to specified countries or territories through notification. Other laws can impose additional requirements. Businesses should therefore map international data flows rather than simply stating in a privacy policy that information “may be transferred internationally”.

The Current DPDP Implementation Timeline

Businesses should be careful when describing the DPDP Act as fully operational. The Rules were notified on 13 November 2025. Rules 1, 2 and 17 to 21 came into force on publication. Rule 4 has a one year commencement period. Rules 3, 5 to 16, 22 and 23 have an eighteen month commencement period. The Act itself also has phased commencement. This means businesses should distinguish between provisions currently in force and provisions requiring implementation preparation. For e commerce businesses, this distinction is particularly important because changing checkout interfaces, vendor contracts, retention systems and customer rights workflows can take months. Preparation should therefore begin before the relevant statutory dates.

How E Commerce Businesses Can Build Privacy Into Operations

Privacy compliance works best when it is integrated into product design. When a new feature is developed, the business should ask what personal data it requires, why the information is needed, who receives it and how long it will remain available. Marketing teams should coordinate with privacy and legal teams before launching new tracking or personalisation initiatives. Procurement teams should identify vendors processing personal data before contracts are signed. Engineering teams should build appropriate access controls and deletion mechanisms into systems. Customer service teams should know how to handle privacy requests. This approach makes privacy a business process rather than a document stored on a website.

E Commerce Privacy Compliance Checklist

A practical review should examine the complete customer lifecycle. The organisation should assess its data inventory, privacy notices, consent mechanisms, marketing practices, tracking technologies, profiling, customer rights processes, retention schedules, vendor contracts, security safeguards, breach response procedures and international data flows. It should also review its consumer protection obligations, particularly where privacy choices intersect with interface design, advertising or other digital practices. For larger businesses, regular privacy audits can provide management with evidence of whether documented policies match actual processing.

Conclusion

Privacy compliance for e commerce businesses is no longer limited to publishing a privacy policy. Online retailers and marketplaces operate complex data ecosystems involving checkout systems, customer accounts, analytics, advertising, payment providers, logistics companies, cloud platforms and customer support tools. Each stage can create a separate privacy consideration. The DPDP Act and the notified 2025 Rules provide an important new framework for managing these activities in India. The phased commencement gives businesses time to review their practices, but it should not become a reason to postpone preparation.

A strong privacy programme begins with data mapping. It then connects appropriate processing grounds with transparent notices, meaningful consent where required, security controls, vendor governance, retention practices and effective customer rights processes. Businesses should also consider consumer protection requirements. Privacy choices should not be separated from the design of the customer journey. Dark patterns, misleading interfaces and unclear marketing choices can create risks beyond data protection law. For growing e commerce businesses, privacy should become part of product development, marketing, procurement, technology and customer service. This approach creates a more sustainable compliance framework and gives businesses a clearer understanding of how customer information moves through their operations.

Where e commerce platforms operate across multiple jurisdictions, use extensive profiling or manage large volumes of personal data, specialist legal review can help align corporate legal compliance with the organisation's actual technology, commercial and customer data practices. Legal note: This article provides general information on Indian data protection and e commerce law. It is not legal advice for a specific business or processing activity. The application of the DPDP Act and Rules depends on the organisation, processing activity, applicable commencement provisions and other relevant laws and regulations.

Frequently Asked Questions (FAQs)

Q1. What is e commerce privacy compliance?

E commerce privacy compliance means managing customer and other personal data in accordance with applicable privacy, cybersecurity, consumer protection and sector specific requirements. It covers collection, use, sharing, storage, security, retention and deletion.

Q2. Does the DPDP Act apply to online shopping websites?

Yes, where the processing falls within the Act's scope. An e commerce platform generally processes digital personal data and may act as a Data Fiduciary.

Q3. Does an e commerce website need customer consent for every activity?

No. The DPDP Act recognises consent as one ground for processing and also provides for certain legitimate uses. Businesses should identify the appropriate basis for each processing activity.

Q4. Is marketing consent different from order processing?

Yes. Order fulfilment and promotional communications can have different purposes and legal bases. Businesses should avoid assuming consent for one purpose automatically covers another.

Q5. Do e commerce companies need a privacy policy?

Businesses processing personal data should provide appropriate transparency under the applicable legal framework. The DPDP Rules, 2025 prescribe detailed notice requirements for the relevant commencement phase.

Q6. Can an e commerce business use customer purchase history for personalised advertising?

It depends on the purpose, applicable legal basis, notice, consent requirements and other applicable laws. Businesses should distinguish between using purchase history to fulfil an order and using it for separate marketing or profiling purposes.

Q7. How long can an e commerce company keep customer data?

There is no single retention period applicable to every e commerce business. Retention depends on purpose, applicable law and the relevant DPDP provisions. The 2025 Rules introduce a specific three year framework for certain large e commerce entities meeting the stated user threshold.

Q8. What happens if an e commerce company suffers a data breach?

The business should activate its incident response process, contain the incident, preserve evidence and assess applicable notification requirements. CERT In obligations and DPDP breach notification requirements should be considered separately where applicable.

Q9. Are payment gateways responsible for customer data protection?

Payment providers have their own regulatory and contractual responsibilities. The e commerce business should also understand what personal data it shares with the provider and establish suitable contractual and security controls.

Q10. Do delivery partners need data protection contracts?

Where a delivery provider processes personal data on behalf of an e commerce business, the relationship should be appropriately documented and governed. The exact contractual structure depends on the parties' roles and processing activities.

Q11. Are cookies covered by Indian data protection law?

Cookies themselves are technologies rather than a separate statutory category under the DPDP Act. The relevant question is whether their use involves processing of personal data and which legal requirements apply to the resulting processing. Businesses should also consider applicable consumer, advertising and technology requirements.

Q12. What are dark patterns in e commerce?

Dark patterns are interface or design practices which can mislead, manipulate or unfairly influence users. India's Central Consumer Protection Authority has issued Guidelines for Prevention and Regulation of Dark Patterns, 2023, making interface design relevant to wider e commerce compliance.

Q13. Do small online stores need to prepare for DPDP compliance?

Yes. The organisation's size does not by itself determine whether the DPDP Act applies. Small businesses should assess their actual processing activities and prepare proportionate privacy controls.

This update was released on 24 Sep 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.