On this page
- Where personal data flows in an online store or marketplace
- Order fulfilment versus promotional marketing on WhatsApp, SMS and email
- Couriers, shipping aggregators and payment gateways are Data Processors
- The three-year inactivity clock for large e-commerce platforms, and invoice retention for everyone
- Our view: six practical steps for D2C and e-commerce teams
- Common questions
- In the news
- Sources
Every online order sets off a chain of personal data transfers. A shopper enters a name, mobile number, delivery pin code and payment method at checkout; the storefront passes the order to a warehouse management system, a payment gateway, a third-party logistics aggregator, a last-mile courier and a WhatsApp or email engagement tool. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, an Indian e-commerce marketplace or direct-to-consumer brand is a Data Fiduciary for that customer data.
Where personal data flows in an online store or marketplace
Because coverage has no minimum turnover or order-volume threshold, a niche D2C brand running on a hosted storefront has the same core Data Fiduciary duties as a national marketplace. Mapping how shopper data moves from discovery to delivery and returns shows where the legal duties attach.
| Retail touchpoint | Personal data handled | Systems and vendors involved | Required DPDP control |
|---|---|---|---|
| Browsing and cart recovery | Phone number, email, device identifiers, abandoned cart items | Storefront, analytics pixels, WhatsApp and SMS marketing tools | Standalone itemised notice and affirmative consent before promotional outreach |
| Checkout and payment | Name, billing address, card or UPI handle, order value | Checkout engine, payment gateway, fraud screening service | Process for order fulfilment; keep payment processor under a valid contract |
| Packing and shipping | Recipient name, doorstep address, landmark, mobile number | Warehouse system, shipping aggregator, courier partners | Share only delivery fields; require processors to protect and purge shipment logs |
| Order alerts vs promotions | Order ID, tracking link, promotional discount codes | Transactional SMS gateway, WhatsApp Business API, CRM | Keep delivery updates separate from marketing blasts; honour instant opt-out |
| Returns, refunds and support | Bank account or UPI ID for refund, product photos, call recordings | Helpdesk ticketing tool, return pickup partner, accounting system | Publish a grievance and rights channel with a maximum 90-day resolution limit |
| Dormant customer accounts | Saved addresses, order history, loyalty points, support logs | Customer database, cloud backups, data warehouse | Erase personal data when purpose ends, subject to tax invoice retention |
Order fulfilment versus promotional marketing on WhatsApp, SMS and email
One of the most common mistakes in retail and D2C operations is treating a completed checkout as blanket permission to message the buyer forever on WhatsApp, SMS and email. When a shopper gives you their address and phone number to buy a product and pays for the order, using those details to pack the parcel, send the tracking link and issue the tax invoice is part of fulfilling the transaction.
Using that same phone number two weeks later to send festival sale broadcasts, new-launch lookbooks or loyalty cross-sells is a separate marketing purpose. It requires a clear, standalone notice and free, specific, affirmative consent—not a pre-ticked box hidden below the "Place Order" button. And when a buyer clicks "Stop" on WhatsApp or withdraws marketing consent in their account settings, withdrawing must be as easy as giving consent was, and your CRM and messaging processors must stop promotional outreach immediately.
Couriers, shipping aggregators and payment gateways are Data Processors
An e-commerce brand relies on external vendors to move boxes and collect money. Shipping aggregators, courier companies, cloud warehouses, customer support platforms and marketing agencies process buyer data on your behalf. Under the Act:
- You remain responsible for how your processors handle buyer data, even if a courier sub-contracts last-mile delivery or a marketing tool stores contact lists in the cloud.
- Every processor must be bound by a valid written contract that requires reasonable security safeguards—including encryption, access control and one-year access logs—and obliges them to report any data breach to you promptly.
- When a buyer exercises the right to know who their data has been shared with, you must be able to provide the identities of all Data Processors and other Data Fiduciaries that received their data, along with the description of the data shared.
The three-year inactivity clock for large e-commerce platforms, and invoice retention for everyone
All online sellers must erase personal data once its specified purpose is no longer served, while keeping personal data, traffic data and processing logs for a minimum of one year for the security and regulatory purposes set out in the Rules. In addition, the Third Schedule sets a specific three-year retention clock for any e-commerce entity having not less than two crore registered users in India: if a user does not approach the platform for the performance of the specified purpose or to exercise their rights for three years, the platform must give a 48-hour advance notice and then erase the personal data unless the user logs in or initiates contact.
For stores of every size, a customer's erasure request never forces you to destroy tax invoices or accounting ledgers that another law requires you to keep. You lock the invoice record for tax compliance and delete the customer's marketing profile, saved preferences and support history.
Our view: six practical steps for D2C and e-commerce teams
In our view, online retail and marketplace teams can get ahead of the 13 May 2027 enforcement date by taking six focused steps:
- Split checkout communication into two clean tracks: transactional order and delivery updates on one side, and optional opt-in marketing on WhatsApp, SMS and email on the other.
- Audit every Shopify, WooCommerce, custom storefront or mobile app plugin to remove unapproved tracking scripts and document every vendor in your processor register.
- Sign Data Processing Agreements with your shipping aggregators, 3PL warehouses, CRM providers and helpdesk tools covering security safeguards and breach notice.
- Configure your CRM and WhatsApp Business API so an opt-out or consent withdrawal propagates across all marketing lists automatically.
- Separate tax invoice records from customer marketing profiles in your database so erasure requests can be fulfilled cleanly without touching statutory accounting files.
- Set up automated 48-hour pre-erasure notices and inactivity purge jobs for dormant shopper accounts.
Common questions
Can an online store send promotional WhatsApp messages to everyone who completes a checkout?
No. Using a buyer’s phone number to deliver the parcel is order fulfilment, but sending promotional sales broadcasts is a separate marketing purpose that requires an itemised notice and specific, affirmative consent.
Are shipping aggregators, 3PL warehouses and last-mile couriers Data Processors?
Yes, when they handle buyer names, addresses and phone numbers on your behalf to pack and deliver orders. You remain responsible for their compliance and must engage them under a valid contract.
When does the three-year inactivity erasure rule apply to an e-commerce platform?
The Third Schedule sets a three-year inactivity period—with a 48-hour advance notice before erasure—for any e-commerce entity having two crore or more registered users in India. Smaller stores still erase data when its purpose ends.
If a shopper asks to delete their account, must we delete past GST tax invoices?
No. You must retain records that another law requires you to keep, such as tax invoices, while erasing the shopper’s marketing profile, saved addresses and optional preferences.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 05: Ask properly, in the toolkit
- How-to 09: Control your vendors, in the toolkit
- How-to 06: Keep only as long as needed, in the toolkit
- The free duties list, every duty in plain words
In the news
CCPA Imposed ₹10 Lakh Penalty on Rapido for Misleading Tipping Prompts and Dark Patterns
DPDP Act & Rules takeaway: Consumer authority enforcement against interface interference and confirm shaming—relevant to how checkout and app consent flows must avoid pre-selected or manipulative prompts.
View statutory briefing illustration
Source & Courtesy Reference: Press Information Bureau (original report)CCPA imposes ₹1 lakh penalty on SpiceJet for use of dark patterns on flight booking platform
DPDP Act & Rules takeaway: Order against pre-ticked check-boxes during online checkout, reinforcing the requirement for clear affirmative action on optional services.
View statutory briefing illustration
Source & Courtesy Reference: Press Information Bureau (original report)Malware Campaign spreading through WhatsApp Attachments
DPDP Act & Rules takeaway: CERT-In advisory on desktop and web WhatsApp attachment attacks, relevant to D2C and retail customer-support teams operating on WhatsApp Business.
View statutory briefing illustration
Source & Courtesy Reference: CERT-In (MeitY) (original report)26 Leading E-Commerce Platforms Declare Compliance with Self-Audit to Eliminate Dark Patterns
DPDP Act & Rules takeaway: Reports e-commerce self-audits to remove pre-ticked boxes, forced actions and deceptive checkout notices across online marketplaces.
View statutory briefing illustration
Source & Courtesy Reference: Press Information Bureau (original report)
Videos
Sources
Every section, rule and date above was checked against the official text on 22 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- Section 2(i)Data Fiduciary
- Section 2(k)Data Processor
- Section 3Application of the Act, with no minimum turnover test
- Section 5(1)Itemised notice
- Section 6(1)Consent requirements
- Section 6(4)Right to withdraw consent easily
- Section 6(6)Cessation by Data Fiduciary and Data Processors after withdrawal
- Section 8(1)Responsibility for Data Processors
- Section 8(2)Valid contract with Data Processors
- Section 8(5)Reasonable security safeguards
- Section 8(7)Erasure when purpose is no longer served unless required by law
- Section 11(1)(b)Right to obtain identities of all Data Processors and categories of data shared
- Section 12Right to correction and erasure
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 3Notice contents
- Rule 6Security safeguards and processor contract clauses
- Rule 8(1)Third Schedule retention period for large e-commerce entities
- Rule 8(2)Forty-eight hours advance notice before erasure
- Rule 8(3)Minimum one-year retention of personal data, traffic data and logs
- Rule 14(3)Ninety-day maximum grievance response timeline
- Third ScheduleThree-year inactivity period for e-commerce entities with two crore or more registered users in India
Notifications
- G.S.R. 843(E), clause (c)Core duties in force eighteen months from 13 November 2025 (13 May 2027)
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
