DPDP Act for ecommerce businesses: checkout, retention and vendors

The official text uses ecommerce repeatedly. It gives an online shopping example for legacy notice, another for withdrawal after a paid order, an online marketplace example for erasure, an e book example for the 1 year retention floor, and a separate threshold for large ecommerce entities. Those examples do not create an ecommerce code. They show how the general framework attaches to each step of the shopper journey.

DPDP for ecommerce is a 4 layer map for each shopper flow. First, role per activity: section 2(i) makes a person that determines the purpose and means of processing, alone or with others, a Data Fiduciary; section 2(k) makes a person processing personal data on that fiduciary's behalf a Data Processor; an own purpose may point to a separate Data Fiduciary role. Second, checkout: section 4 requires consent or a particular use in section 7 for a lawful purpose; a consent request carries the section 5 notice and section 6 consent standard; the withdrawal Illustration says new orders may stop but processing to supply goods already ordered and paid for may not stop. Third, vendor chain: section 8(2) permits use of a processor only under a valid contract, while section 8(1) keeps responsibility with the Data Fiduciary; a box typed as this site's practical recommendation, not a statutory requirement, says to make withdrawal and erasure work across the chain and include security and breach. Fourth, retention: the 3 section 8 and Rule 8 rules are kept separate. The first is the section 8(7) purpose test, erasing on withdrawal or when the purpose is no longer served, whichever is earlier, unless law requires retention, while causing the processor to erase personal data made available to it too. The second is Rule 8(1) with the Third Schedule, a 3 year timer from the latest listed trigger for an ecommerce entity with at least 2 crore registered users in India, with at least 48 hours warning under Rule 8(2). The third is Rule 8(3), requiring personal data, associated traffic data and other processing logs for at least 1 year for Seventh Schedule purposes before erasure, subject to the further retention limb. A separate red band keeps Rule 6(1)(e) outside that count: for detection and investigation of unauthorised access, remediation to prevent recurrence and continued processing after a compromise, retain such logs and personal data for 1 year, unless compliance with any law in force requires otherwise. Status as at 22 October 2026: section 2 is in force. The checkout, vendor and retention duties shown sit in the 18 month group, computed 13 May 2027. That date is interpretation until officially confirmed and may fall as late as 15 May 2027.

Map the shopper journey before writing 1 policy

The role belongs to the activity, not the marketplace label

Section 2(i) makes a person a Data Fiduciary when that person determines the purpose and means of processing, alone or with others. Section 2(k) makes a person a Data Processor when it processes on a Data Fiduciary's behalf.

An ecommerce platform will commonly determine the purpose and means for its customer account, checkout and support flows. That points to the Data Fiduciary role for those activities. A delivery provider, payment provider, cloud service or support vendor may act on the platform's behalf for 1 flow and choose a separate purpose for another. The first is the processor direction; the second can make that provider another Data Fiduciary. These are applications of the definitions, not labels the Act assigns to an industry.

This is why a vendor register cannot stop at company names. It needs a row for each activity, the person deciding its purpose and means, and whether every recipient acts on instructions or for a purpose of its own. The role guide keeps the unresolved cases where 2 parties divide those decisions.

Checkout needs a ground, and consent needs a notice

Section 4 permits processing in accordance with the Act for a lawful purpose on either consent or a particular use in section 7. A privacy policy is not a third route.

When the platform asks for consent under section 6, section 5 requires the request to be accompanied or preceded by a notice. Rule 3 adds the form: the notice must stand independently, use clear and plain language, itemise the personal data, identify the specified purpose and specifically describe the goods, services or uses enabled by the processing. It must also give the routes for withdrawal, rights and complaints.

Section 6(1) then asks whether consent is free, specific, informed, unconditional and unambiguous, shown by a clear affirmative action and limited to personal data necessary for the specified purpose. That standard applies at a guest checkout too. Creating no account changes the screen design, not the legal test.

An operational checkout map should separate at least the data needed to take and fulfil the order, an optional account, recommendations, fraud controls and later marketing. The point is not to manufacture 5 consent boxes. It is to identify the purpose and ground for each flow instead of treating the purchase button as permission for every later use.

Withdrawal can stop new orders while a paid order finishes

The Act answers 1 ecommerce edge case in its own words. An individual places and pays for an order, then withdraws consent. The platform may stop enabling new orders, but it may not stop processing needed to supply the goods already ordered and paid for.

That Illustration is precise and narrow. It does not settle every return, cancellation, refund, warranty or fraud dispute. Section 6(6) provides the general next step: within a reasonable time, the Data Fiduciary must cease and cause its Data Processors to cease processing unless processing without consent is required or authorised by the Act, Rules or another law in force.

So withdrawal should become an executable workflow. It needs to reach delivery, messaging, support, analytics and other processors, while the platform records the ground for any processing that continues. A preference control that updates the storefront but leaves the vendor chain untouched does not perform that job.

A processor contract is necessary and does not shift responsibility

Section 8(2) lets a Data Fiduciary use a Data Processor for an activity related to offering goods or services only under a valid contract. Section 8(1) keeps the fiduciary responsible for processing by it or on its behalf irrespective of an agreement to the contrary.

For an ecommerce journey, that can reach cloud hosting, fulfilment, delivery messaging, customer support and a provider operating part of the checkout. It does not automatically make every recipient a processor. A payment provider or seller using the data for a purpose it independently determines must be analysed as a possible separate Data Fiduciary.

Section 8(3) matters when order or identity data will be used for a decision affecting the person or disclosed to another Data Fiduciary. The platform processing that data must ensure completeness, accuracy and consistency. The processor contract guide keeps the clause map; this page keeps the shopper journey.

Section 8 and Rule 8 have 3 different retention rules

The framework does not give every ecommerce record a single retention period.

First, section 8(7) sets the purpose test. Erase on withdrawal of consent or as soon as it is reasonable to assume the specified purpose is no longer served, whichever is earlier, unless retention is necessary to comply with law. Cause the Data Processor to erase the personal data made available to it too. The Act's marketplace Illustration is direct: once the marketplace helps conclude a used car sale, it says the operator shall no longer retain the seller's personal data.

Second, Rule 8(1) and entry 1 of the Third Schedule create a 3 year inactivity timer for a narrower class: a Data Fiduciary that is an ecommerce entity with at least 2 crore registered users in India. The clock runs from the latest of the person's last approach for the specified purpose, exercise of rights, or commencement of the Rules. Account access and a stored virtual token usable to get money, goods or services are excepted from the purpose column. Rule 8(2) requires at least 48 hours warning before erasure under that rule.

The threshold is registered users in India, not orders, revenue, employees or the amount of personal data. The Schedule's Note also excludes a seller that merely offers goods or services on a marketplace ecommerce entity from its borrowed ecommerce entity definition. This does not remove the seller from the Act; it answers only whether that seller falls within this scheduled class on that basis.

Third, Rule 8(3) pulls in the other direction. For the Seventh Schedule purposes, it requires a Data Fiduciary to keep personal data, associated traffic data and other processing logs for at least 1 year from processing, then erase them unless the further retention limb applies. The printed Illustration is an e book purchase. Delivery is complete and the specified purpose has ended, yet the platform must keep order details, personal data and the order, payment and delivery event logs for at least 1 year even if the person deletes her account.

The retention guide works through how these rules interact. The safe design move is to record the exact purpose, the trigger, the record class, any other law requiring retention, every processor holding a copy, and which Rule 8 limb applies. Copying 3 years onto all order data is as wrong as erasing every record the moment delivery completes.

Marketing after purchase is a separate flow

A completed purchase does not by itself answer the ground for a later promotional message, audience profile or advertising share. The section 6 consent is tied to the specified purpose and necessary data. The platform must map the later purpose on its own terms.

Channel rules can apply alongside DPDP. The marketing guide keeps the live TRAI framework, the distinction between its consent and DPDP consent, and the child advertising rule. This article makes only the ecommerce boundary: do not bury marketing inside fulfilment merely because both begin at checkout.

Security and breach handling must cross the vendor chain

Section 8(5) requires reasonable security safeguards for personal data in the Data Fiduciary's possession or control, including processing by a Data Processor. Rule 6 supplies the minimum list, including access controls, visibility through logs, measures for continued processing and an appropriate processor contract provision.

Rule 6(1)(e) adds a separate 1 year security floor outside the 3 section 8 and Rule 8 rules above. It requires such logs and personal data to be retained to enable detection and investigation of unauthorised access, remediation to prevent recurrence and continued processing after a compromise, unless another law in force requires otherwise.

Section 8(6) requires intimation to the Board and each affected Data Principal after a personal data breach. Rule 7 prescribes the 2 audiences and the content and timing for each. The detailed Board submission is due within 72 hours of awareness unless the Board allows a longer period on a written request. The breach guide keeps the complete list and the separate CERT In regime.

For an order data incident, the platform needs evidence from every relevant provider quickly enough to describe the nature, extent, timing, likely consequences and mitigation. A contract that says only comply with applicable law does not itself produce those facts.

When these duties commence

The role definitions in section 2 are already in force. The checkout, processor, security, breach and retention duties discussed here sit in the 18 month group: sections 3 to 5, sections 6(1) to 6(8) and 6(10), and sections 7 to 17; Rules 3, 5 to 16, 22 and 23.

Computed from the printed publication dates, the common date is 13 May 2027. That date is interpretation until officially confirmed. The eGazette records carry 14 November 2025 and neither instrument explains how to count the period, so the latest reading is 15 May 2027. The current status article keeps the provision by provision position.

A practical ecommerce preparation sequence

These are recommendations, not statutory requirements:

1. Draw the journey from account or guest checkout through payment, fulfilment, delivery, returns, support, marketing and erasure.
2. Assign the Data Fiduciary and Data Processor roles per activity, then record the ground and specified purpose for each use.
3. Rebuild consent requests and notices around the data and purpose actually needed at that step, with withdrawal and rights routes that work.
4. Put processing done on the platform's behalf under a valid contract and make withdrawal, erasure, security and breach actions executable across the chain.
5. Build retention per record class. Keep the section 8(7) purpose test, the large platform timer and the Rule 8(3) floor as separate rules.
6. Keep purchase fulfilment and later marketing as separate flows, even when 1 interface presents them together.
7. Exercise the incident path with the delivery, payment, cloud and support providers that hold order data.

Start with the role checker, test each record class in the retention tool, review vendors with the processor checklist, and bring the results together in the company compliance plan.