E-Commerce, Quick Commerce and D2C: A DPDP Act Impact Study

Executive summary

A single online order carries a shopper's name, phone number, address, payment token and browsing history; on a quick-commerce app, live location too. Within the hour it may pass from a marketplace to a seller, a dark-store operator, a payment aggregator and a delivery partner.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 reach every one of those steps from 13 May 2027. A data fiduciary decides why and how personal data is processed; a data principal is the person the data is about; a data processor handles data on a fiduciary's behalf.

Headline rating: Overall impact High. Six of the twelve areas in the Trayambic scorecard below are rated High for a typical mid-size marketplace, quick-commerce operator or direct-to-consumer (D2C) brand.

The three biggest changes:

• Consent moves beyond the cart. Buying something does not license retargeting, lookalike audiences, data sharing with brand partners or WhatsApp campaigns. Each needs its own itemised notice and a separate, withdrawable consent.
• Retention gets a deadline. Every retailer must erase data once its purpose is served, subject to tax and IT law. Platforms with at least two crore registered users also face a fixed three-year dormancy rule in the Third Schedule to the Rules.
• The supply chain becomes the retailer's liability. Section 8(1) makes the fiduciary responsible for its processors "irrespective of any agreement to the contrary". Logistics firms, storefront software, payment partners and messaging vendors all sit inside that responsibility.

The Act does not displace consumer law. The Central Consumer Protection Authority (CCPA) still polices the interface, so a manipulative consent screen can breach both regimes at once.

Background

Three business models share the sector:

• Marketplaces connect shoppers with third-party sellers. The platform owns the customer account; sellers, warehouses and couriers receive slices of each order.
• Quick-commerce operators run small urban fulfilment centres, often called dark stores. Precise location decides which store serves the shopper and which partner picks up the order.
• D2C brands sell their own products online, usually also through marketplaces and quick-commerce apps, on rented software: a storefront platform, a customer data platform, messaging tools and advertising pixels.

The data principals are a wider group than "customers":

• registered shoppers and guest buyers;
• gift recipients, whose details are supplied by someone else;
• children, when a parent records a child's age or size for baby, toy or school products;
• delivery partners, whose identity documents, bank details, location trails and ratings the platform holds;
• sole-proprietor sellers, reviewers and customer-support callers.

The data runs from identity, contact details and addresses to geolocation, order history, payment tokens, device identifiers, clickstream and call recordings. The vendors include cloud hosting, storefront software, payment aggregators, logistics firms, last-mile fleets, messaging providers, analytics and advertising tools, fraud scoring and outsourced call centres.

Legal framework

The DPDP provisions that matter most

• Grounds (ss.4, 6, 7). Consent or a listed legitimate use. Section 7(a) covers data a person "has voluntarily provided" for a specified purpose without objecting. There is no "legitimate interests" ground.
• Notice and consent (ss.5–6; Rule 3). Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", backed by a standalone, itemised notice, and as easy to withdraw as to give.
• Children (s.9; Rule 10). Verifiable parental consent for anyone under 18; no tracking, behavioural monitoring or targeted advertising directed at children.
• Fiduciary duties (s.8; Rules 6–7). Responsibility for processors, accuracy where data drives a decision, security safeguards (encryption or tokenisation, access control, a year of logs), and breach notice to each affected person and the Data Protection Board, with a detailed report within 72 hours.
• Rights (ss.11–14; Rule 14). Access, including who else received the data; correction and erasure; grievances answered within 90 days at most.
• Retention (s.8(7); Rule 8; Third Schedule). Erase when the purpose ends. E-commerce entities with at least two crore registered users must also erase after three years without engagement, on 48 hours' notice.
• Significant Data Fiduciaries (s.10; Rule 13). The Centre may designate a Significant Data Fiduciary (SDF) based on factors including the volume and sensitivity of data and the risk to people's rights. An SDF needs an India-based Data Protection Officer, an independent data auditor and an annual Data Protection Impact Assessment (DPIA).

Sector law that applies alongside

• Consumer Protection (E-Commerce) Rules, 2020 (G.S.R. 462(E), 23 July 2020). A displayed grievance officer (rule 4(4)) who acknowledges complaints within 48 hours and resolves them within a month (rule 4(5)). Purchase consent only through "an explicit and affirmative action", never pre-ticked boxes (rule 4(9)). Marketplaces display seller details (rule 5(3)(a)); sellers need a prior written contract and their own grievance officer (rule 6(4)).
• Guidelines for Prevention and Regulation of Dark Patterns, 2023, notified by the CCPA on 30 November 2023, listing 13 specified patterns; the Government's answer to Parliament cites drip pricing, disguised advertisement, bait and switch and false urgency.
• Consumer Protection Act, 2019. The Act's definition of unfair trade practice includes disclosing to another person personal information given in confidence by a consumer, unless the disclosure is made in accordance with law (s.2(47)(ix)).
• IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (G.S.R. 139(E), 25 February 2021). Marketplaces acting as intermediaries must keep a user's registration information for 180 days after the account is cancelled or withdrawn (rule 3(1)(h)), and preserve removed content and associated records for 180 days (rule 3(1)(g)).
• RBI card-data rules. The circular of 7 September 2021 permitted card-on-file tokenisation with explicit customer consent and barred everyone in the card chain except issuers and card networks from storing actual card data, beyond the last four digits and the issuer's name. A 24 June 2022 circular set the final deadline at 30 September 2022. The 6 April 2018 circular requires payment system data to be stored only in India.
• CERT-In Directions of 28 April 2022. Cyber incidents must be reported to CERT-In within six hours; logs must be kept in India for 180 days.
• CGST Act, 2017, s.36. Books of account and records must be kept until 72 months after the due date of the annual return.
• Code on Social Security, 2020 (in force 21 November 2025) treats gig and platform workers as distinct from employees. In Karnataka, the Platform-Based Gig Workers Act, 2025 adds algorithmic transparency (s.13) and 14 days' notice before termination (s.14(2)).

How sections 38 and 16(2) fit them together

Section 38(1) makes the DPDP Act additional to other laws; section 38(2) makes it prevail in a conflict. True conflicts are rare here. Retention rules in the IT Rules and the CGST Act fit the s.8(7) exception for retention required by law, and the E-Commerce Rules' purchase consent and DPDP consent govern different decisions. Section 16(2) preserves stricter laws on transfers abroad, so the RBI's payment-data localisation keeps binding payment system operators although the Act itself restricts transfers only to notified countries, of which there are none.

The dates

• 13 November 2026: consent manager provisions commence. A consent manager is a Board-registered company through which people give, manage and withdraw consent across businesses.
• 13 May 2027: the main duties, rights, Rules 3 and 5 to 16, and the penalty provisions commence; IT Act s.43A is omitted.

No notification compressing this timeline has been issued as of October 2026, and no appointments to the Data Protection Board have been announced.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Consent after checkout

Section 7(a) is the natural ground for the core transaction. A shopper who types an address to get a parcel has voluntarily provided it for that purpose, which covers payment, delivery updates, returns and warranty service.

It runs out quickly. Retargeting on social media, lookalike audiences built from the customer list, WhatsApp promotions and sharing purchase data with advertising brands are new purposes. They need consent under s.6 and a Rule 3 notice. Explicit consent to the purchase under the E-Commerce Rules does not help: it is consent to buy, not to be marketed to.

Two blind spots are specific to retail:

• Gift recipients. Section 7(a) speaks of data the data principal provided herself. A recipient whose address a friend typed in has provided nothing. Use it only to deliver, keep it out of marketing lists, and delete it after the return window.
• Pixels and software development kits (SDKs). When a D2C site fires an advertising pixel, the brand chose to send that data and is a fiduciary for the disclosure. Pixels that fire before consent are among the commonest gaps in retail audits.

Screen design matters as much as wording; Trayambic's blog on dark patterns and consent design for e-commerce covers the screen-level tests.

Marketplaces, sellers and the fiduciary map

The Act defines a data fiduciary as a person who "alone or in conjunction with other persons" decides the purpose and means of processing. On a marketplace, that makes the map more complicated than "platform equals fiduciary, seller equals processor".

The platform is a fiduciary for the account, the recommendation engine and its own marketing. A seller who receives a buyer's address to ship its own goods decides its own purposes too (fulfilment, invoicing, warranty) and is better treated as a separate fiduciary than as the platform's processor. A seller who copies buyers' numbers into its own WhatsApp list needs a ground of its own.

Three consequences follow:

• Use the seller contract. Rule 6(4) of the E-Commerce Rules already requires a prior written contract. Add data terms: permitted uses, no off-platform marketing, security minimums, deletion after the return and warranty window, and breach notice to the platform.
• Mask by default. Where the platform or its logistics partner ships, the seller often needs no phone number or full address.
• Answer the access right. Section 11 lets a shopper ask who received her data. A marketplace must be able to answer per order: seller, logistics partner, payment aggregator.

The Third Schedule's definition of an e-commerce entity excludes marketplace sellers, so the three-year dormancy clock is the platform's. Sellers holding copies must still erase them under s.8(7) once their own purpose is served.

Delivery partners and the location layer

Quick commerce runs on two streams of location data: the shopper's, to choose a store, and the delivery partner's, to dispatch and track the trip. For shoppers, collect only the precision the purpose needs: a delivery point, not continuous background location, with live tracking ending at delivery.

For delivery partners, the employment ground in s.7(i) is a poor fit, because the Code on Social Security treats platform workers as a separate category. Trayambic's guide to driver and rider location data covers the grounds for tracking. Two points go further for quick commerce:

• Ratings and deactivation. Section 8(3) requires accurate, complete and consistent data where it drives a decision about the person. A fraud flag or rating that leads to deactivation qualifies. Karnataka's Act adds 14 days' notice before termination and transparency about automated systems.
• Onboarding documents. Keep only what the platform needs from identity documents, bank details and selfies, mask Aadhaar numbers, and delete image files once verification is complete.

Retention, erasure and the dormant account

Section 8(7) requires erasure once the purpose ends or consent is withdrawn, unless law requires retention. One customer record therefore splits into several clocks:

• Invoices and tax records: kept until 72 months after the due date of the annual return (CGST Act, s.36).
• Registration information on an intermediary platform: kept for 180 days after the account is cancelled (IT Rules, rule 3(1)(h)).
• Logs and traffic data: kept for at least one year (Rule 6 and Rule 8(3)).
• Marketing profiles, abandoned carts, browsing history and saved addresses: erased when the purpose ends or consent is withdrawn.

Platforms with two crore or more registered users also face the Third Schedule's three-year dormancy rule, with exceptions for data needed to give the user access to her account and to honour a virtual token the platform issued, such as a gift-card balance. Trayambic's dark patterns blog sets out the two readings of when that clock starts.

Payment data is the easiest category, because the RBI has already minimised it: the token, the last four digits and the issuer's name. An old export still holding full card numbers has breached RBI rules since October 2022 and is now a DPDP security risk too.

Worked example: a D2C baby-care brand

Consider a mid-size D2C brand selling baby skincare through its own app, two marketplaces and three quick-commerce apps. It sends WhatsApp reminders through a messaging vendor, runs advertising pixels, and asks parents for the baby's name and birth month to send "milestone" product suggestions.

Children's data. The baby's name and birth month are the child's personal data, so s.9(1) requires verifiable parental consent. The account holder is usually the parent, and under Rule 10 the brand can confirm she is an identifiable adult from details it already holds. But milestone reminders follow the child's development, which sits uneasily with the s.9(3) bar on behavioural monitoring. A safer design asks the parent to pick a product stage ("newborn", "6–12 months") instead.

Marketplace orders. The brand receives shipping data for marketplace orders. It may not move those buyers into its WhatsApp list without consent.

A breach. The messaging vendor leaves 80,000 order records in a publicly readable storage bucket. The brand must tell each affected person and the Board without delay, send the Board a detailed report within 72 hours, and report to CERT-In within six hours. Under s.8(1) the vendor's fault does not shift the brand's liability, so the contract needs hours-level notice, audit rights and an indemnity.

Retention. Invoices stay for the tax period; milestone data, carts and marketing lists go when the child outgrows the range or consent is withdrawn. Below two crore users the Third Schedule does not apply, but s.8(7) does.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: data map and vendor inventory; purge stored card data and stale exports; decide on consent manager support.
• January to March 2027: new notices and consent screens; consent-gated pixels; revised seller and vendor contracts.
• April to May 2027: test rights and breach workflows end to end; switch on retention jobs; train grievance officers.
• Ongoing: review new marketing tools before launch; audit vendors yearly; watch for SDF designation and CCPA advisories.

Recommendations

1. 1.Split the order from the marketing: rely on s.7(a) only for fulfilling what the shopper bought, and take separate consent for everything else.
2. 2.Treat pixels and SDKs as disclosures you make, and load none before consent.
3. 3.Rewrite seller contracts so marketplace buyers cannot be moved into a seller's own marketing.
4. 4.Build one retention schedule that names the legal clock for each data type, then automate deletion.
5. 5.Mask what sellers and delivery partners see, and delete partner onboarding images after verification.
6. 6.Run a joint breach drill with your logistics and messaging vendors before May 2027.
7. 7.If you sell children's products, collect product stage rather than a child's identity, and take verifiable parental consent for anything more.

Key takeaways

• Section 7(a) covers fulfilling the order a shopper placed; marketing, pixels and partner sharing need separate DPDP consent.
• A marketplace seller that receives buyer data for its own fulfilment is usually a separate data fiduciary, and needs its own ground for any reuse.
• Retention splits into several clocks: 72 months for GST records, 180 days for intermediary registration data, a year for logs, and prompt erasure for marketing data.
• Platforms with two crore or more registered users must erase data after three years of inactivity, on 48 hours' notice.
• A vendor's breach is the retailer's breach: notify affected users and the Board, and CERT-In within six hours.