DPDP for D2C and e-commerce brands

Last checked 22 Oct 2026 · Draft. Awaiting counsel review.

Using a customer's details only to deliver what was ordered may not need consent (s.7(a)), but offers, marketing and website tracking need a notice and consent (s.5(1), s.6(1)), with withdrawal as easy as giving it (s.6(4)). Nearly every duty under the DPDP Act 2023 and the DPDP Rules 2025 applies from 13 May 2027, including, for the largest online shopping sites and apps, the erasure of users inactive for 3 years (s.8(8), Rule 8(1), Third Schedule).

Which duties weigh most for a D2C or e-commerce brand?

• Notice and consent for offers, marketing and tracking. A notice before or with every consent request, stating each item of personal data, the purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board, readable in English or a language of the Eighth Schedule (s.5(1), s.5(3), Rule 3). Consent is asked per purpose, by a clear action, and not bundled into the terms (s.6(1), s.6(2)). Penalty up to ₹50 crore (s.33, Schedule item 7).
• Withdrawal. As easy as giving consent; after a withdrawal, processing stops, at the brand's vendors too, within a reasonable time, unless a law requires it to continue (s.6(4), s.6(6)).
• Proof. If a question arises, the brand carries the burden of proving that the notice was given and consent obtained (s.6(10)): who agreed, which notice version and language, which purposes, and when and how.
• Children. Nothing likely to harm a child's well-being, and no tracking, behavioural monitoring or targeted advertising directed at children (s.9(2), s.9(3)); a parent's verified consent before using a child's data (s.9(1), Rule 10). A child is anyone under 18 (s.2(f)). Penalty up to ₹200 crore (s.33, Schedule item 3).
• Vendors. A payment gateway, a delivery partner, a WhatsApp Business provider or cloud storage that handles customer details works under a valid contract with reasonable security safeguards, and the brand stays responsible for it (s.8(1), s.8(2), Rule 6(1)(f)).
• Security and breaches. Reasonable security safeguards, at vendors as well as in the brand's own systems (s.8(5), Rule 6(1)), up to ₹250 crore (s.33, Schedule item 1). Every breach is told to each affected person and the Board without delay, with the detailed report to the Board within 72 hours of becoming aware (Rule 7(1), Rule 7(2)(a), Rule 7(2)(b)).
• Large platforms. The 3-year inactivity erasure applies only to an online shopping site or app the business owns or runs, not to a seller on another business's marketplace, with at least 2 crore registered users in India (s.8(8), Rule 8(1), Rule 8(2), Third Schedule). The 3 years run from 13 May 2027 at the earliest, a Fohrkast reading pending counsel.

When do the duties start?

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early, until counsel confirms, and shows each duty as a recommended step until its start date.

What does Fohrkast do for a D2C or e-commerce brand?

• Fohrkast drafts the notice from the brand's purposes and data map; the brand checks and publishes it (s.5(1), Rule 3), in English or a language of the Eighth Schedule (s.5(3)).
• Consent is recorded per purpose, withdrawal is as easy as giving it (s.6(4)), and each record is kept to its retention date (s.6(10)).
• On the brand's own website, a banner holds each marked tracker until the matching consent, and treats a browser that sends Global Privacy Control or Do Not Track as declining every optional purpose.
• A rights desk for access (s.11), correction (s.12(2)), erasure (s.12(3)), nomination (s.14), withdrawals of consent (s.6(4)) and grievances (s.13), from the brand's hosted request page or logged by staff from WhatsApp, phone, SMS, email or letter.
• A record of each vendor that processes personal data for the brand (s.8(2)); for each erasure, the vendors asked to erase and their answers, and a deletion certificate (s.8(7)).
• The incident desk drafts the notice to each affected person (Rule 7(1)), the first intimation to the Board (Rule 7(2)(a)) and the detailed report, counting the 72 hours from the awareness time the brand records (Rule 7(2)(b)).
• Every step is written to a hash-chained record (SHA-256) with times in IST, and the evidence pack can be exported on every plan.

What does Fohrkast not do?

• Give legal advice.
• File or send on a business's behalf. The brand decides and sends every notice and report.
• Hold more personal data than a duty needs.
• Claim a security certification. Fohrkast holds none yet.

The brand remains the Data Fiduciary, responsible for its duties (s.8(1)).

Which plan usually fits?

A brand within every Professional limit fits Professional: up to 50,000 people on record, 2,50,000 consent records, 2 websites, apps and hosted pages, and 2,00,000 banner loads a month. A brand above any one of these at renewal moves to the lowest plan whose limits cover every figure, usually Business: up to 10,00,000 people on record and 20,00,000 banner loads a month. Prices are before GST at 18% and billed yearly in advance, in INR. Rights requests, grievances, consent withdrawals and incidents never count toward a limit. Full terms: fohrkast.com/pricing.

Questions and answers

Does a D2C brand need consent to send order updates?

Using a customer's details only to deliver what was ordered may not need consent (s.7(a)). Offers, a newsletter, loyalty points and website tracking need a notice and consent (s.5(1), s.6(1)), with withdrawal as easy as giving it (s.6(4)).

Does website tracking need consent under the DPDP Act?

Website tracking needs a notice and consent, as offers and marketing do (s.5(1), s.6(1)), and tracking, behavioural monitoring or targeted advertising directed at children is not allowed outside the narrow Fourth Schedule cases (s.9(3), Rule 12). On a brand's own website, Fohrkast's banner holds each marked tracker until the matching consent.

Which e-commerce platforms must erase the data of inactive users?

Only an online shopping site or app the business owns or runs, not a seller on another business's marketplace, with at least 2 crore registered users in India; the rule also covers social media platforms of that size and online gaming platforms with at least 50 lakh. A user inactive for 3 years is warned at least 48 hours before the erasure, and what the user needs to reach the account or spend stored value is kept (s.8(8), Rule 8(1), Rule 8(2), Third Schedule).

Can a D2C brand show targeted ads to children?

No. The Act bars tracking, behavioural monitoring and targeted advertising directed at children, outside the narrow Fourth Schedule cases (s.9(3), Rule 12), and any processing likely to harm a child's well-being (s.9(2)). A child is anyone under 18 (s.2(f)), and the penalty reaches ₹200 crore (s.33, Schedule item 3).

Which Fohrkast plan fits a D2C brand?

Professional, ₹9,999 a month billed yearly with GST extra, while the brand stays within every Professional limit, for example 50,000 people on record and 2,00,000 banner loads a month. Above any one limit at renewal, the lowest plan whose limits cover every figure, usually Business at ₹49,999 a month billed yearly with GST extra.

Sources

• Digital Personal Data Protection Act, 2023 (22 of 2023): MeitY copy. Read 21 Oct 2026.
• G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: MeitY copy. Read 21 Oct 2026.
• G.S.R. 843(E), commencement of the Act, 13 Nov 2025: MeitY copy. Read 21 Oct 2026.
• Fohrkast rulebook in.dpdp version 1: published duties.

Related duties in the published rulebook: notice before consent, valid and withdrawable consent, proof of notice and consent, no tracking of children, vendor contracts, 3-year erasure on large platforms.

Not legal advice. Legal statements on this page are awaiting counsel review.