E-commerce and D2C brands must comply with the DPDP Act by 13 May 2027. Order fulfilment is a use customers expect, but marketing by email, SMS or WhatsApp needs a separate opt-in, and pre-ticked boxes are not valid consent. Platforms with 2 crore or more registered users in India must erase data of users inactive for 3 years, after a 48-hour warning. Courier, payment and marketing tools are processors and need contracts.
- Deadline
- 13 May 2027
- Marketing
- Separate opt-in
- 2 crore+ users
- Erase after 3 years inactive
- Pre-ticked boxes
- Not valid consent
Where e-commerce and d2c brands face the most DPDP risk
| Area | What to do |
|---|---|
| Checkout and account creation | Short notice, unticked marketing box, guest checkout option |
| Abandoned-cart WhatsApp and SMS | Consent for marketing reminders; easy opt-out |
| Couriers, payment gateways, CRM and ad tools | Processor contracts; share minimal data |
| Customer support recordings and chats | Retention limits and access control |
| Inactive accounts | Retention schedule; 3-year rule for large platforms |
Other rules that apply alongside the DPDP Act
- Consumer Protection (E-Commerce) Rules, 2020
- CCPA Guidelines on dark patterns, 2023 (forced action, basket sneaking, nagging)
- TRAI rules for promotional SMS and calls
Where another law sets a stricter or longer requirement, follow both: the DPDP Act does not override sector rules on retention or storage.
Six steps to comply
- List every tool that receives customer data: store platform, payment, courier, CRM, email, ads.
- Rewrite checkout and sign-up notices; remove pre-ticked marketing boxes.
- Re-permission old marketing lists before May 2027.
- Sign data processing clauses with key vendors.
- Set retention for inactive accounts and support data.
- Add a self-service way to unsubscribe and delete accounts.
Most DPDPA duties apply from 13 May 2027, with penalties up to ₹250 crore per breach. See the DPDPA 2027 roadmap and the DPDP compliance checklist.
Want it done for you? Our DPDP compliance service covers data mapping, notices, consent, vendor contracts, breach plans and staff training for e-commerce marketplaces, D2C brands and online stores.
Frequently asked questions
Can an online store send WhatsApp offers to customers under DPDP?
Only with consent. Order and delivery updates relate to the purchase, but offers and abandoned-cart marketing need a separate opt-in and an easy way to stop.
What is the 3-year rule for e-commerce under DPDP?
E-commerce entities with at least 2 crore registered users in India must erase personal data of users who have not used the platform or exercised their rights for 3 years, after warning them 48 hours before (Third Schedule, Rule 8).
DPDP guides for other industries
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- DPDP compliance cost in India
- DPDP compliance for hospitals and healthcare
- DPDP compliance for edtech, schools and coaching
- DPDP compliance for fintech, nbfcs and lending apps
- DPDP compliance for hr, staffing and recruitment firms
- DPDP compliance for real estate developers and brokers
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.