₹250 Crore DPDP Risk: Is Your E-commerce Website Collecting Customer Data Without Valid Consent?

Your e-commerce website probably collects more customer data than you realize. A shopper creates an account, enters a shipping address at checkout, ticks a box for offers, and clicks a WhatsApp link to ask about an order. Behind the scenes, analytics scripts, advertising pixels, a CRM, an email tool and a payment gateway may all receive pieces of that information. Our e-commerce DPDP compliance service starts by tracing exactly these flows.

Collecting customer information is a normal part of running an online store. The question under India's Digital Personal Data Protection Act, 2023 (the DPDP Act) is different: can you show why each piece of personal data is collected, how consent or another lawful ground applies, and how the data is used and deleted afterwards? Our DPDP compliance consulting services help businesses answer exactly that question.

Where e-commerce websites collect personal data

Most online stores collect personal data at more points than the owner tracks. Common collection points include:

• Customer registration and account forms
• Checkout and payment pages
• Newsletter subscriptions and marketing pop-ups
• Cookie-based tracking technologies
• Google Analytics and advertising pixels
• WhatsApp marketing and chat integrations
• CRM and email marketing platforms
• Loyalty and referral programs
• Third-party payment, shipping and delivery services

Each of these points creates a flow of personal data. Some flows are needed to complete an order. Others serve marketing or analytics. The DPDP Act treats these purposes differently, so the business has to know which is which.

What the ₹250 crore DPDP penalty means for e-commerce businesses

The DPDP Act regulates the processing of digital personal data, which is personal data collected in digital form or digitized later. An online store that processes data of people in India is generally within its scope. The Act applies to processing within India, and it can also apply to processing outside India when it relates to offering goods or services to people in India. Confirm the exact scope for your business with a lawyer.

Under the Act, the business that decides why and how personal data is processed is called a Data Fiduciary. The person whose data it is, the customer, is called a Data Principal. A vendor that processes data on the Data Fiduciary's behalf is called a Data Processor. The Data Fiduciary stays accountable for the processor's handling of the data.

The headline figure is ₹250 crore. The Act's penalty schedule sets a maximum amount for each category of failure. Secondary summaries of the schedule list the top amount, ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach. Other categories carry lower maximums. Please check the figures against the official Gazette text, because penalty tables are often summarized inaccurately.

Three points matter for an e-commerce business:

• The maximum is not an automatic fine. The Data Protection Board decides on any penalty after an inquiry. Each case turns on its facts.
• A single violation is not the same as a single penalty. Several failures can lead to several proceedings. Reducing risk means fixing the underlying practices, not just the paperwork.
• Consent is not the only lawful basis. The Act also allows certain legitimate uses. Each processing activity needs its own basis.

The table below links common failures to the business risk and a practical first action.

Requirements now and later

The DPDP Rules were notified in November 2025. The Rules bring into force some provisions immediately and others after a transition period. Most operational obligations apply after about 18 months, which some sources place around May 2027. Check the official commencement schedule before you set internal deadlines, and do not assume the dates for every obligation are the same.

Keep two categories separate when you plan your work. Legal requirements are the obligations in the Act and Rules that apply to you. Recommended practices are steps that reduce risk and make compliance easier to show, even where the law does not spell out the exact method. This article labels its advice accordingly.

10 e-commerce practices that create DPDP compliance risk

Each practice below follows the same pattern: what businesses are doing wrong, why it creates risk, a realistic example, the fix, and the technical work it may need.

1. Collecting customer information without a proper consent mechanism

What goes wrong. Forms ask for every detail in one step. Pop-ups collect email addresses for "offers" without saying what the offers are. Newsletter sign-ups and account creation are mixed together.

Why it is a risk. Where consent is the basis for processing, the consent must be specific and clearly given. A single mixed request makes it hard to show what the customer agreed to.

Example. A fashion store asks for an email address, mobile number and birthday at account creation and treats the whole form as consent to marketing.

Fix. Separate necessary information (name, delivery address, payment details to complete an order) from optional marketing preferences. Ask for consent for marketing only through a separate, unticked choice.

Technical work. Store the purpose, the notice version shown and the timestamp for each consent. Keep a record of withdrawals too.

2. Using pre-selected marketing consent checkboxes

What goes wrong. The "send me offers" box is ticked by default, or the marketing consent is hidden inside the terms and conditions.

Why it is a risk. Consent that is pre-ticked or bundled with other terms is hard to describe as freely given and unambiguous. If the business cannot show a clear positive choice, it cannot easily rely on consent.

Example. A checkout page includes "I agree to receive promotional messages" already ticked, with the terms link below it.

Fix. Leave the marketing box unticked, place it apart from the order terms, and describe what the customer will receive and how to stop it.

Technical work. Update the front-end form, the consent record, and any integration that sends consent status to the email or messaging tool.

3. Tracking customers through advertising pixels without a clear basis

What goes wrong. The business installs Meta Pixel, Google Ads tags and retargeting scripts, then assumes that a cookie banner makes everything compliant.

Why it is a risk. Advertising and analytics tools can send personal data, such as device identifiers, browsing behavior and purchase events, to third parties. Each tool needs a clear purpose, a notice to the customer, and a lawful basis. A banner alone does not settle these questions. Also note that the DPDP Act does not single out cookies. The question is whether the tracking processes personal data, and on what basis.

Example. A store fires purchase events from its checkout to an advertising platform, including email addresses in hashed form, with no notice describing this sharing.

Fix. List every tracking tool, the data it receives, the purpose and the recipient. Decide the basis for each one with your legal adviser. Where consent is the basis, give the customer a real choice and a way to change it later.

Technical work. Configure tags so optional tracking loads only after the relevant choice is made, and log the choice.

4. Sharing customer data with many third-party vendors

What goes wrong. Customer data flows to the payment gateway, courier, CRM, email tool, advertising networks and support software, but nobody keeps a current list.

Why it is a risk. Under the Act, the Data Fiduciary remains accountable for how processors handle data on its behalf. An unmanaged vendor is an unmanaged risk.

Example. A support tool stores full order histories for every customer, though support staff only need the last order.

Fix. Maintain a vendor inventory with the data each vendor receives, its purpose and its access. Put processing terms in writing, and limit what each vendor can see.

Technical work. Use role-based permissions in each tool, and remove unused integrations.

5. Collecting excessive personal information at checkout

What goes wrong. The checkout asks for date of birth, gender, household income or a second phone number that the order does not need.

Why it is a risk. Collecting more data than a stated purpose requires conflicts with the principle that data should be limited to what is needed. It also increases the damage if a breach occurs.

Example. A home goods store asks for date of birth on every order, although no product or delivery step depends on it.

Fix. Review each checkout field. Keep only what the order, delivery, payment and legal record-keeping require. Make optional fields clearly optional.

Technical work. Remove fields from the form and the database schema, and stop sending the removed fields to downstream tools.

6. Using customer phone numbers for WhatsApp and SMS marketing without proper consent

What goes wrong. A number given for delivery updates is later used to send promotional WhatsApp messages.

Why it is a risk. A number collected for one purpose cannot automatically serve another. Promotional messages need their own basis and an easy way to stop.

Example. A customer gives a mobile number for courier updates. Weeks later, the store starts sending festival offers to the same number.

Fix. Separate transactional messages (order status, delivery) from promotional messages. Request consent for the promotional channel, and provide an opt-out in every message.

Technical work. Tag each number with its consent status and purpose, and stop promotional sends when the status is withdrawn. Check the rules of your messaging provider as well.

7. Keeping customer data after it is no longer needed

What goes wrong. Customer records, abandoned carts, support tickets and marketing lists are kept indefinitely because nobody set a schedule.

Why it is a risk. Under the Act, data should generally be erased when the purpose for which it was collected is no longer served, unless retention is required by law. Indefinite retention also increases breach exposure.

Example. A store still holds the personal details of guests who placed one order five years ago and never returned.

Fix. Set a retention period for each category of data, based on the purpose and any legal retention obligations. Document the exceptions. Confirm the specific periods with a lawyer.

Technical work. Build scheduled deletion or anonymization jobs, and include backups and processor copies in the plan.

8. Having a privacy policy that does not match actual practices

What goes wrong. The store copies a generic privacy policy from another website. It does not name the tools it uses, the data it shares, or how customers can withdraw consent.

Why it is a risk. A notice must describe the processing that really happens. A generic policy describes a business that may not exist.

Example. The policy says the store does not share data with third parties, while the website sends data to four advertising and analytics services.

Fix. Rewrite the notice from your data inventory. It should state the categories of personal data, the purposes, the way data is used, who receives it, how long it is kept, how to withdraw consent, and how to raise a grievance.

Technical work. Version the notice, show it at the relevant collection points, and keep a record of which version each customer saw.

9. Failing to handle customer requests for access, correction and erasure

What goes wrong. Customer emails about data requests go to a general inbox and sit unanswered. Nobody knows which systems hold the person's data.

Why it is a risk. The Act gives Data Principals rights, including access, correction and erasure, along with grievance redressal. Businesses need a documented process to respond within the timelines set by the Rules.

Example. A customer asks for their data to be deleted. The store deletes the account but leaves the email list, the CRM and the support system unchanged.

Fix. Create a request workflow with identity verification, internal routing, deadlines, a response log and a checklist of systems to update.

Technical work. Maintain a system map so that requests can reach every place the data is stored.

10. Ignoring security risks across e-commerce platforms and integrations

What goes wrong. Admin accounts are shared among staff. API keys sit in plain text. Old plugins are not updated. Vendors have more access than they need. Logs are not reviewed.

Why it is a risk. The schedule lists a penalty category for failing to take reasonable security safeguards to prevent a personal data breach. Weak access controls, unpatched software and poor monitoring are common routes to breaches on e-commerce platforms.

Example. A former employee's shared admin login still works on the store's platform, and nobody knows who used it last.

Fix. Assign individual accounts, enforce multi-factor authentication for admins, restrict vendor permissions, patch plugins on a schedule, and monitor logs for unusual access.

Technical work. Set up role-based access, secrets management for API keys, vulnerability scanning, backups and an incident response plan.

How to tell whether your e-commerce website has a DPDP compliance problem

Use the questions below as an initial internal review. The checklist is an indicative business tool. It is not a legal certification or a regulatory risk determination.

• Does your website give a privacy notice before or at the point where personal data is collected?
• Can you show valid consent wherever consent is your basis for processing?
• Are marketing permissions separate from the activities needed to process an order?
• Do you keep records of consent and of withdrawal?
• Have you mapped customer data across every system?
• Do you know which third parties receive customer information?
• Are vendor responsibilities written down?
• Do you have a retention and deletion policy?
• Can customers exercise their rights, and can you track each request?
• Is there a documented process for responding to a personal data breach?

Score your answers, then use this table to choose the next step.

Step-by-step implementation plan

The steps below are a practical sequence. Legal interpretation for your business should come from a qualified lawyer.

Step 1: Conduct a DPDP compliance gap assessment

Review your website forms, mobile app, backend databases, marketing tools, privacy notice, vendor contracts and internal policies. Record what you find, then rank the gaps by risk.

Step 2: Map every customer data collection point

Build a data inventory. For each collection point, record the source, data category, purpose, system, access, sharing and retention period. A sample for one checkout is shown below.

Step 3: Review and redesign consent management

Where consent is your basis, implement purpose-specific consent with a clear notice, separate optional marketing choices, a way to withdraw consent that is as easy as giving it, and timestamps with an audit trail. Remember that consent is one lawful basis among several. Assess the other grounds and any statutory exceptions for each activity.

Step 4: Put a DPDP-appropriate tracking strategy in place

Audit every tracking technology, identify each data recipient, and configure your consent tool so that optional tracking loads only after the customer's choice. Re-audit whenever you add a tag or campaign.

Step 5: Review third-party vendors and processor agreements

Maintain a vendor inventory. For each vendor, document the data it receives, its security expectations, its access limits and the contract terms. Reassess vendors at least when their scope changes.

Step 6: Establish data retention and deletion workflows

Set a retention period for each category of data, based on its purpose and any legal obligations. Build deletion or anonymization jobs, and include backups and vendor copies in the plan.

Step 7: Strengthen customer data security

Cover encryption in transit and at rest, role-based access, multi-factor authentication for administrators, secure API keys, logging, tested backups, vulnerability management and an incident response plan.

Step 8: Create customer rights and grievance workflows

Handle access, correction, erasure, grievance and consent withdrawal requests through one documented process, with identity checks, deadlines and a response log.

Step 9: Train employees and assign responsibilities

Name an owner for privacy in the business. Train staff who handle customer data, support and marketing on what they may collect, how to escalate incidents and whom to contact.

Step 10: Conduct periodic compliance reviews

Review the program whenever you change the website, add an integration, sign a new vendor, run a new campaign or change your retention rules. Review consent records and security controls on a fixed schedule.

Real-world example: how a growing D2C brand could fix its gaps

The following scenario is hypothetical. It does not describe a real client or a verified case study.

Imagine an Indian D2C brand running a Shopify store. It collects names, phone numbers, email addresses, shipping addresses and order details. It also uses Google Analytics, Meta Pixel, WhatsApp marketing, a CRM, an email automation tool, a payment gateway and a delivery platform.

Five likely gaps and fixes:

What happens if an e-commerce business suffers a personal data breach?

A breach is an incident that compromises personal data. Your response should begin with detection: monitoring that spots unusual access, a clear way for staff to report suspicions, and a log of each incident.

Next, assess the incident. Identify what data was involved, how many people may be affected, and whether the risk to them is serious. Record the decisions you make, including the reasons for them.

Under the Act, the Data Fiduciary must notify the Data Protection Board and each affected Data Principal in the manner the Act and Rules prescribe. The Rules set the procedure and the timelines. Do not rely on a general deadline from memory or from a blog post. Read the notification requirements in the official Rules, and build your response plan around the exact wording.

Keep an up-to-date incident response plan, a contact list, an escalation path and a record of past incidents. Test the plan with your team before you need it.

DPDP compliance checklist for e-commerce websites

Use this list for an initial internal review. Mark each item as done, in progress or not started.

Website privacy and transparency

• Privacy notice is available at each collection point
• Notice describes actual data, purposes, sharing and retention
• Notice explains how to withdraw consent and raise a grievance

Consent management

• Marketing consent is separate and unticked by default
• Consent purpose and notice version are recorded with a timestamp
• Withdrawal works as easily as giving consent

Cookies and tracking

• Every tracking tool is listed with its purpose and recipient
• Optional tracking loads only after the relevant choice
• Tags are re-audited when campaigns change

Customer data collection

• Each form field has a documented purpose
• Optional fields are clearly optional
• No data is collected "just in case"

Third-party integrations

• Vendor inventory is current
• Processing terms are documented for each vendor
• Vendor access is limited to what each vendor needs

Data retention and deletion

• Retention periods are set for each data category
• Deletion or anonymization jobs run on schedule
• Backups and vendor copies are covered

Customer rights and grievances

• One documented process handles all requests
• Requests are logged with deadlines and outcomes
• Deletion requests reach every system that holds the data

Security safeguards

• Individual admin accounts with multi-factor authentication
• API keys stored in a secrets manager, not in code
• Plugins and platform software patched on a schedule
• Logs reviewed for unusual access

Breach response

• Written incident response plan with named owners
• Notification steps follow the official Rules
• Plan tested with the team at least once a year

Employee training and governance

• Privacy owner named for the business
• Staff who handle customer data are trained
• Compliance review scheduled periodically

How Cor Advance Solutions helps e-commerce businesses implement DPDP compliance

Cor Advance Solutions works with e-commerce businesses on the practical side of DPDP compliance: the forms, tags, integrations, databases and internal processes that customer data passes through. Our services include:

• DPDP compliance gap assessment. We identify gaps across website forms, applications, databases, marketing systems and internal processes.
• Data mapping and records of processing. We document where customer data is collected, processed, stored, accessed and shared.
• Consent management implementation. We help design consent workflows, preference management, consent records and withdrawal mechanisms.
• Processor agreements. We help review and structure data processing agreements and vendor responsibilities.
• DPO-as-a-Service. Ongoing compliance coordination and privacy governance support, where it suits your business.
• Staff training and awareness. We help employees understand how to handle customer data, their privacy responsibilities and how to escalate incidents.

Our engagement follows these stages: an initial business consultation, a DPDP compliance gap assessment, data mapping and risk prioritization, an implementation roadmap, technical and operational remediation, documentation and staff training, and ongoing compliance monitoring.

Is your e-commerce website DPDP-ready? Don't wait for a customer complaint, a security incident or a compliance review to expose gaps in your data protection practices. Get a professional assessment of your customer data collection, consent workflows, third-party integrations and security safeguards.

Request your DPDP compliance assessment

You can also contact our team to discuss your store, your tools and your timeline.

Frequently asked questions

Can an e-commerce website face a ₹250 crore DPDP penalty? The ₹250 crore figure is the maximum penalty in the Act's schedule for failing to take reasonable security safeguards to prevent a personal data breach. It is not an automatic fine for every violation. The Data Protection Board decides any penalty after an inquiry, based on the facts of the case.

Does the DPDP Act apply to Shopify and WooCommerce websites in India? The platform is not what matters. The Act applies to the business that decides how personal data is processed, and it covers processing of digital personal data within India. It can also reach processing outside India when it relates to offering goods or services to people in India. Your legal adviser should confirm the scope for your business.

Is a privacy policy enough to make an e-commerce website DPDP-compliant? No. A privacy policy is one part of compliance. It must match what your website actually does. You also need valid consent or another lawful basis, vendor management, retention rules, security safeguards and a way for customers to exercise their rights.

Do e-commerce websites need customer consent for marketing emails and WhatsApp messages? Where consent is the basis for marketing, yes, and the consent must be specific and clearly given. Transactional messages about an order may rely on other grounds. Assess each message type separately with your legal adviser.

Does the DPDP Act require cookie consent on every e-commerce website? The Act does not single out cookies. What matters is whether the tracking processes personal data, and on what lawful basis. Some tracking may need consent and some may rely on another ground. Map each tool before deciding.

Can businesses use customer phone numbers for promotional messages after collecting them during checkout? Not automatically. A number collected for delivery updates serves that purpose. Using it for promotions needs its own basis, normally consent for that purpose, and an easy way to opt out.

What should an e-commerce company do if a customer requests data deletion? Verify the request, find every system that holds the customer's data, and delete or anonymize it where the law requires or the purpose no longer applies. Keep a record of the request and the outcome. Check whether any legal retention obligation applies before you delete.

Are e-commerce companies responsible for customer data shared with third-party vendors? Yes, the Data Fiduciary remains accountable for data it shares. Vendors are processors, but the business must choose them carefully, document their responsibilities and limit their access.

How long does DPDP compliance implementation take? It depends on the number of systems, the number of tracking tools, how clean the existing data is and how many vendors are involved. A focused gap assessment can be completed first, and remediation then follows in phases. We set timelines after the assessment.

How can a business get a DPDP compliance assessment? Contact our team through the assessment page or the contact page. We start with a short business consultation, then review your forms, tools, vendors and processes before recommending next steps.

Conclusion: Don't let customer data become your biggest compliance risk

Customer data runs through every part of an e-commerce business, from the checkout form to the advertising pixel to the courier's app. DPDP compliance starts with knowing where that data goes, why it is collected, on what basis, who receives it, how long it is kept and how it is protected.

Compliance is not a one-time legal exercise. It is an ongoing responsibility shared by the business, its technology team and its governance processes. The sooner you map your data and fix the most serious gaps, the more control you will have when customers, partners or regulators ask questions.

If you want a business-specific view, contact Cor Advance Solutions for a DPDP compliance assessment of your store.

This article gives general information, not legal advice. Confirm legal interpretations and commencement dates against the official Act, Rules and Gazette notifications, and seek qualified legal review for your business.