DPDP Rules 2025 for D2C Brands and Marketplace Sellers: What You Must Do With Customer Data

The Digital Personal Data Protection Rules, 2025 tell a business how to give notice, take consent, protect data, report a breach, erase data and answer customers. For most e-commerce brands the main duties apply from 13 May 2027, eighteen months after the Rules were published on 13 November 2025. This guide turns them into tasks for a D2C brand and a marketplace seller. It is general information, not legal advice; confirm with a lawyer.

Does the law apply to a small online seller?

The Rules apply to a "Data Fiduciary", the person who decides why and how personal data is processed. A D2C store that takes name, phone, address and email at checkout decides those things, so it is a fiduciary. We read the notified Rules for the duties below; the definition itself sits in the Act, which we did not use to settle edge cases. There is no turnover or size threshold in the Rule provisions we read. Two things in the Rules do depend on size: the Third Schedule erasure rule for e-commerce entities with at least two crore registered users, and the extra duties for notified significant data fiduciaries.

Which parts apply to a marketplace seller is less settled. The marketplace holds the buyer account. You receive the name and address to ship the order. Treat that as personal data you must secure, use for fulfilment and not push into your own marketing list without a lawful basis. Ask a lawyer how far the platform's notice covers you.

What does a valid privacy notice need?

Rule 3 requires the notice to be clear and plain, to itemise the personal data and to state the specific purpose and the goods or services or uses it enables. It must also give a link to the website or app and describe how the person can withdraw consent, exercise their rights and complain to the Board. Withdrawal must be as easy as giving consent.

For a Shopify or custom store, that means:

• one notice at checkout and sign-up, not a buried policy page;
• separate lines for order fulfilment, marketing messages and ad retargeting;
• an unsubscribe and "delete my data" route as visible as the sign-up form.

The Rules are also said not to apply retrospectively to consent already obtained. Old consent you cannot evidence is still a weak position.

What security does the law expect?

Rule 6 lists minimum safeguards: encryption, masking or tokens; access control; logs and monitoring; backups; retaining logs and personal data for one year to investigate unauthorised access; and security terms in contracts with data processors. For a brand that means checking who has admin access to your store, CRM and Google Sheets exports, turning on two-step login, and reading your courier, payment and agency contracts for security clauses.

How fast must I report a breach?

Rule 7 has two steps. Tell each affected person without delay, in plain language, through their account or registered contact, with what happened, likely consequences, steps taken and what they can do. Tell the Board without delay, then send updated and detailed information within 72 hours of becoming aware, or a longer period the Board allows in writing. Write the routine now: who decides it is a breach, who contacts customers, who contacts the Board.

How long do I keep customer and order data?

Two Rule 8 clocks matter.

1. Minimum retention. Keep the personal data, traffic data and logs of any processing for at least one year from the date of processing, for the purposes in the Seventh Schedule, then erase unless another law requires longer. The Rule's own illustration says an e-book platform must retain order details and logs for at least one year even if the customer deletes the account.
2. Erasure for large platforms. An e-commerce entity with at least two crore registered users must erase data three years after the person last approached it, with 48 hours' notice.

Other laws, such as GST record-keeping, can require longer retention, so do not delete invoices because of this Rule. The Rule itself carves out data needed to comply with another law.

What must I tell customers about their rights?

Rule 14 requires you to publish how a person can make a request to exercise their rights and what identifier you need. It also requires a grievance redressal system that responds within a reasonable period not exceeding 90 days. Rule 9 requires you to prominently publish the business contact of the Data Protection Officer, if applicable, or of a person who can answer questions about processing. A support email and a named owner are the minimum.

What about children and kids' products?

Rule 10 requires verifiable consent of a parent before processing a child's personal data. A compliance review adds that section 9(3) of the Act bars tracking and targeted advertising aimed at children, so ad pixels and profiling should be off for accounts flagged under 18. A toy or school-supplies brand that sells to parents is less exposed than an app used directly by teenagers, but test the flow either way.

Does sending data abroad matter?

Rule 15 allows transfer outside India subject to requirements the Central Government may set by order for making data available to a foreign State or its agencies. We did not find a general ban for ordinary businesses. If your CRM, email tool or analytics runs abroad, keep a register of what goes where so you can adjust if an order is issued.

How does this connect to the other 2027 rules?

Three rule sets reach the same checkout in 2027. The Consumer Protection (E-Commerce) (Amendment) Rules, 2026 start on 1 January 2027 and restrict how marketplace entities use consumer information without express and affirmative consent; see our E-Commerce Amendment Rules guide. The same amendment brings in a yearly dark-pattern audit, covered in our dark patterns guide for sellers. The DPDP duties follow on 13 May 2027. Our compliance calendar lists all the dates in one place, so one consent flow can be designed once.

What are the penalties?

The Act's Schedule sets maximums of ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to notify a breach, ₹200 crore for breaching children's obligations and ₹50 crore for breach of any other provision. Commentary says no penalty can be imposed before 13 May 2027. The dates are in our DPDP compliance timeline.

FAQ

Do I need a Data Protection Officer? Rule 9 asks you to publish the contact of the Data Protection Officer, if applicable, or of a person who can answer questions about processing. A named person is enough for most small brands. An India-based DPO is a duty for notified significant data fiduciaries, per the commentary we read.

Can I keep emailing customers who bought from me? Only for the purposes in your notice and with consent that can be withdrawn as easily as it was given. Keep order updates separate from marketing, and honour unsubscribes at once.

Does the law apply to data I get from Amazon or Flipkart? The buyer name and address you receive for shipping is personal data. Use it for fulfilment, protect it, and do not load it into your own marketing tools unless you have a basis. Check the platform's seller terms as well.

Do I have to delete data when a customer asks? Rights requests must be handled through your grievance route within 90 days. You may keep data that other law or the one-year retention rule requires, so erase what you can and tell the customer what you must keep.

What if my agency or courier leaks customer data? You are responsible for processing done on your behalf by a data processor under Rule 6, and the contract must carry security terms. Ask partners for their breach procedure now.

Is a cookie banner enough? No. The Rules require an itemised notice with specific purposes and an easy way to withdraw consent. A banner may be one part of that, not the whole.

Where Blooprint fits

Data protection is a legal and engineering job, so begin with your lawyer and your tech lead. Blooprint, a Bengaluru e-commerce agency, handles marketplace catalogues and listings; our catalogue and listing optimisation service is the link if you need that side tidied before the 2027 changes.