Sector reference
DPDP for E-Commerce and Quick Commerce
- What is processed
- Name, address, contact and order information, where the shop genuinely needs it to get your order to you, or for another purpose it has stated.
Why it is allowed, and when
Where a shop relies on your agreement, that agreement is limited to what the stated purpose actually needs, and where a company handles the data on the shop's behalf rather than for its own ends, the shop has to have a proper contract with it. On top of that, the largest platforms are put on a dormancy clock. For an online shop with at least two crore registered users in India, three years run from whichever came last: your last approach, the last time you exercised a right, or the day the Rules commenced. Online gaming intermediaries with fifty lakh users, and social media intermediaries with two crore, are on the same clock. That clock is written for a defined kind of business, an e-commerce entity, rather than for everyone who sells something online.
Where the permission stops
When that clock runs out the platform has to erase, unless a law requires it to keep something, and keeping your account reachable or a stored token is carved out. It is a trigger to delete for large platforms, not a rule that anyone must keep data for three years, and below the threshold it does not apply at all. A separate rule runs the other way. Personal data, the traffic data that goes with it, and the records of what was done have to be kept for at least a year, so that the purposes the Rules list can be met. We read that second rule as reaching organisations of every size, and we say so because the Rules illustrate it with an ordinary e-book purchase, where the platform must keep the order details and logs for a year even after the customer deletes her account. Some readers take it more narrowly, on the basis that the listed purposes are mostly State ones. On our reading the two rules have to be reconciled record by record, because deleting too early is as much a failure as keeping too long.
Questions people actually ask
Does an online store have to delete my data if I stop using it?
It depends how big the platform is. A store with at least two crore registered users in India is on a three year clock. It has to delete your information three years after whichever came last: your last visit for the thing you signed up for, the last time you exercised a right, or the day the Rules commenced. Keeping your account usable, and any stored voucher or token, is carved out, and anything a law requires it to keep still stays.
That clock is written for a defined kind of business, an e-commerce entity, rather than for everyone who sells something online. An individual seller listing goods on somebody else's marketplace is not the entity being counted.
Below that size there is no clock, but the ordinary duty still applies to everyone. Delete once you withdraw your agreement, or once it is fair to say the reason for holding it has ended, whichever comes first.
On the platforms that clock does cover, you should also get a warning. They have to tell you at least forty eight hours before that scheduled deletion, so you can log in and keep the account alive if you want to. That notice belongs to this three year rule. It is not a general right to be warned before any company deletes anything.
If I give my phone number for delivery, did I also agree to marketing?
No. Handing over a number so a parcel can reach you is not agreement to be marketed at. Where a company is relying on your agreement, it has to be specific to the thing they actually asked about.
If I delete my account, do they still keep my old order history?
They can only keep it while a live reason remains, or where a law requires it. The test is whether the reason they collected it for is still being served, not the act of deleting itself.
Deleting your account is strong evidence that the reason has ended, so anything held on to after that needs a real justification rather than habit. It is not conclusive, though. A pending refund, a warranty, or a tax record a law requires them to hold can each survive the account.
Can they use my delivery address for showing me ads on other platforms?
Only with a fresh and specific agreement from you for exactly that. Giving an address so a parcel arrives does not carry over into being advertised to across other platforms.
What happens to my data if the company is acquired?
A court approved merger, demerger or transfer of a business gets special treatment. For the transaction itself, most of the usual rules are switched off, including the limits on what your data may be used for, and your rights.
Two things survive. The company stays responsible for complying with the law, and it still has to take reasonable security precautions to prevent a breach.
It is also temporary. Once the deal is done, whatever the new owner goes on to do with your information is back under the ordinary rules.
If I withdraw my consent, do I lose the app?
You can lose the part that depended on your agreement, and the Act says so in its own example. If you withdraw, the shop may stop letting you place new orders.
What it may not do is walk away from what you have already paid for. Processing needed to supply goods you have already ordered and paid for carries on regardless.
Withdrawing also has to be as easy as agreeing was, and once you do, the shop has to stop and make its vendors stop too.
The delivery agent can see my name, address and phone number. Is that allowed?
Yes, for the delivery. That is what you gave the details for, and getting a parcel to you needs somebody to know where you are.
The limit is that it stays with the delivery. Keeping your number afterwards, saving it personally, or using it to contact you about anything else is outside the reason it was handed over.
The platform stays answerable for what the people doing the work on its behalf do with your details. It cannot treat that as the agent's problem.
I deleted the app months ago and still get their marketing messages. Is that allowed?
Not without a reason that still stands. Marketing is not one of the situations where the law lets an organisation act without asking, so it runs on your agreement. Deleting the app and going quiet is strong evidence the reason has ended.
On the largest platforms, the ones the three year rule covers, there is also an outer limit of three years and a warning at least forty eight hours before that scheduled deletion. Neither applies to a small shop.
Whichever applies, what you should have is a way to say stop that is as easy as signing up was.
What people get wrong
DPDP requires us to keep your data for three years.
It does not. The three year period is a dormancy trigger, and it applies only to online shops with two crore or more registered users in India, gaming intermediaries with fifty lakh or more, and social media intermediaries with two crore or more. It is the point at which those platforms must erase, not a duty on anyone to retain.
We cannot delete your account because of the data protection law.
The law points the other way. Erase once you withdraw your agreement, or once the reason for holding it has gone, whichever comes first, unless another law requires it to be kept. This is a reason to delete, not an excuse to keep.
You gave your number for delivery, so you agreed to our offers.
Agreement has to be specific to the purpose it was given for. A number handed over so a courier can find you is not agreement to a marketing list.
The company was acquired, so your old consents and rights start again.
For a court approved deal, the exemption covers the transaction itself, and even then the company stays responsible for complying and still has to keep the data secure. Once it is done, the new owner's ongoing use is fully back under the ordinary rules.
Related questions
- How long can I keep personal data?
- Can I send marketing emails under DPDP?
- What rights do people have under DPDP?
- Can I use pre ticked consent boxes?
This sector sits inside the full Sector Reference, which covers 26 sectors and 160 questions. To work through your own organisation rather than the general case, the Template Builder starts from your answers.