DPDP Act for Indian e-commerce and D2C brands

What valid consent looks like under the DPDP Act

Section 6 of the DPDP Act is unusually specific about consent. It must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited strictly to the personal data necessary for the stated purpose. Bundled consent — one checkbox covering analytics, advertising, marketing email and profiling — does not satisfy this test.

The Act also requires that withdrawal be as easy as giving consent. In practice that means if a visitor could accept tracking with one click on a banner, they must be able to withdraw it with roughly one click too, at any time, from any page. A buried link in a privacy policy is not equivalent.

• No pre-ticked boxes and no implied consent from continued browsing
• Separate opt-in per purpose: analytics, marketing, functional, advertising
• A notice, in plain language, available in English and the Eighth Schedule languages
• A standing, always-reachable way to withdraw consent
• A record of what was consented to, when, and against which notice version

Marketing consent is separate from transactional contact

You may contact a customer about the order they placed — that is processing for the purpose the data was given. You may not, on the same basis, add them to a promotional broadcast list. The purpose limitation in Section 6 makes that a different purpose requiring its own consent.

The practical implication for a D2C brand is that checkout needs an unticked, clearly worded marketing opt-in that is not a condition of purchase, and your ESP needs to store which customers gave it and when.

Retargeting pixels are the audit finding you will get first

In our scans of Indian storefronts, the single most common failure is a Meta Pixel firing on page load before any consent decision exists. It is also the easiest to fix: categorise the pixel as marketing in AssentRepo and it will not execute until the visitor opts in.

Data Principal rights and the request queue

Chapter III of the Act gives every Data Principal the right to access a summary of their personal data and the processing performed, the right to correction and completion, the right to erasure, and the right to nominate someone to exercise those rights on their behalf. You must publish a way to make those requests and you must respond within a reasonable period.

For a small team, the failure mode is not refusing a request — it is losing one. Requests arrive by email, WhatsApp, a contact form and Instagram DM, and nobody owns the spreadsheet. A single intake endpoint with an auditable status trail removes that risk entirely, which is why the AssentRepo banner ships a built-in DSAR form alongside the cookie controls.

You have to be able to prove it

The obligation that catches most teams out is evidentiary. Under Section 8, the Data Fiduciary — you — is responsible for demonstrating compliance, including that valid consent was obtained. If the Board asks and your answer is "our banner was live", that is not evidence.

A defensible consent record contains, at minimum: a stable visitor identifier, the categories accepted and rejected, a UTC timestamp, the version of the notice shown, the policy text hash, and enough network context to establish the request was genuine without storing raw personal identifiers. AssentRepo writes exactly this record for every consent event and one-way hashes the IP address with a server-side salt, so the log is useful to an auditor and useless to an attacker.

Frequently asked questions