E-Paper
Accelerated DPDP: The e-commerce challenge
This article is authored by Arun Goyal, retired officer, Indian Administrative Service and ex-member, Central Electricity Regulatory Commission (CERC).
India’s Digital Personal Data Protection (DPDP) framework is a significant step toward strengthening privacy and accountability in the digital economy. For the e-commerce sector, the DPDP Act and Rules aim to provide clearer safeguards around the large volumes of personal data used in online retail for logistics, payments, fraud prevention, etc.
E-commerce ecosystems operate in a fast-moving data environment, where every transaction generates multiple data flows across customer accounts, sellers, warehouses, delivery partners, and payment systems. With India’s internet user base set to exceed 900 million, digital commerce is expanding rapidly across both urban and rural areas. The sector was valued at roughly $125 billion in 2024 and is expected to grow sharply by the end of the decade to $345 billion.
This growth directly translates into more personal data being generated and processed across platforms. E-commerce firms operate across hundreds of interconnected systems and manage billions of data records. Implementing DPDP obligations in this environment is not just a matter of updating policies. It requires coordinated changes across legal interpretation, data architecture, engineering workflows, user interfaces and internal governance.
Compressed timelines can have unintended effects on how organisations handle data retention and deletion. Rules governing retention beyond the original purpose require firms to identify legal obligations across areas such as taxation, payments, disputes and investigations, and then translate those obligations into clear, system-level rules. For large e-commerce platforms, these requirements apply to billions of historical records relating to users, sellers and transactions, each subject to different legal triggers for retention or deletion. Applying this level of detail across complex, interconnected systems takes time. When timelines are too short, organisations often respond by adopting conservative approaches, retaining data longer than necessary to reduce legal risk. This outcome contradicts the DPDP Act’s principles of data minimisation. It can also leave firms holding larger data sets for longer periods, increasing long-term privacy and security risks rather than reducing them.
Many DPDP obligations go well beyond policy updates or procedural fixes. They require lasting changes to how organisations operate. These include enhanced governance for significant data fiduciaries, oversight of automated decision-making, and the integration of data protection impact assessments into product and engineering decisions. All of which make DPDP more robust but, consequently, require time to rework systems and processes. It is also important to recognise that firms do not all begin from the same baseline when implementing these changes. Some organisations have operated for years in global markets with established privacy frameworks and already have mature compliance systems in place. Others, particularly domestic e-commerce firms focused on the Indian market, are building these capabilities for the first time under DPDP. Shortened timelines may therefore advantage firms with existing compliance infrastructure without necessarily improving overall data protection outcomes. In e-commerce, automated systems can shape how products are shown, how fraud is detected and how accounts are monitored, often in environments where features are updated and tested continuously. Managing these systems responsibly requires time to put clear decision-making and oversight mechanisms in place, particularly to identify errors, bias or unintended effects before they scale.
A less talked about aspect of DPDP compliance is its impact on user experience. Several obligations require changes to consent flows, notifications, grievance processes and account controls. These changes are visible to users and must be carefully designed, tested and rolled out across apps, mobile web and desktop platforms. User trust is central to e-commerce. Poorly and rushed designed interfaces can cause users to abandon transactions or stop using an app altogether. Research shows that many users disengage after a single poor experience. This is particularly important in India, where mobile devices account for roughly three-quarters of e-commerce activity and many users are still relatively new to digital services. Rushed interface updates can erode trust, cause confusion, and lead to more requests for support and grievance redressal. This weakens the objectives of the DPDP framework by making compliance less consistent and less effective in practise.
Clear timelines help organisations prioritise high-risk areas, allow regulators to set consistent expectations, and enable enforcement to focus on substantive outcomes rather than transitional gaps. Predictability also supports coordination across legal, technical, and supervisory functions, which is critical for firms in complex digital sectors.
The debate over DPDP timelines should not be seen as resistance to regulation. The real question is one of effectiveness. In data-intensive sectors such as e-commerce, privacy protections work best when they are properly built into systems, processes, and user interfaces to ensure there are no lapses when dealing with large-scale data. Timelines that reflect the practical realities are more likely to deliver consistent compliance, clearer enforcement signals and meaningful reductions in privacy risk. As India moves from rulemaking to implementation, the success of the DPDP framework will depend on how well it balances regulatory ambition with the conditions needed for sound execution.
This article is authored by Arun Goyal, retired officer, Indian Administrative Service and ex-member, Central Electricity Regulatory Commission (CERC).
