For E-Commerce

Your online store is a Data Fiduciary.

If you sell to Indian customers online, the DPDP Act applies. Plus: The CCPA's 2023 dark-pattern Guidelines list 13 practices platforms must not use. Law, from 13 May 2027: e-commerce firms with 2 crore+ registered users in India follow a 3-year rule for erasing inactive users' data (Rule 8, Third Schedule).

Educational only · not legal adviceLast updated: 6 October 2026Written and edited by Sandesh Kokate

Check your DPDP role — take the check →

What applies to you

Priority order: (1) a real consent notice at checkout and signup, not a pre-ticked box, (2) audit your storefront for the 13 listed dark-pattern practices, (3) write a retention schedule — including the Third Schedule 3-year rule if you have 2 crore+ registered users, (4) confirm where your payment and buyer data is stored, (5) treat marketing messages as a separate, opt-in consent.

What matters most for you

DPDP Rules, 2025 + Third Schedule DPDP Act, 2023 G.S.R. 843(E) — phased commencement

Common situations

False urgency timers on your product pages

Good practice: remove false urgency timers. The CCPA's 2023 dark-pattern Guidelines list 13 practices platforms must not use. Primary source not yet confirmed.

Storing buyer data after account deletion

Third Schedule (Rule 8). Law, from 13 May 2027: e-commerce firms with 2 crore+ registered users erase data three years after the user's last contact. Law: smaller stores erase it once the purpose is served (Section 8(7)). Law, from 13 May 2027 (Rule 8(3)): every Data Fiduciary must also keep personal data, related traffic data and logs of the processing for at least one year from the date of processing, for the purposes in the Seventh Schedule, and then erase them unless another law requires longer. The Third Schedule three-year rule applies only to the listed classes. It has two exceptions: account access and virtual tokens.

Official text — Rule 8(3), DPDP Rules, 2025

(3) Without prejudice to sub-rules (1) and (2), a Data Fiduciary shall retain, in respect of any processing of personal data undertaken by it or on its behalf by a Data Processor, such personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing, for the purposes as specified in the Seventh Schedule, after which the Data Fiduciary shall cause such personal data and logs to be erased, unless further retention is required for compliance with any other law for the time being in force or notified by the Government.