DPDPA readiness for e-commerce businesses.
E-commerce businesses collect personal data at high volume and high frequency — every browse, cart, and order — and pass a meaningful share of it to delivery, payment, and marketing partners before a single order is even fulfilled. Readiness work usually starts with tracing that full chain.
What personal data typically looks like here
Where this usually creates the most work
Consent for marketing, separate from order-related contact
A customer's phone number and email are needed to fulfil their order — that's not the same basis as using them for promotional messages. The two need separate, clear consent, not one blanket checkbox at checkout.
A delivery and logistics chain that changes with every order
Address and contact details pass to delivery partners, and sometimes to sellers on a marketplace model, for every order. Knowing who currently has access to that data, not just who had it at launch, is the harder part as the partner list grows.
Vendor review checklistBrowsing and behavioural data used for personalisation
Recommendation engines and retargeting rely on tracking behaviour across sessions. That's a real processing activity worth documenting on its own, with its own notice, not folded silently into a generic privacy policy.
Deletion requests against an active order or return window
A customer's right to erasure runs up against a live order, an open return, or a fraud-prevention hold. Deciding in advance which categories can be deleted immediately and which need to wait is easier than working it out mid-request.
Other industries
Readiness work looks different depending on how your organisation uses personal data.
See where your organisation stands.
Ten minutes, no legal jargon, no commitment.