DPDPA for online stores and retailers
Shops collect contact, payment and location data and pass it to many partners to take an order from click to delivery. The Act asks for a clear purpose for each use.
Customer journey
- 1Sign-upCONSENT
- 2CheckoutSECURITY
- 3Delivery partnersSHARING
- 4SupportRIGHTS
- 5Account closureRETENTION
Where E-commerce and retail gets hard
Marketing consent
Marketing needs its own choice, separate from placing an order.
Delivery and payment partners
Each partner that touches an order is part of your data map.
Location and device data
Location and app data need a stated purpose.
Customer lists
Old accounts and mailing lists should not live forever.
How the three stages apply
Consulting
Map data across the store, payments and partners.
See consultingImplementation
Consent at sign-up, rights requests in the account page.
See implementationGovernance
Vendor reviews and breach drills on a schedule.
See governance
E-commerce and retail questions
Marketing needs its own purpose and its own choice, so ordering from you is not agreement to marketing. We check your notices and sign-up flow.
Often, when they act on your instructions. We review each contract.
Only as long as the purpose needs it and any rule requires it. Your data map should record a limit for each data type.
With a map of data across the store, payments and delivery, then marketing consent.
Get the e-commerce checklist
One page: the duties that matter most for online retail, in order.