DPDP consent guide for D2C brands.
Under India's DPDP Act, a D2C brand needs a clear notice and the customer's real, specific consent before using personal data for anything beyond the order itself, and it must be able to prove that consent and let customers withdraw it easily. Most duties start on 13 May 2027, so the next months are for getting set up, not for panicking.
This guide is general information, not legal advice. Check your own situation with a lawyer.
Where a D2C brand collects personal data
Most stores collect more than they notice:
- Checkout: name, phone, email, address, payment details (through your gateway)
- Newsletter and discount pop-ups
- WhatsApp, SMS and email opt-ins
- Account sign-up, wishlists and loyalty programmes
- Reviews and customer support chats
- Ad pixels and analytics (Meta, Google and similar) that follow visitors across pages
- Delivery partners, payment gateways and email tools that receive the data from you
What counts as valid consent
The Act asks for consent that is free, specific, informed, unconditional and unambiguous, given by a clear action. In plain terms:
- Ask in plain language, before you collect, and say what you will use the data for.
- One purpose, one choice. A single "I agree to everything" tick for marketing, analytics and sharing is the kind of thing to avoid.
- No pre-ticked boxes and no making the service depend on unrelated consent.
- Make withdrawal as easy as giving consent. If a customer agreed in one click, they should be able to withdraw in one click.
- Name a grievance contact and tell customers how to use their rights.
Not everything needs a consent tick
The Act also allows processing for certain "legitimate uses", for example when a customer gives you their details voluntarily to complete a purchase and you use them for that purpose. Marketing messages, profiling for ads and sharing data with ad platforms are different. Treat those as needing consent.
The D2C checklist
- 1List every place your store collects data (use the list above)
- 2Write a short notice in plain language for each, and link your privacy policy
- 3Put a consent banner on your site that blocks ad and analytics trackers until the visitor chooses
- 4Keep a record of each consent and each withdrawal, with the time
- 5Make a visible way for customers to ask for access, correction or deletion
- 6Name a grievance contact and publish it
- 7List the vendors that receive your customers' data
- 8Write down what you will do if there is a data breach, and who does it
- 9If you knowingly serve under-18s, plan for verifiable parental consent
What happens if you get it wrong
The Act sets penalties of up to ₹250 crore, the highest for failing to keep reasonable security safeguards. For a small brand, the more likely problems are customer complaints and lost trust, so a tidy process matters long before a penalty does.
How Foxinel helps
Foxinel is a consent management platform. It gives you the banner, the consent records, the rights-request queue, the vendor list and the breach log in one place. It does not replace legal advice and does not by itself make a business compliant.
