Overview
Flipkart is India’s largest e-commerce marketplace, handling personal data of over 400 million registered users. The volume and sensitivity of data processed — including addresses, payment information, and purchase history — makes DPDP compliance a top priority.
DPDP Readiness Assessment
Section 4: Consent & Notice 🔴
Flipkart’s consent mechanism is bundled within the Terms of Use — users cannot selectively accept or reject specific data processing activities. Under DPDP Section 4, consent must be free, specific, informed, and unconditional. Bundled consent is non-compliant.
Section 5: Lawful Purpose ⚠️
The policy lists multiple purposes for data processing, but several (such as “improving services” and “personalization”) are vaguely defined. DPDP requires each purpose to be clearly specified at the time of consent.
Section 6: Right to Withdraw Consent 🔴
While users can delete their account, there is no granular mechanism to withdraw consent for specific processing activities while maintaining the account. This is a clear gap under Section 6.
Section 8: Data Security ✅
Flipkart maintains industry-standard security measures. As a Walmart subsidiary, it benefits from enterprise-grade security infrastructure.
Section 11: Data Principal Rights ⚠️
The policy provides for data access and deletion but lacks provisions for data correction, nomination rights, and a clear timeline for responding to data access requests as required by DPDP.
Section 17: Cross-Border Transfer ⚠️
Given Walmart’s global presence, data is likely transferred internationally. The policy does not specify which jurisdictions receive data or whether they are on the approved list.
Recommendations
- Unbundle consent from Terms of Use — implement granular consent
- Define specific purposes with clear descriptions for each data use
- Implement granular consent withdrawal without requiring account deletion
- Publish data retention schedule with specific timelines per data category
- Restrict third-party sharing with clear justifications and named parties
- Establish Data Principal rights portal with response timeline commitments
Risk Assessment
| Risk Category | Level | Impact |
|---|---|---|
| Regulatory fine risk | High | Up to ₹250 Cr — massive user base increases scrutiny |
| Customer trust impact | Medium | Privacy-conscious segment growing |
| Operational readiness | Medium-High | Significant policy + technology updates needed |