Overview
Pepperfry is one of India’s largest online furniture retailers. To sell you a sofa or a lamp, they collect a lot of personal info: your home address, phone number, GPS location, and even your tax details if you’re a business seller.
As a Data Fiduciary (the company that decides why and how your data is used), Pepperfry is responsible for keeping this data safe. As the Data Principal (the person the data belongs to), you have new rights under the DPDP Act that this policy doesn’t quite acknowledge yet.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Consent & Notice 🔴
Pepperfry uses “bundled” and “implied” consent, which is a big no-no under the new law. They assume that if you are on the website, you’ve already agreed to everything.
What the policy says: “Personal Information of a User(s) is collected if the User(s) registers… accesses the Website or take any action on the Website.”
What the law requires: Consent must be affirmative. This means you have to click a button that says “I agree” specifically for data processing. Simply “accessing” a site isn’t consent anymore.
The problem: Under Section 6, consent must be specific and clear. Pepperfry bundles marketing, shipping, and “internal analytics” into one giant bucket. You can’t say “yes to shipping” but “no to marketing” easily at the start.
Section 7 — Certain Legitimate Uses ⚠️
The policy claims they collect data for “lawful purposes” related to their business functions.
What the policy says: “You understand, agree and acknowledge that our collection… is for a lawful purpose connected with a function or activity of the Platform.”
What the law requires: The DPDP Act replaced “lawful purpose” with Certain Legitimate Uses. This is a much narrower list, such as medical emergencies or government functions.
The problem: Pepperfry is still using the old, broad language from the 2011 rules. They cannot claim “legitimate use” for marketing or tracking your behavior; they must get your explicit consent for those things now.
Section 8 — Obligations of Data Fiduciary ⚠️
Pepperfry promises to try their best, but the law now demands a higher standard.
What the policy says: “We will ensure on reasonable commercial efforts basis that the third parties… are under an obligation to maintain confidentiality.”
What the law requires: The Data Fiduciary (Pepperfry) is responsible for any data breach, even if it happens at their partner’s end (like a delivery company).
The problem: Using words like “reasonable commercial efforts” is a legal shield. The DPDP Act doesn’t care about “efforts”—it mandates that you must protect data, or face fines up to ₹250 crore.
Section 9 — Data Retention 🔴
This is a major gap. The policy doesn’t tell you how long they keep your data.
What the policy says: It mentions you can ask for deletion, but it doesn’t say how long they keep it if you don’t ask.
What the law requires: Data must be deleted as soon as the purpose is fulfilled. If you bought a bed three years ago and haven’t logged in since, Pepperfry technically shouldn’t be holding onto your home address anymore.
The problem: Without a clear retention policy, your data sits in their servers forever, increasing your risk if they ever get hacked.
Section 11 — Rights of Data Principal ⚠️
The DPDP Act gives you four “superpowers,” but Pepperfry only mentions one and a half.
The gaps:
- Right to Nominate: You can’t currently tell Pepperfry who should manage your account if something happens to you.
- Right to Withdraw: While they mention “opting out” of emails, they don’t provide a clear way to withdraw consent for all processing without deleting your account entirely.
Section 12 — Right of Grievance Redressal ⚠️
They have a Grievance Officer, which is good, but the rules they follow are out of date.
What the policy says: It explicitly cites the “IT Rules, 2011.”
The problem: Those rules are being replaced by the DPDP Act. The policy fails to mention that if the Grievance Officer doesn’t help you, you have the right to complain to the Data Protection Board of India.
Section 16 — Cross-Border Data Transfer ⚠️
What the policy says: “Your information may be transferred to… computers… located outside of your state or country.”
The problem: The DPDP Act says the government will create a “restricted list” of countries where data cannot go. Pepperfry’s policy is too vague; it doesn’t specify which countries your data might end up in or how they protect it once it leaves India.
Risk Assessment
| Category | Risk Level | Potential Impact |
|---|---|---|
| Consent Validity | High | Bundled/implied consent is invalid under DPDP; could stop data use. |
| Old Law Reliance | High | Referencing the IT Act 2000 instead of DPDP Act 2023 shows non-compliance. |
| Data Retention | Medium | Keeping data indefinitely increases liability during a breach. |
| User Rights | Medium | Lack of nomination and easy withdrawal features. |
Recommendations
- Update the Legal Framework: Immediately remove references to the “IT Rules 2011” and replace them with the DPDP Act 2023.
- Unbundle Consent: Give users checkboxes. Let them agree to “Delivery” (essential) but opt-in to “Marketing” (optional).
- Set a Deletion Timer: Define that if an account is inactive for 3 years, the data is automatically deleted or made anonymous.
- Modernize the Grievance Path: Add a link to the Data Protection Board and commit to acknowledging complaints faster than the old 36-hour limit.
- Add a “Notice”: Before asking for data, show a simple notice in clear language (maybe even in Hindi) explaining what is being collected and why.