DPDP for Home Service Marketplaces
Home service platforms must protect addresses, call logs, and provider data. Learn how to manage DPDP compliance for your marketplace business.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For DPDP for Home Service Marketplaces, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Sharing Addresses with Providers
Home service platforms share precise home addresses with gig workers. This is a high-risk data transfer. You must ensure the service provider deletes the address from their phone or app immediately after the job ends. Contracts with providers must strictly forbid them from saving customer numbers for private work or future marketing.
Managing Background Check Data
You collect Aadhaar and criminal records to vet providers. This data belongs to the worker. You need a specific consent notice for providers explaining who sees their records and how long you store them. If a worker leaves your platform, you must delete their sensitive documents unless another law specifically requires you to keep them for a set time.
Call Recording and Masking
Many platforms record calls to settle disputes between customers and providers. These audio files contain personal data. You must notify both parties that the call is being recorded. You also need a policy to delete these recordings after a set number of days if no complaint is filed. Achieving full compliance requires mapping these flows. Our initial gap assessment takes four weeks, followed by a two to three-month implementation period and a final assessment.
Marketplace Data Workflows
| Task | Data Used | DPDP Risk |
|---|---|---|
| Booking | Physical address | High: Shared with third-party workers |
| Vetting | Aadhaar or ID | Very High: Processing sensitive ID data |
| Support | Call recordings | Medium: Identity captured in audio |
| Payment | UPI or Bank info | High: Financial data processing |
| Feedback | Ratings and Photos | Low: Service history logs |
This week
Review your provider app interface. Count exactly how many people see a customer’s phone number and address before the service starts. Document if that data remains visible to the provider after the job is marked “Completed.”
Need help applying this to your business? Review the consulting scope and bring the systems, teams, and data flows involved to your first call. If you already have a gap assessment, see implementation support.
Frequently asked questions
Are independent plumbers or cleaners responsible for data?
The marketplace is the Data Fiduciary and holds primary responsibility. You must sign Data Processing Agreements with every provider to ensure they follow your privacy rules and delete customer data after the job.
How long can we keep customer addresses for safety reasons?
You can keep data for as long as necessary to resolve disputes or satisfy safety laws. You must define this specific time period in your privacy notice and delete the data once that period ends.
Does call masking satisfy DPDP requirements?
Masking helps prevent data leaks between parties, but the platform still processes the call logs and recordings. You still need clear consent and a secure way to store or delete those audio files.