DPDP Compliance for Online Marketplaces
Marketplaces sit between buyers and sellers, processing data from both sides. Get a free assessment.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For DPDP Compliance for Online Marketplaces, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Managing the Buyer-Seller Data Handover
Marketplaces must control how buyer contact details move to independent sellers. You need a system that masks phone numbers or limits address visibility once a delivery is finished. If a seller uses a buyer’s phone number for their own private marketing, the marketplace is responsible for that unauthorized data use.
Third-Party Logistics Integration
Your platform shares real-time location and contact data with delivery fleets. Your contracts must specify that these drivers cannot store buyer data on personal devices after the package is dropped. You are responsible for ensuring your logistics partners delete this data from their local logs once the service is complete.
| Workflow | Personal Data | DPDP Risk |
|---|---|---|
| Seller Onboarding | PAN, GST, Bank Details | Unauthorized access by internal staff |
| Buyer Checkout | Shipping Address, Phone | Data leakage to third-party sellers |
| Recommendation Engine | Search History, Purchase Patterns | Processing data for profiling without consent |
| Refund Processing | Bank Account, UPI ID | Keeping financial data longer than necessary |
This week
Review your seller dashboard to see if sellers can download bulk reports containing buyer phone numbers. Disable the “Export” button for buyer contact details and replace it with a masked contact system for order issues.
Now think about your work. Where does personal data enter your workflows? Where does it sit? Who else touches it?
Frequently asked questions
Do we need consent to share a buyer's address with a seller?
Yes, you must tell the buyer during checkout that their data will be shared with the specific seller to fulfill the order. You cannot allow the seller to use that data for any reason other than shipping that specific package.
How do we handle data deletion requests for data we shared with sellers?
You must notify every seller and delivery partner who received that person's data to delete it from their systems. Your seller agreements must include a legal requirement for them to follow these deletion orders.
Can we use a buyer's purchase history to suggest products from different sellers?
You must get specific consent for "profiling" or "marketing" when the user signs up. If you only have consent to "process orders," using that history for cross-seller advertising violates the rule of using data only for its original purpose.