India's Digital Personal Data Protection Act, 2023 (DPDPA) and the accompanying Rules, 2025 are set to reshape how digital commerce handles personal data. A recent Lexology analysis of the topic frames the shopping cart as a data collection point, and that framing is useful. Every account sign-up, saved address, payment preference and browsing pattern in a shopping app is personal data. For anyone following India DPDPA online shopping privacy, the question is what you actually gain as a shopper, and what no tool can do for you.
India DPDPA Online Shopping Privacy: What Changes for E-Commerce Data
The DPDPA is India's first comprehensive framework governing the collection, processing and storage of personal data. It uses specific terms: the person whose data is collected is a "Data Principal," and the company deciding why and how data is used is a "Data Fiduciary." In practice, you are the Data Principal and the shopping platform is the Data Fiduciary.
Law firm summaries of the Rules point to specific obligations for large platforms. According to those summaries, the Rules set out erasure requirements for certain classes of Data Fiduciaries, including e-commerce entities, social media platforms and online gaming companies. One summary describes the requirement this way: inactive user data must be deleted after three years, with a 48-hour prior notice to the user. Another describes erasure within three years of the Data Principal last approaching the company.
The details of which platforms qualify and how "inactive" is defined matter, so treat these figures as a summary rather than legal advice. The direction is still clear: collecting data indefinitely and keeping it "just in case" becomes harder to justify.
Consent, Deletion and Correction Rights Shoppers Gain
The Act is built around consent. Companies are expected to tell you what data they collect and why, and to process it for that purpose. For shoppers, that should mean clearer prompts at sign-up and checkout, rather than a single bundled approval buried in terms and conditions.
The rights you can expect to use include:
- Withdrawing consent. You should be able to pull back permission you previously gave, and the process should be no harder than giving it.
- Correction. If your address, phone number or other details are wrong, you can ask for them to be fixed.
- Erasure. You can request that your personal data be deleted, subject to legal exceptions.
- Grievance redressal. Platforms must offer a way to raise complaints about how your data is handled.
The inactivity-based deletion rule adds a safety net for the accounts you forgot about. An abandoned shopping profile with a saved address and order history is exactly the kind of record that tends to linger for years and end up in a breach.
What a VPN Can and Cannot Do While Shopping Online
A VPN encrypts the connection between your device and the VPN server and hides your IP address from the sites you visit. That helps on public Wi-Fi and limits one signal that sites use to estimate your location. It is a useful layer, but it solves a different problem than the DPDPA does.
When you log in to a shopping app, the platform still knows who you are. It sees your account, your delivery address, your payment details and your purchase history, whatever your IP address says. A VPN does not stop a company from collecting data you hand over voluntarily, and it does not control how long that data is stored or whether it gets deleted. Those are legal questions, and the DPDPA is the tool for them.
There is also a practical limit. VPNs depend on a working connection, and they cannot help if access itself is cut off. Our explainer on what a VPN can and cannot do during an internet shutdown covers a different scenario, but it shows the same principle: a VPN is one tool with defined boundaries, not a blanket shield.
The reverse is also true. The law does not protect you from a snooping network or an unencrypted hotspot. The two work best together.
What This Means For You: Steps to Limit Tracking at Checkout
You do not need to wait for every provision to be fully in force to start tightening your habits. Consider these steps:
- Review consent settings in your shopping apps. Look for privacy or data settings and switch off optional tracking, personalized advertising and contact syncing you do not need.
- Delete accounts you no longer use. Do not rely only on automatic deletion after a period of inactivity. Use the in-app deletion or erasure request option where one exists.
- Check and correct your saved details. Outdated addresses and phone numbers are both a privacy and a delivery problem.
- Use guest checkout when you can. Fewer stored profiles means fewer records to protect.
- Share only what is required. If a form asks for more than delivery and payment need, treat optional fields as optional.
- Tighten browser settings. Block third-party cookies, clear site data periodically and use tracking protection features built into your browser.
- Use a VPN on untrusted networks. It protects the connection, not your account data.
- Keep records of your requests. If you file a deletion or correction request, save the confirmation in case you need to escalate a grievance.
Why do these limits matter beyond shopping? Because personal data rarely stays in one place. Debates over identity data and monitoring in India are active, from the facial recognition privacy debate under Article 21 to concerns about a proposed Aadhaar requirement for social media sign-ups in Karnataka. Limiting what commercial platforms collect is one part of a larger conversation about who holds your information and for how long.
Takeaways
India DPDPA online shopping privacy comes down to a division of labor. The law gives you rights over consent, correction and deletion, and it puts retention limits on large e-commerce platforms. A VPN and sensible browser settings reduce exposure on the network and from third-party trackers, but they cannot make a retailer forget what you told it.
This week, open the shopping apps you use most, review the consent toggles, and find the account deletion or data erasure option. Remove the profiles you no longer need, and exercise your rights as the Rules take effect. Implementation details may evolve, so check the platform's privacy notice and official guidance for the latest requirements.
