DPDP readiness for online marketplaces in India

A marketplace has many stalls, but the data ledger has one memory.

What to review

Online marketplaces sit between buyers, sellers, payment providers, logistics partners, advertisers, support teams and trust-and-safety operations. That position creates a dense personal-data map. Buyer profiles, seller identities, tax references, addresses, product reviews, chat messages, complaints, refund records, risk flags, device data, marketing audiences and platform analytics may all sit in different systems while still forming one privacy story.

DPDP readiness should begin with the marketplace's own decisions. The platform may not own the goods, but it often decides how accounts are created, how search and recommendations work, what data sellers see, how disputes are handled, what fraud signals are collected and how marketing campaigns are run. Those choices can make the platform a Data Fiduciary for many workflows, even where a seller is separately responsible for its own customer handling.

Buyer-seller data sharing needs a clear rulebook. Sellers may need enough information to fulfil orders and handle returns, but they should not receive broad buyer profiles, marketing segments or unrelated complaint history. The marketplace should record what data is shared, why it is necessary, whether seller terms restrict reuse, and how misuse is detected.

Consumer Affairs ecommerce materials add practical sector context. Marketplaces already need governance for grievance handling, seller transparency and consumer trust. DPDP readiness should use that same operational muscle: named owners, clear records, escalation paths and proof that platform rules are enforced in the product.

Implementation steps

1. Map buyer, seller, payment, delivery, dispute, review, chat, fraud, advertising, analytics and support data across marketplace systems and vendors.
2. Define the marketplace role for each workflow. Separate platform-controlled purposes from seller-controlled processing and processor support services.
3. Review notices for buyer registration, seller onboarding, checkout, in-platform messaging, reviews, grievances, loyalty, advertising and optional personalisation.
4. Limit seller access to data needed for fulfilment, returns, warranties and support. Keep broader buyer profiling, risk scores and marketing audiences away from seller dashboards.
5. Put seller and vendor terms in operational language. Cover permitted use, confidentiality, account security, onward sharing, data extraction, deletion and cooperation with rights requests.
6. Review trust-and-safety tools for data minimisation. Fraud detection, abuse monitoring and fake-review controls should have documented data fields, purpose, retention and access limits.
7. Set retention rules for rejected sellers, inactive buyers, disputes, chats, returns, reviews, fraud flags, tax records, advertising audiences and old support tickets.
8. Build a coordinated rights workflow. A request may require action in platform databases, seller-facing tools, payment references, logistics records, marketing platforms and archived support data.

A marketplace should also maintain a seller-data misuse escalation path. If a seller exports buyer data, sends unauthorised marketing or mishandles a complaint, the platform needs a response that covers account action, evidence preservation, user communication, vendor review and recurrence prevention.

Another useful control is a quarterly access sample. Pick a few seller-support, dispute and fraud cases, then test whether each person who viewed buyer or seller data had a clear operational reason. This gives the privacy file evidence that marketplace permissions are being checked in practice, not merely described in a policy.

Common mistakes

• Assuming the marketplace has no DPDP responsibility because independent sellers complete the sale.
• Sharing buyer data with sellers without defining purpose, reuse limits and deletion expectations.
• Keeping dispute chats, fraud flags and seller verification records forever because they are awkward to classify.

How DataNuance can help

DataNuance helps marketplace teams build DPDP controls for buyer-seller data sharing, seller terms, platform notices, vendor reviews, retention schedules, grievance workflows and misuse escalation. To prepare a marketplace DPDP readiness file before launch, audit or partner review, speak with DataNuance's privacy advisory team.

FAQs

Does the DPDP Act apply to online marketplaces in India?

Yes, where the marketplace processes digital personal data in India or offers goods or services to people in India. Buyer, seller, transaction, grievance and platform-use data may all be relevant.

Are sellers separate Data Fiduciaries?

They may be, depending on their own decisions and customer handling. The marketplace can still be responsible for platform-controlled purposes such as account design, recommendations, fraud controls and support workflows.

What buyer data should sellers receive?

Only the data needed for a defined purpose such as fulfilment, returns, warranty support or complaint handling. Seller terms should restrict reuse, extraction, onward sharing and unauthorised marketing.

What records should marketplace teams keep?

Keep data maps, notices, seller data-sharing rules, vendor instructions, access reviews, retention decisions, fraud-control assessments, grievance records and rights-request evidence.