Consumer Protection Rules + GST, one platform.
D2C site, marketplace or quick-commerce — your buyer data lives under DPDP, your refund flow lives under CPA 2020, your invoices live under GST, your tracking under CERT-In. dcomply ships one tenant that handles cookie consent, grievance SLA, DSR portal, vendor DPAs, breach workflow and the GST calendar.
propagates to MoEngage · WebEngage · CleverTap on withdrawalSix frameworks, one order.
DPDP covers browse-to-buy data. CPA 2020 covers the refund SLA. GST covers the invoice. DPIIT covers Country of Origin. Legal Metrology covers packaging. CERT-In covers the breach.
Four fires that cost conversion.
Cookie banners, grievance SLAs, cart data, bundled consent. All named, templated, logged.
Cookie consent that holds up. "We use cookies" strips do not meet DPDP. You need purpose-based opt-in (marketing / analytics / personalisation / cart-recovery), preference centre from every page, propagation to connected CDPs.
Grievance officer SLA. E-commerce Rules 2020: publish name + contact, acknowledge in 48 h, resolve in 1 month. Not a form, a tracked ticket pipeline with audit trail.
Abandoned cart = personal data. If the cart is tied to a user (email, phone, cookie), it is personal data processed for cart-recovery. Disclose purpose, obtain consent, honour withdrawal, propagate to CDP.
Transactional vs marketing opt-in. Order updates are legitimate use (no consent needed). Review nudges, upsell, promo = separate opt-in. Bundling the two invalidates both.
Every e-com module, pre-mapped to Indian law.
E-commerce engagement from Rs 2,49,999 (60 days, single-storefront) or Marketplace tier (custom quote). Managed retainer from Rs 24,999/mo.
E-commerce compliance in four numbers.
Questions e-com ops leads actually ask.
Indian e-commerce faces DPDP Act 2023 (buyer/browser data), Consumer Protection (E-Commerce) Rules 2020, GST plus e-invoicing, Legal Metrology declarations, CERT-In 6-hour breach reporting, and for marketplaces publication of a grievance officer and 48-hour acknowledgement SLA. Foreign platforms selling to India are equally in scope.
Yes. If the cart is tied to an identifiable user (email, phone, cookie) it is personal data being processed for the cart recovery purpose. This purpose must be disclosed in the notice, consented to, and honoured on withdrawal. dcomply's connector layer propagates withdrawal to CDPs like MoEngage, WebEngage and CleverTap.
Marketplaces must display grievance officer name plus contact, acknowledge complaints within 48 hours, and resolve within 1 month. dcomply's Grievance Management module ingests complaints via web form, email, portal or WhatsApp, timestamps them, routes to owner, tracks SLA and closes with an audit trail.
The DPDP Act does not name cookies but treats browser tracking data as personal data. A compliant e-commerce site needs a purpose-based consent banner, granular opt-in for marketing/analytics/personalisation/cart-recovery, and a preference centre accessible from every page. Static "we use cookies" strips do not meet DPDP.
No. Order fulfilment is a specified legitimate use under DPDP (contractual necessity). Transactional SMS, email and WhatsApp about the order do not need explicit consent. Marketing follow-ups (abandoned cart, upsell, review request) require explicit opt-in. Bundled consent for both is invalid.
Quick-commerce operators use dcomply for rider onboarding KYC, dark-store CCTV data retention (24 to 72h typical), delivery-address purpose scoping, and cross-border transfer registers if inventory data flows to parent-company systems abroad. Real-time consent lookup on order creation is supported via the /api/v1 endpoint.
If you sell goods or services digitally to Indian consumers, yes. This applies to your own D2C site as much as a marketplace.
Yes. The 2020 Rules require the grievance officer's name, contact, and response timelines to be published. dcomply auto-generates the disclosure block for your site.
Country of Origin declarations under DPIIT rules must be evidenced. dcomply logs the origin, the source document, and the display audit trail.
Full GSTR-1 and GSTR-3B export from your transaction data. Reconciliation with your ledger.
No. The e-commerce module already includes the ODR-ready escalation ladder. When mandated, it turns on.
Request a scope. Ship a DPDP-safe checkout in a week.
Single-storefront engagement from Rs 2,49,999 (60 days). Marketplace tier custom-quoted. Managed retainer from Rs 24,999/mo.