E-commerce door. CP-Ecomm + DPDP + GST.

Selling online in India means five regulators. One platform.

Consumer Protection E-commerce Rules, DPDP for customer data, GST reconciliation, country-of-origin, grievance officer, ODR. Every obligation. One workspace. Marketplaces and D2C brands get every register, every alert, every audit trail in a single tenant. dcomply publishes the mandatory grievance officer block on your site, logs and clocks every complaint, tracks country-of-origin evidence per SKU, and produces GSTR-1 and GSTR-3B from your transaction data.

DPDP + Consumer Protection mapped Country of Origin enforcement No credit card to start
Live E-commerce Compliance Snapshot
Bazaar Online Pvt Ltd · D2C
Compliance Score: 81/100 GREEN
───────────────────────────────
DPDP Act 2023 ............... 86%
Consumer Protection Rules ... 74%
Country of Origin ........... 92%
ODR Grievance Register ...... 88%
GST returns ................. 95%
───────────────────────────────
Open grievances: 7 · SLA at risk: 2
Sound familiar?

If any of this sounds familiar, you're in the right place.

These are the exact sentences we hear on first calls. If two or three of them ring true, dcomply is the workspace you have been trying to build in a spreadsheet.

Your grievance officer's name is on the website but there's no logged workflow behind it.

Country of origin is set on the product page but you can't produce evidence for it.

Your GST reconciliation is done by the CA at month-end.

Your customer data-request policy exists as one line in the privacy policy.

You've heard about ODR but you're not sure who runs it and whether you need to plug in.

If you also sell into the EU or handle subscriber lists, the Publishing door covers GDPR and one-click unsubscribe patterns.

Your regulator stack

Here's what sits above the foundation.

A D2C brand or marketplace typically lives under five overlapping regulators. dcomply ships modules for each layer.

ODR (once mandated)
Online Dispute Resolution readiness. Escalation ladder pre-built.
Country of Origin (DPIIT)
Per-SKU origin logging, source document archive, display audit trail.
Legal Metrology (Packaged Commodities)
Declaration rules for packaged goods, importer registration, evidence archive.
CGST / SGST
GSTR-1, GSTR-3B exports, ITC reconciliation, notice tracker.
Consumer Protection (E-commerce) Rules 2020
Grievance officer publication, 48-hour ack SLA, 1-month resolution, refund workflow.
DPDP Act 2023
The foundation. Customer consent, DSR portal, breach for buyer data, retention.
48 hours
CP Rules grievance SLA
1 month
Resolution deadline
100%
Country of origin required
₹250 Cr
Max DPDP penalty
The E-commerce Compliance Stack

Five Regulators, One Customer Journey

Every order touches multiple frameworks. Most teams patch them together with manual workflows.

DPDP Act 2023

Customer data drives the funnel. Consent, DSR, breach, cross-border for analytics tools.

Consumer Protection Rules

48-hr grievance acknowledgement, mandatory ODR linkage, seller disclosures.

Country of Origin

Mandatory product-level COO disclosure on every listing. Audited periodically.

GST + DPIIT

Multi-state GSTIN, monthly returns, DPIIT recognition for funding access.

In Your Tenant On Day One

Every E-commerce Module. Pre-Wired

DPDP
Consent Management

Cookie banner, marketing consent, withdrawal flows, retention rules per data class.

DPDP
DSR Portal

Customer right-to-access, correct, delete via WhatsApp / portal. 90-day SLA enforced.

DPDP
Cross-Border Tracker

Analytics tools, ad platforms, CDN, storage outside India. Country approval log.

Consumer
Grievance Officer

48-hr acknowledgement, 1-month resolution, monthly grievance report PDF.

Consumer
ODR Linkage

Display ODR portal link on every listing. Track escalations.

Consumer
Country of Origin

Bulk SKU import, gap-fill workflow, audit-ready report.

GST
Multi-GSTIN

Manage GST across states. GSTR-1 / GSTR-3B export. ITC reconciliation.

DPIIT
DPIIT Recognition

Track recognition renewal, startup incentives, tax holiday compliance.

Vendor
Vendor Risk + DPA

Sub-processor register for ad networks, analytics, CDN, payment gateway.

Audit
Evidence Locker

One vault: policies, consent receipts, COO files, GST returns, DPIIT certificate.

Coverage By Regulator

What dcomply Replaces

Regulator / FrameworkWhy It Appliesdcomply Module
DPDP Act 2023You process customer personal data Data Privacy pack
CP E-commerce RulesMarketplace or D2C inventory E-commerce module + ODR
Country of OriginEvery imported product listing Country of Origin module
GSTMulti-state sales GST module + Tax Calendar
DPIITStartup recognition + tax holiday DPIIT + Startup India tracker
POSH10+ employees POSH IC + annual return
vDPO Addon

Don't Have a DPO? Get a Virtual One.

D2C brands hit Section 10 SDF criteria fast as user counts climb. A DPO is mandatory.

dcomply vDPO bolts on from ₹2,499/mo with AI Q&A, monthly DPO PDF, auto-DPIA triggers, and DSR auto-drafts.

See vDPO tiers
vDPO Basic₹2,499/mo

AI-powered DPO for solo founders and small teams.

  • Plain-English Q&A with DPDP citations
  • Monthly DPO PDF report
  • DSR auto-draft
  • Privacy micro-training
Built for e-commerce

Customer data lives across your stack. We discover all of it.

Shopify orders, Magento catalogues, Razorpay payments, WhatsApp orders, Zoho leads. Connect them and the discovery engine maps PII automatically.

MySQL
Order / customer DB
MongoDB
Catalogue / sessions
AWS S3
Product media + exports
Razorpay
Payment PII
WhatsApp Business
Order flows + DSR
Zoho CRM
Lead / contact PII
E-commerce FAQs

Questions D2C founders and marketplace legal heads actually ask.

Indian e-commerce faces DPDP Act 2023 (buyer/browser data), Consumer Protection (E-Commerce) Rules 2020, GST plus e-invoicing, Legal Metrology declarations, CERT-In 6-hour breach reporting, and for marketplaces publication of a grievance officer and 48-hour acknowledgement SLA. Foreign platforms selling to India are equally in scope.

Yes. If the cart is tied to an identifiable user (email, phone, cookie) it is personal data being processed for the cart recovery purpose. This purpose must be disclosed in the notice, consented to, and honoured on withdrawal. dcomply's connector layer propagates withdrawal to CDPs like MoEngage, WebEngage and CleverTap.

Marketplaces must display grievance officer name plus contact, acknowledge complaints within 48 hours, and resolve within 1 month. dcomply's Grievance Management module ingests complaints via web form, email, portal or WhatsApp, timestamps them, routes to owner, tracks SLA and closes with an audit trail.

The DPDP Act does not name cookies but treats browser tracking data as personal data. Practically: a compliant e-commerce site needs a purpose-based consent banner, granular opt-in for marketing/analytics/personalisation/cart-recovery, and a preference centre accessible from every page. Static "we use cookies" strips do not meet DPDP.

No. Order fulfilment is a specified legitimate use under DPDP (contractual necessity). Transactional SMS, email and WhatsApp about the order do not need explicit consent. Marketing follow-ups (abandoned cart, upsell, review request) require explicit opt-in. Bundled consent for both is invalid.

Quick-commerce operators use dcomply for rider onboarding KYC, dark-store CCTV data retention (24 to 72h typical), delivery-address purpose scoping, and cross-border transfer registers if inventory data flows to parent-company systems abroad. Real-time consent lookup on order creation is supported via the /api/v1 endpoint.

If you sell goods or services digitally to Indian consumers, yes. This applies to your own D2C site as much as a marketplace.

Yes. The 2020 Rules require the grievance officer's name, contact, and response timelines to be published. dcomply auto-generates the disclosure block for your site.

Country of Origin declarations under DPIIT rules must be evidenced. dcomply logs the origin, the source document, and the display audit trail.

Full GSTR-1 and GSTR-3B export from your transaction data. Reconciliation with your ledger.

No. The e-commerce module already includes the ODR-ready escalation ladder. When mandated, it turns on.
Real teams, real programmes

"The enquiries stopped."

"We were flagged twice in Consumer Affairs enquiries for grievance response time. Since dcomply, every complaint sits in a workflow with a clock. The enquiries stopped."
Head of Operations, a D2C brand selling nationally.

Start Free. Scale When You're Ready.

Pay-per-module from ₹1,499. Sector pack from ₹4,999. vDPO from ₹2,499.