The personal data you hold
- Names, addresses and phone numbers for delivery
- Order history and preferences
- Cookies, IP addresses and device data
- Marketing email, SMS and WhatsApp lists
- Reviews, photos and returns data
What to do
- Add a consent banner with choices for analytics and marketing; don’t pre-tick boxes.
- Separate order-fulfilment processing from marketing; marketing needs its own consent.
- Log every consent from checkout and sign-up forms with the notice version.
- Let customers withdraw marketing consent and delete their account easily.
- Sign data terms with your courier, payment gateway, email/SMS tools and agencies.
- Report breaches within 72 hours; check your platform plugins’ security.
See the full 13-step DPDP checklist or set up your notice and consent log free.
Frequently asked questions
Is a cookie banner enough for an online store?
No. You also need a notice, records of consent, a way to handle requests, security and a breach plan.
Can I send abandoned-cart WhatsApp messages?
Only if the customer agreed to receive such messages and was told about it in your notice.
Get DPDP-ready without a lawyer’s bill
ConsentKaro writes your privacy notice in English and Hindi, logs consent, and handles customer data requests. 14-day free trial, no card.
Start free trial → Take the free DPDP check