ROLE OF DIGITAL PERSONAL DATA PROTECTION ACT INPROTECTING CUSTOMERS PERSONAL DATA WHILE PURCHASING FASHION DESIGNED PRODUCTS ON E-COMMERCE: A CRITICAL STUDY

Abstract:

The Digital Personal Data Protection Act, 2023, is the act enacted to protect personal data. Prior to this Act, the Information Technology act, 2000 was the law dealing with the protection of data privacy. But it played a role of protecting data generally, not having any specific provisions for protecting personal datat. But the Digital Personal Data Protection Act, 2023, is the law enacted for specifically protecting personal data. Here the research focuses on whether this law succeeds in protecting consumer data privacy with regard to fashion e-commerce platforms. To find out such a one, this research methodology will be primarily take note of statutes, and as secondary sources books, articles, journals, etc. This research also will focus on how effective it is  in protecting  the data protection of consumers and what the measures needed to adopt to make further improvement of protection will be

Keywords: DPDP Act, Data Privacy, E-commerce, Consumer, fashion designed products

Introduction:

E-commerce is the platform that operates in the electronic mode in which buyers buy the products and sellers sell the product. The buying and selling of fashion designed products via e-commerce platforms is growing more day by day. In the past, everyone went to shop directly, and they bought the fashion designed products in a physical mode. But due to the growth of e-commerce platforms, no one goes to shop directly. For fashion designed products even from small pins to big purchasing fashion dresses, people used to choose e-commerce platforms. The choice of buying from e-commerce platforms is time saving and has no need of travelling. Whatever the place they were, their selected products for buying will reach them easily. If they have money, that is enough for them to buy any fashion designed products. As per their wish of place and  time, they can get their booked fashion designed products. On the one hand, during their booking of fashion designed products on e-commerce platforms, they are in a need of providing  their personal details. This is a chance of misuse of data privacy. On the other hand, while entering into e-commerce platforms, there are many cookies used by platformers, those cookies unnecessarily take private data of customers. And such other issues of data privacy are also present in e-commerce platforms when buying fashion designed products. This brings a need to analyse whether there is any law to protect these consumers as all while they are buying, they are giving their personal details to the e-commerce sellers. Thus, there is a need to look upon data protection laws on e-commerce fashion product sellers platforms. The Digital Personal Data Protection Act, 2023 is governed by provisions to protect personal data. This research is to analyse how the provisions of The Digital Personal Data Protection Act, 2023 are effective in implementing the  role of data protection of consumers who buy fashion products on e-commerce platforms. This research focuses on the background of law protecting consumer’s data protection on e-commerce platforms by analyzing that law whether it is effective, and judicial precedents in protecting consumer’s data protection in fashion products selling e-commerce platforms.

Background and conceptual framework:

E-commerce in India is governed by data privacy rules after the enactment of the Digital Personal Data Protection Act, 2023[1].  It is the act covers how organizations  collect and store digital personal data. If the provisions mentioned in such act, breached by data handlers, the penalty up to 250 crore per instance can be invoked[2].

The DPDA, 2023, enacted in the year, got presidential assent on 11^th August, 2023. It gives rights to data fiduciaries and, at the same time, also gives a duty to protect and limit data processing. It enables data principals to enhance security for their personal information[3]. Thereby, it acts effectively on the transparency and accountability of data fiduciaries. Before this act came into force, the Information Technology Act, 2000 existed relating to issues relevant to e-commerce and cyberoffences.

Under this DPDA, 2023, data processing process needs to follow certain legal conditions: Receiving permission for processing the personal data from data principles, Such information must be accurate and complete, these data fiduciaries having additional responsibilities while carrying children data, there is a data protection officer enabling a grievance redressal procedure for data principals[4].

There is a major amendment in the 2023 act that requires informed consent of the data principal for further data processing, and also the  data principal may use a consent manager to provide, revoke, or monitor their consent[5]. This consent manager is accountable to the data principal. Further, this act says that if a data principal withdraws their consent to process their personal data, such data need to be deleted by the data handler[6]. Some e-commerce platforms uses Data protection Officers(DPO) to compliance under the DPDP Act[7].

The DPDP act and its effectiveness in  protecting the sdata privacy of consumers:

As one know, e-commerce is the evolving concept that is increasing day by day. According to Mordor Intelligence, India’s e-commerce market is expected to develop a compound annual growth rate of 21.5% between 2025 and 2023 reaching 363.30 billion by 2030[8]. India’s legal protection governing e-commerce consumer is Information Technology Act, 2000 (which given birth to electronic data interchange and electronic fund transfer, the facilitation of which done with help of internet developed into electronic transactions called e-commerce[9]) and IT(Reasonable Security practices and Procedures and Sensitive personal Data or information) rules, 2011. It is the first one to protect personal data for businesses including e-platforms[10].  Section 43 A of Information Technology act,2000 mandates that companies handling sensitive personal data implement reasonable security practices to prevent data breaches[11]. And a consumer protection act (2019) it deals about fair business practices, open pricing, safe payment modes, precise product descriptions, efficient dispute resolution procedures etc[12].

Internationally for data protection, General Data protection Regulation (GDPR) exist in European Economic Area and the Eu.  Aims to enhance individual control over their personal data, requiring businesses to obtain informed consent for data processing[13]. California Consumer Privacy Act(CCPA) ensure e-commerce business comply with right to know to consumers ensuring their personal information collected about them and how it is used and such other countries also having data protecting law[14].

In India, The DPDP act have its evolution from European Union’s General Data Protection Regulation(GDPR) mentioned above. This act came into force on 2023. Now there is Digital personal data protection rules, 2025 which also having certain provisions to protect data privacy. One of such provision is data erasure. Such is data retention is allowed up to 3 years from last interaction of data principal[15]. 

Data steward of E-commerce: E-commerce organisations are called as data stewards. Because they are maintaining a personal data of consumers. To process such data, their require informed consent of consumers.[16]

Data localization: this enables E-commerce organisation to locate their data storage centres according to this act standards[17].

Supervision: there is a Data Protection Authority (DPA): it require e-commerce organisation to integrate with DPA to compliance with legislation and reporting[18].

Cooking and Tracking technologies: this mandate e-commerce organisation to described it before getting consent from data principals[19].

Appoint data processor: data fiduciary may appoint data processor to process data in behalf of activity relative to goods or services under a valid contract[20].

Purpose limitation: this act prohibits bundled consent. Specific consent required for specific purpose[21].

Data minimization and security: this act organizations to allow limited data for specific purpose and need to store it securely[22].

Cross border data transfer: it data transfers across cross border only if it is approved by central government[23].

Thus, noted from above, this DPDP act plays a vital role in protecting data privacy of consumers on e-commerce platform those buy fashion designed  products.

Case law discussion:

The right to privacy is originated in 1890. It is first recognised in the European Union. The famous cases for recognising right to privacy and right to let alone is Google Spain case.

Rajagopal vs State of Tamilnadu[24]: right to privacy is included under right to life and individual liberty of Indian constitution[25].

K.S. Puttaswamy vs union of India : the supreme court recognised right to data privacy recognised under Indian constitution[26]. This judgment had impacted on e-commerce online platforms to ensure security on consumer data privacy protections also.

Whatsapp useful to people in various ways and it also useful to buy fashion designed products as a medium of chatting. Hereafter mentioned with case law with regard to service of WhatsApp.

Karmanya singh sareen and anr. vs union of India and ors : WhatsApp privacy policy to permit WhatsApp to share data with Facebook was challenged before Delhi high court, high court held upheld WhatsApp policy and directed to delete data of users who left from this service.

Amazon Seller Services Pvt.Ltd vs Consumer Education and Research Society (2016): In this case, National Consumer Disputes Redressal Commission (NCDRC) upheld the consumer rights who get defective products through online platforms. The ruling emphasized the need to ensure standard fair-trade practices in ensuring product quality. It also applies to online platforms which  sells fashion designed products.

Trimex international FZE vs Vedanta Aluminium Limited(2010) – this court affirmed the importance of enforceability of e-contracts. This also applies to consumers those who buy fashion designed products on e-commerce platform.

Union Civil Liberties vs Union of India(1997) – the supreme court held that right to privacy under right to life of Article 21 of Indian Constitution cannot denied to citizens of India, so, e-commerce companies violating these rights by their lengthy terms and condition by which they taken permission which is unethical. It also applies to e-commerce platforms which sells fashion designed products[27].

This above mentioned are the cases imposes duty on the e-commerce platforms to ensure privacy of data protection of consumers.

Critical analysis on DPDP act regard to its effective implementation:

Both Digital Personal Data Protection Act, 2025 and Digital Personal Data Protection rules 2025 having advantages and also have certain drawbacks. Digital Personal Data Protection rules notified by Ministry of Electronics and Information Technology(MeitY)  has been criticised for enforcement vagueness in most key parts of rules. Some of such are timelines for giving notice, erasure of data, procedural directives to withdraw consent etc[28].

Lack of timeline for notice:

section 6 of the DPDP act mandate to give notice from data fiduciary to data principal but rules does not say about timeline of notice[29].

Right to erasure of data if consent withdrawn:

Section 8 of such act speaks of right to erasure of data if consent withdrawn by data principal. But Digital Personal Data Protection Rules, 2025 doesn’t specify any timeline[30].

Lack of timely Grievance redressal mechanism:

section 11 of Digital Personal Data Protection Act, 2023 says that Grievance redressal mechanism to be established in such organisation to deal with disputes. But the digital personal data protection rules, 2025 did not lay down any timeline to decide disputes within a limited period. It will cause inordinate delay to address the grievances. It is one of the major issues which inactivate the effectiveness of Digital personal data protection act, 2023.

As above mentioned, there are some lacunas present in act. Even the act good in data privacy security, storage, informed consent data retention, erasure of data when consent is withdrawn, various authorities to ensure data privacy protection of consumers, timeline not mentioning and such other procedural lacunas made ineffective  of DPDP act  and that need to be noticed by the legislature.

Conclusion:

In digital era of buying and selling the fashion designed products through e-commerce platforms, the digital personal data protection act, 2023 plays an vital role in protecting privacy of the consumer. It plays an effective role in protecting personal data. The misuse of personal data may be happened by using cookies or unnecessary permission settings to access their personal data. But Digital Personal Data Protection acts as a cheque on arbitrary use of personal data of data principal by data fiduciary. As seen above, the data fiduciary may be liable to higher penalty, if it breaches provisions of Digital Personal Data Protection Act, 2023. While noting the privacy of consumers, the supreme court as mentioned before recognised right to privacy which include to all including consumers, thus while buying fashion designed products on e-commerce platforms, they are protected from data violation breaches from data fiduciaries. So, Digital Personal Data Protection Act, 2023 is succeed in protecting consumers data protection while they are buying fashion designed products on e-commerce platforms. Even such law good in protecting privacy, need of some suggestive measures to take. That is to provide timeline as the Digital Personal Data Protection rules, 2025 lacks timelines for grievance redressal, notice to data principal etc.

References and bibliography:

1. Anahad Narain, What does the DPDP act mean for e-commerce platforms, consentin available at https://www.consent.in
2. How data protection laws impact on E-commerce in india
3. DPDP act, 2023
4. E-commerce laws in india: Legal guide for consumers <https://www.lloydlawcollege.edu.in>
5. Rajiv Ghare professor of law and Gargi Rajvanshi Assistant Professor of Law,”E-commerce and consumer protection: A critica analysis of legal regulations” 2013(1) IJCLP
6. Lawvs,”Data protection regulating governing e-commerce in india”https://www.lawvs.com
7. Sapna Deo and Sukurt Deo,”Legal aspects of E-commerce in India : Consumer Rights and Data privacy” (2023 )X(1) Shodhasamhita
8. Top strategies for data privacy and protection in ecommerce https://www.clarity-ventures.com
9. DPDP act, 2023 and DPDP rules, 2025, Drishti IAS < https://www.drishtiias.com>
10. Sowmya sharma, Dr. chanjana Elsa Philip, “balancing E-commerce and Data privacy in India – An analytical study” (2025) 10(54s) <https://www.jisem-journal.com/>
11. Section 8 DPDPA General Obligations of Data Fiduciary- Legal Interpretation <https;//dpdpa.co.> accessed 9 March 2026Data privacy in e-commerce platforms: navigating challenges and compliance with dpdp act https://lexpanacea.in
12. (1994) 6 SCC 642
13. T.H. Desai,”Protection of online privacy of consumers in E-commerce” https://www.scitepress.org
14. Data privacy vs Data protection:key legal distinctions in Indian law https://www.cyberlawconsulting.com
15. Ashmita biswas and Tanvi goyal,”Analysing Indian laws related to e-commerce” https://www/blog.ipleaders.in
16. Gaps in timeline and consent management in india’s draft dpdp rules:2025 : A critical study https://www.techlawforum.nalsar.ac.in

[1] Anahad Narain, What does the DPDP act mean for e-commerce platforms, consentin available at https://www.consent.in assessed on 09.03.2026

[2] Ibid

[3] How data protection laws impact on E-commerce in india

[4]ibid

[5] Ibid

[6] Section 6(4) of DPDP act, 2023

[7] ibid

[8] E-commerce laws in india: Legal guide for consumers < https://www.lloydlawcollege.edu.in> accessed on 9 march 2026

[9] Rajiv Ghare professor of law and Gargi Rajvanshi Assistant Professor of Law,”E-commerce and consumer protection: A critica analysis of legal regulations” 2013(1) IJCLP

[10] Lawvs,”Data protection regulating governing e-commerce in india”https://www.lawvs.com accessed on 9 marc 2026

[11] Sapna Deo and Sukurt Deo,”Legal aspects of E-commerce in India : Consumer Rights and Data privacy” (2023 )X(1) Shodhasamhita

[12] Supra note 8

[13] Top strategies for data privacy and protection in ecommerce https://www.clarity-ventures.com accessed on 9 march 2026

[14] Ibid

[15] DPDP act, 2023 and DPDP rules, 2025, Drishti IAS < https://www.drishtiias.com> accessed  9 march 2026

[16] Sowmya sharma, Dr. chanjana Elsa Philip, “balancing E-commerce and Data privacy in India – An analytical study” (2025) 10(54s) <https://www.jisem-journal.com/> accessed 9 march 2026

[17] Ibid

[18] Ibid

[19] Ibid

[20] Section 8 DPDPA General Obligations of Data Fiduciary- Legal Interpretation <https;//dpdpa.co.> accessed 9 March 2026

[21] Infra note 14

[22] Ibid

[23] Data privacy in e-commerce platforms: navigating challenges and compliance with dpdp act https://lexpanacea.in accessed on 9 march 2026

[24] (1994) 6 SCC 642

[25] T.H. Desai,”Protection of online privacy of consumers in E-commerce” https://www.scitepress.org accessed 9 march 2026

[26] Data privacy vs Data protection:key legal distinctions in Indian law https://www.cyberlawconsulting.com accessed 9 march 2026

[27] Ashmita biswas and Tanvi goyal,”Analysing Indian laws related to e-commerce” https://www/blog.ipleaders.in accessed on 9 march 2026

[28] Infra note 29

[29] Gaps in timeline and consent management in india’s draft dpdp rules:2025 : A critical study https://www.techlawforum.nalsar.ac.in accessed on 9 march 2025

[30] ibid