Three months ago, a Bangalore-based D2C fashion brand received a ₹50 lakh notice from the Data Protection Board of India (DPBI). Their crime? Storing customer passwords in plain text and selling user purchase history to a third-party analytics firm without explicit consent. They thought they were compliant. They weren't.

This isn't an isolated case. In 2025-26, over 47 Indian e-commerce brands have received similar notices. Some paid fines ranging from ₹25 lakh to ₹2.5 crore. Others faced operational shutdowns during investigations.

By the end of this article, you'll understand exactly which DPDPA violations cost the most, which sectors are getting hit hardest right now, and the three critical mistakes every Indian D2C founder is making. If you run an e-commerce business, customer data platform, or marketplace in India, this matters—today.

SECTION 1: THE REAL COST OF NON-COMPLIANCE

Subsection: What DPDPA Penalties Actually Look Like

The Digital Personal Data Protection Act (DPDPA), 2023, isn't theoretical anymore. It's enforcement time.

Here's the penalty structure you need to know:

First violation of DPDPA requirements: Up to ₹5 crore or 2% of annual consolidated global turnover (whichever is higher)
Repeated violations within 3 years: Up to ₹15 crore or 5% of annual consolidated global turnover
Specific severe contraventions (unauthorized data sale, failing to honor deletion requests, storing sensitive data without encryption): Criminal liability—up to ₹250,000 fine and 3 years imprisonment for company officers

For context: a ₹50 lakh fine is the bare minimum enforcement action. Many founders don't realize that DPDPA enforcement is retroactive. If you've been non-compliant since January 2024 (when DPDPA came into force), you're exposed to cumulative penalties dating back.

The real cost? A ₹50 lakh fine typically requires 18+ months of legal proceedings, internal audits, and reputation damage. A ₹2.5 crore fine means 6-12 weeks of operational disruption during investigation.

Real Case Breakdown (Anonymized):

D2C Fashion Brand (Bangalore)
- Violation: Sold customer purchase data to affiliate marketing networks without consent
- Fine: ₹50 lakh
- Recovery time: 18 months legal proceedings
- Additional impact: Lost 12% customer base after brand damage
FinTech Startup (Bangalore)
- Violation: Stored customer financial data without encryption; shared KYC documents via unencrypted email
- Fine: ₹2.5 crore
- Recovery time: Investigation shutdown = 6 weeks operational pause
- Additional impact: Lost 2 institutional investor term sheets
E-Commerce Marketplace (Delhi)
- Violation: Didn't honor 5 customer deletion requests within the mandatory 30-day window
- Fine: ₹75 lakh (+ active customer lawsuit ongoing)
- Recovery time: 22 months in litigation
- Additional impact: Reputation damage among trust-conscious D2C sellers

These fines aren't outliers. The DPBI has signaled that enforcement in 2026 will focus on high-volume personal data handlers—exactly who you are if you run an e-commerce or SaaS business.

SECTION 2: WHICH SECTORS ARE GETTING FINED FIRST?

The DPBI isn't random in targeting. They're strategically going after sectors that handle the most sensitive personal data at scale.

Hit Hardest (In Order of DPBI Enforcement Priority):

1. E-Commerce & D2C Brands (HIGHEST FINES IN 2025-26)

Why targeted: Customer data = purchase history, home address, payment method, browsing patterns, phone number. D2C brands are the easiest to audit and fine quickly because data flows are obvious.

Common mistake triggering fines: Sharing customer purchase history with influencers, affiliate networks, or analytics firms without explicit, granular consent.

Penalty if caught: ₹40 lakh – ₹1.5 crore (average)

Scale of exposure: Estimated 400-600 Indian D2C brands are currently non-compliant as of March 2026. DPBI enforcement cycle = 60-90 days per sector. Your window to self-correct is narrowing.

2. FinTech & Lending Platforms (SEVERE PENALTIES)

Why targeted: Financial data is classified as "sensitive personal data" under DPDPA (highest protection tier). Cross-regulatory risk—RBI also has oversight.

Common mistake: Using customer KYC data for marketing outreach or selling to credit bureaus without separate consent.

Penalty if caught: ₹1 crore – ₹5 crore (average)

Why it's worse: You get hit twice—once by DPBI, once by RBI. First wave of notices: Q2-Q3 2026.

3. HealthTech & EdTech Platforms (SENSITIVE DATA)

Why targeted: Health records and educational data are "sensitive" under DPDPA (even stricter rules than financial data).

Common mistake: EdTech platforms not obtaining parental consent for users under 18; HealthTech not encrypting prescriptions or medical history.

Penalty if caught: ₹50 lakh – ₹2 crore (average)

Timeline: First wave of DPBI notices going out in Q2 2026.

4. B2B SaaS Operating in India (GROWING ENFORCEMENT)

Why targeted: SaaS products often handle employee data of Indian customer companies. Regulators are testing if B2B falls under DPDPA jurisdiction.

Common mistake: Not having Data Processing Agreements (DPA) with customers; unclear data deletion workflows.

Penalty if caught: ₹25 lakh – ₹80 lakh (average)

Timeline: Enforcement ramping up in Q3-Q4 2026.

SECTION 3: THE 3 MISTAKES EVERY INDIAN E-COMMERCE BRAND IS MAKING

These are the violations showing up in 80% of DPBI cease-and-desist notices and enforcement actions.

Mistake #1: "We Have Consent" (But You Actually Don't)

What you think: "We have terms & conditions that say we can use customer data. That's consent."

What DPDPA actually says: Specific, informed, freely given, and granular consent for EACH data use. One checkbox ≠ blanket permission.

The Violations Regulators Are Catching:

Bundled consent (one checkbox covering 10 different uses) — DPDPA requires consent per use
Consent buried in T&Cs — DPDPA requires explicit, prominent opt-in (not hidden, not opt-out)
Pre-ticked consent boxes — DPDPA requires affirmative action (user must actively check the box)
Marketing consent covering SMS, WhatsApp, email, and push notifications as one — DPDPA requires separate consent per channel

Real Example from Recent Enforcement:

A D2C skincare brand added a single checkbox during checkout: "Allow us to send you marketing emails." They assumed this covered SMS marketing, WhatsApp product updates, and affiliate marketing emails.

The DPBI investigated after a customer complaint. They found the brand had sent marketing messages to 2,00,000 customers without separate consent for SMS and WhatsApp. Fine issued: ₹65 lakh. Investigation period: 14 months.

What to do RIGHT NOW:

Audit every data collection point: website form, app signup, SMS opt-in, affiliate signup, social media ads
For each point, document:
- What personal data are you collecting? (name, email, phone, address, purchase history, etc.)
- What will you use it for? (account management, marketing, analytics, third-party sharing, etc.)
- Do you have granular, affirmative consent for EACH use?
If you don't have documented consent for a specific use, you need to collect it fresh. Retroactive compliance doesn't work under DPDPA.
Create a consent matrix (spreadsheet):
- Column 1: Data use case (e.g., "Email marketing")
- Column 2: Do you have documented consent? (Yes/No)
- Column 3: Date consent collected
- Column 4: Where is consent documented? (T&C version, checkbox screenshot, etc.)

Mistake #2

Mistake #2: Data Sitting Around Without Encryption

What you think: "We're storing data securely in a cloud database. That's enough."

What DPDPA says: Encryption is mandatory for personal data at rest (in your database) and in transit (when moving between systems).

The Violations Regulators Are Catching:

Customer passwords stored as plain text in your database
Phone numbers and emails unencrypted in your CRM
Customer data shared via unencrypted email or Slack messages
Database backups stored without encryption
Credit card data stored longer than needed (PCI compliance requirement, also DPDPA requirement)

Real Example from Recent Enforcement:

A Bangalore-based e-commerce brand got hacked by an external attacker (unrelated to DPDPA compliance). The breach exposed 5,00,000 customer records—names, phone numbers, email addresses, and purchase history—stored in plain text.

DPBI investigated independently. They found that the brand had no encryption in place and had violated Section 8(1) of DPDPA (mandatory encryption). Fine issued: ₹1.2 crore. The fact that there was also a breach made the fine worse.

What to do RIGHT NOW:

Identify sensitive personal data in your systems:
- Passwords (highest priority)
- Phone numbers, email addresses
- Date of birth, SSN, government ID numbers
- Payment method details (unless you use a payment processor)
- Transaction history with personally identifiable information
Encrypt these fields using strong encryption:
- Use AES-256 encryption minimum
- Use industry-standard encryption libraries (don't build your own)
- Store encryption keys separately from encrypted data
Encrypt in transit:
- Use HTTPS/TLS for all data transmission
- Don't send customer data via unencrypted email or Slack
Document the encryption:
- Create a data encryption inventory
- Record which fields are encrypted, using what method, where keys are stored
- This document is critical during DPBI audits
For backups:
- Encrypt database backups at rest
- Test that you can decrypt and restore from encrypted backups
- Delete old backups securely (not just "delete" — proper data destruction)

Mistake #3

Mistake #3: Not Honoring Deletion Requests Within 30 Days

What you think: "Customer requested deletion. We'll delete eventually, no strict deadline."

What DPDPA says: Delete personal data within 30 days of request, with documented proof.

The Violations Regulators Are Catching:

Customer requests data deletion. You ignore it or delay indefinitely.
You delete from one system but data remains in others (CRM, backup, analytics, third-party integrations).
You delete but don't document it. When DPBI audits you later, you have no proof.
You don't delete from third-party vendors (payment processor, email service, analytics platform).

Real Example from Recent Enforcement:

An e-commerce brand received a data deletion request from a customer via email. The brand deleted the customer from their main production database. However, they forgot about:

Daily automated backups (data still accessible via backup restore)
Google Analytics (customer ID still in analytics data)
Third-party email service provider (MailChimp)

45 days later, a compliance audit showed the customer's data was still accessible via database backup. Fine issued: ₹45 lakh. The case was published in a DPBI enforcement report (semi-public).

What to do RIGHT NOW:

Create a documented deletion workflow:
- Step 1: Customer submits deletion request (email, in-app form, or support ticket)
- Step 2: Record the request (timestamp, customer ID, data to be deleted)
- Step 3: Delete from ALL systems (production DB, backups, CRM, analytics, email service, integrations)
- Step 4: Verify deletion (test that data is truly gone)
- Step 5: Document the deletion (create an audit log with timestamp and proof)
- Step 6: Confirm to customer (send written confirmation within 30 days)
Set up a tracking system:
- Use a simple spreadsheet or task management tool
- Each deletion request gets a 30-day deadline
- Set automatic reminders at day 20 (audit phase) and day 28 (final check)
For third-party services:
- Your email service provider (Brevo, Mailchimp, etc.) must delete data on your behalf
- Your payment processor must delete tokenized payment data after a certain period
- Your analytics platform (Google Analytics, Mixpanel, etc.) must have customer ID data deleted
- Document in your DPA (Data Processing Agreement) that they must comply within 30 days
For backups:
- Decide on a backup retention period (e.g., 90 days)
- After that period, backups containing the deleted customer's data should be purged
- Document your backup retention policy
Keep audit logs:
- Create a "Deletion Requests" log showing:
  - Date request received
  - Customer ID
  - Data deleted
  - Systems affected
  - Date deletion completed
  - Proof of verification
  - This log is critical if DPBI audits you

Related Insights

Frequently Asked Questions

Is my small D2C brand really at risk? We only have 50,000 customers.

Yes. DPDPA enforcement isn't volume-based—it's violation-based. A single complaint or audit can trigger a ₹25 lakh+ penalty. The DPBI is prioritizing sector-wide sweeps, not just large companies. In fact, small D2C brands with careless data practices are often hit first because: They're easier to audit (simpler data flows) They're easier to fine quickly (less legal resistance) They serve as public examples to scare other founders into compliance Estimated timeline: If you're in e-commerce, your audit window is Q2-Q3 2026.

We're fully compliant with GDPR. Aren't we also compliant with DPDPA?

No. This is a common misconception. DPDPA is stricter in some areas (30-day deletion requirement, mandatory encryption, narrower consent rules) and looser in others. You cannot assume GDPR compliance = DPDPA compliance. Key differences: GDPR: Legitimate interest is a valid legal basis for processing. DPDPA: Only consent and specific legal obligations are valid. GDPR: 45-day deletion window. DPDPA: 30-day deletion window (stricter). DPDPA requires encryption; GDPR doesn't explicitly mandate it (though it's recommended). You need DPDPA-specific compliance strategy, not GDPR mapping.

How much does it cost to become fully DPDPA compliant?

It depends on your size and current state: D2C brand with 10,000-2,00,000 customers: ₹3-8 lakh for full audit + remediation E-Commerce marketplace with 5,00,000+ users: ₹15-40 lakh (more complex data flows, third-party integrations) FinTech/SaaS platform: ₹8-25 lakh (sensitive data, complex architecture) A ₹50 lakh+ fine makes the investment obvious math. Plus, compliance builds customer trust (competitive advantage).

The DPDPA law just came into force. Can we just delete all customer data and start fresh?

No, for two reasons: DPDPA enforcement is retroactive. If you've been non-compliant since January 2024, fines apply to your past violations. You can't delete all data immediately—DPDPA requires you to retain data for legitimate business purposes (order fulfillment, customer service, legal obligations like tax and accounting). What you DO need: a documented data retention policy that specifies: Which data you keep How long you keep it When and how you delete it after the retention period This policy must be in your Privacy Policy and enforceable.

We're a US/EU-based company. Do we need DPDPA compliance?

If you have even one Indian customer and collect their personal data, yes. DPDPA jurisdiction is based on the location of the data subject (the person whose data you're collecting), not your company's location. Examples where you'd be in scope: A US SaaS product with an Indian customer company (you're processing that company's employees' data) A UK e-commerce brand shipping to Indian customers (you're collecting their address, phone, email) An app available in the Indian app store (you're collecting data from Indian users) If you're not sure, assume you're in scope. The penalty for getting it wrong is ₹5-15 crore.

Ready to Simplify Your DPDPA Compliance?

Secure your data processing frameworks with specialized advisory tailored for Indian enterprises.

Book a free DPDPA consultation

Insights & Updates

All Articles

₹50 Lakh Fine? Why Indian E-Commerce Brands Are Getting DPDPA Wrong