India’s new data privacy rules: how they affect apps & e-commerce platforms

India’s newly notified data-privacy rules impose obligations on apps, marketplaces, and e-commerce platforms regarding consent management, purpose limitation, data minimisation, record-keeping, breach reporting, and cross-border data transfers. Platforms classified as significant data fiduciaries face stricter compliance requirements. The article outlines practical steps including updating privacy policies, embedding privacy-by-design, appointing data protection officers, and establishing grievance redressal mechanisms. It also addresses enforcement, penalties, and impact on startups versus incumbents. Legal, compliance, and product teams must align operations to meet regulatory expectations while maintaining user experience and scalability.