Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsMarketplaces sit on a huge web of buyers, sellers and logistics, payment and ad partners.
In short
Marketplaces are Data Fiduciaries for buyers, and often for sellers too. The Act requires consent for marketing and profiling, minimization at checkout, easy deletion, and control over every processor in the chain. Penalties reach ₹250 crore.
What changes for this sub-sector.
You are a Fiduciary for buyer profiles and, frequently, for seller KYC and payout data too.
Recommendation, retargeting and marketing need clear opt-in consent, not pre-ticked boxes or dark patterns.
Logistics, payment, ad and analytics partners are processors; contract and oversee all of them.
Make account deletion and data erasure easy to find and to act on.
Collect only what an order needs; do not hoard browsing and device data indefinitely.
Report breaches of customer or seller data to the affected people and the Board.
Fix consent and the processor web first, then deletion.
The readiness check maps consent, processor and deletion gaps.
Take the readiness check →Consultant-led and partner-backed.