Data Protection and Privacy Challenges for Indian E-Commerce Companies

The rapid growth of e-commerce in India has greatly changed the relationship between the customer and the business organisations when it comes to collecting, retaining, and exploiting personal information. This paper focuses on the privacy and data protection challenges experienced by the e-commerce businesses in India in light of the Digital Personal Data Protection Act, 2023 along with the current data protection laws under the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020. It explores ongoing challenges like informed consent, cross-border transfer of data, data breaches, algorithmic profiling, deceptive design, and data sharing by third parties, putting all of these in the background of the constitutional recognition of privacy as a fundamental right. The paper goes ahead to conduct a comparative analysis with the GDPR in EU to identify approaches that can prove useful in regulating the issue in India. It concludes that even though India has made commendable progress in creating an extensive legal framework for data protection, there are still several challenges in terms of enforcement abilities, compliance cost for small businesses, and implementation of data subject rights in e-commerce.