Web Data Vendor Due Diligence India: DPDP Guide 2026

Author : Actowiz Solution | Published On : 03 Nov 2026

Introduction

Indian enterprises now buy web data the way they buy any other critical input: through procurement, legal review and an information-security questionnaire. Marketplace prices from Amazon.in and Flipkart, quick-commerce shelf data from Blinkit, Zepto and Swiggy Instamart, and restaurant data from Zomato and Swiggy all feed pricing, category and strategy decisions. The question reviewers ask first is simple: does this data carry personal data, and can the provider prove it does not?

Short answer: Web data vendor due diligence in India means checking that a provider collects only public business data (products, prices, stock, ranks, aggregate ratings), excludes personal fields by design, and backs this with a written data inventory, NDA, clear usage rights, retention rules, security controls, an SLA and an audit trail. The DPDP Act 2023 makes this review a board-level topic.

This guide explains the Digital Personal Data Protection Act and the DPDP Rules in plain words, shows where the line sits between public business data and personal data, and gives procurement and legal teams a ready checklist. It is not legal advice – speak to your counsel about your specific use case.

Why do Indian enterprise buyers ask about DPDP before a trial?

In our recent inquiries from India, enterprise buyers raise the same three topics before they agree to a trial: who owns and may use the delivered data, whether an NDA is in place, and whether any personal data could end up in the feed. That is a healthy sign. It means web data has moved from an analyst's side project into formal vendor onboarding.

The people involved usually include:

Procurement – vendor onboarding, commercial terms, SLA and exit clauses.
Legal and compliance reviewers – DPDP exposure, usage rights, NDA, IT Act and platform-terms questions.
Chief Data Officers and data platform heads – data inventory, security, delivery into Snowflake, BigQuery or an S3 bucket, audit trail.
Category, pricing and e-commerce heads at FMCG, retail and D2C brands – coverage by platform and pincode, freshness and accuracy.
BFSI and consulting teams – market, merchant and price signals for research, credit or advisory work, often with stricter information-security reviews.

What do the DPDP Act and DPDP Rules mean in plain words?

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) governs the processing of digital personal data – any data about an individual who can be identified by or in relation to that data. Organisations that decide why and how personal data is processed are "Data Fiduciaries"; vendors that process it on their behalf are "Data Processors". The individual is the "Data Principal".

The DPDP Rules, 2025 were notified by MeitY as G.S.R. 846(E) dated 13 November 2025 and announced in a PIB release. They apply in phases:

On publication – November 2025: What comes into force — Rules 1, 2 and 17–21 (definitions and the Data Protection Board of India set-up) | What it means for web data buyers — The regulator exists; the clock on compliance has started.
One year after publication – November 2026: What comes into force — Rule 4 (Consent Managers) | What it means for web data buyers — Mostly relevant to consumer-facing businesses, not to public business data feeds.
Eighteen months after publication – May 2027: What comes into force — Rules 3 and 5–16, 22, 23 (notice, security safeguards, breach intimation, retention, children's data, Significant Data Fiduciaries and more) | What it means for web data buyers — Vendor contracts should already reflect security, breach and retention duties.

In early 2026 MeitY consulted industry on shortening the 18-month window to 12 months (S.S. Rana & Co., February 2026). Check the latest gazette notifications with your counsel before you fix internal deadlines.

Three points matter most to a web data buyer:

Penalties are significant. The Schedule to the Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards (DPDP Act 2023).
Security safeguards are spelt out. Rule 6 lists measures such as encryption, masking, access control, logging and monitoring, backups and contract terms with processors (DPDP Rules 2025).
"Publicly available" is narrower than "visible online". Section 3(c)(ii) excludes personal data made publicly available by the individual or by someone legally required to publish it. Advisers caution that this is a narrower test than "it can be found online", so it is not a blanket licence to collect personal data from websites. The safest design for business intelligence is to avoid personal data altogether.

Two older rules also appear in enterprise questionnaires. The IT Act 2000 remains India's core cyber law, and the CERT-In Directions of 28 April 2022 require covered entities to report specified cyber incidents within 6 hours and to keep ICT system logs for a rolling 180 days within India. Ask your provider how its incident and logging practices line up with these.

Public business data vs personal data: where does the line sit?

Most enterprise use cases – price monitoring, digital shelf analytics, assortment tracking, restaurant and menu intelligence, travel rate shopping – need no personal data at all. Risk only appears in a few specific fields. The table below is a practical starting point for your data inventory review.

In-body image 1: public-business-vs-personal-data-india.png – alt 'Table of web data types and their personal-data risk under India's DPDP Act'.

Product listings – title, brand, pack size, MRP, images, category: Personal data risk — None – product information | How a provider should handle it — Collect; document source URL and timestamp.
Selling price, discount, coupons, bank offers: Personal data risk — None – commercial terms | How a provider should handle it — Collect; record the pincode or city used for the check.
Availability / out-of-stock by pincode or dark store: Personal data risk — None – the pincode is a query location, not a person | How a provider should handle it — Collect; use neutral test locations, never customer addresses.
Search rank and sponsored placements: Personal data risk — None | How a provider should handle it — Collect per keyword, platform and location.
Ratings and review counts: Personal data risk — None – aggregate figures | How a provider should handle it — Collect as numbers.
Review text: Personal data risk — Medium – may contain reviewer names, profile links or details people write about themselves | How a provider should handle it — Exclude reviewer names, IDs and photos; deliver de-identified text or aggregated themes only if the use case needs it.
Marketplace seller name: Personal data risk — Low to medium – some sellers are sole proprietors | How a provider should handle it — Keep the public business display name only; never phone numbers, personal emails or home addresses.
Restaurant listings – name, cuisine, menu, prices, rating, area: Personal data risk — Low – business information | How a provider should handle it — Collect business fields; exclude owner names and personal contact numbers.
Hotel and flight prices on OTAs such as MakeMyTrip: Personal data risk — None – public rates | How a provider should handle it — Collect rates, room or fare type, dates and taxes as displayed.
User profiles, customer photos, phone numbers, emails: Personal data risk — High – personal data | How a provider should handle it — Do not collect. A reputable provider will decline this scope.

Which Indian platforms matter, and what data do buyers usually take?

Coverage questions and compliance questions go together: the more platforms in scope, the more important a consistent field policy becomes.

Amazon.in, Flipkart: Typical enterprise data — Prices, discounts, bank offers, Buy Box seller, ratings, search rank | Personal-data note — Seller display names only; exclude reviewer identities.
Blinkit, Zepto, Swiggy Instamart, BigBasket: Typical enterprise data — Pincode-level price, availability, pack size, search rank, delivery time shown | Personal-data note — Use test locations; no customer or delivery-partner data.
Zomato, Swiggy (food delivery): Typical enterprise data — Restaurant listings, menus, item prices, offers, ratings | Personal-data note — Business fields only; exclude reviewer and owner personal details.
MakeMyTrip: Typical enterprise data — Hotel and flight prices, availability, taxes and fees as displayed | Personal-data note — Public rates only; no traveller data.

For platform-specific detail, see our pages on quick-commerce data collection and Flipkart and Amazon India marketplace intelligence. Collection is limited to publicly visible pages, respects site terms and never involves logging in to accounts.

Why do reputable providers exclude personal data by design?

It is not needed. Pricing, availability and shelf metrics answer business questions without any individual's details.
It lowers your DPDP exposure. If no personal data reaches you, there is far less to secure, retain, notify about or erase.
The "publicly available" exclusion is narrow. Relying on it for scraped personal data is a legal judgement your counsel should make, not a vendor shortcut.
Platform terms and other laws still apply. Contract, copyright and IT Act questions exist regardless of the DPDP Act.

What should be on your web data vendor due diligence checklist in India?

Use this table in your RFP or vendor questionnaire. Ask for evidence, not just a yes.

In-body image 2: web-data-vendor-checklist-india.png – alt 'Enterprise checklist for vetting a web data provider in India'.

Data inventory: What to ask — Which fields will you deliver, from which sources? | Good evidence — Field list with definitions, sample file, source list
Personal-data exclusion: What to ask — Which fields are excluded, and how is that enforced? | Good evidence — Written exclusion list; QA rule that blocks personal fields
Collection method: What to ask — Public pages only? Any logins or bypassing access controls? | Good evidence — Written statement: public pages only, no logins
Usage rights: What to ask — What may we do with the data – internal use, client reports, models? | Good evidence — Usage clause in the MSA or order form
NDA and confidentiality: What to ask — Will you sign our NDA before scoping? | Good evidence — Signed mutual NDA; your use case kept confidential
Retention and deletion: What to ask — How long do you keep raw and delivered data? | Good evidence — Retention schedule; deletion on request or at contract end
Security: What to ask — Encryption, access control, logging, backups? | Good evidence — Security summary mapped to Rule 6 themes
Incidents: What to ask — How and how fast will you tell us about an incident? | Good evidence — Notification clause and named contact
Data location: What to ask — Where is data stored and delivered? | Good evidence — Option to deliver into your own cloud bucket in the region you choose
SLA and QA: What to ask — Freshness, delivery time, accuracy checks, re-runs? | Good evidence — SLA document; QA report on a sample
Audit trail: What to ask — Can we trace each record to source and time? | Good evidence — source_url and captured_at on every row; crawl logs
Sub-processors and exit: What to ask — Who else touches the data? What happens at exit? | Good evidence — Sub-processor list; exit and hand-over clause

How to run due diligence in five steps

Define the use case in one paragraph. Platforms, countries or cities, categories, refresh rate and who will use the output.
Ask for a field-level data inventory. Mark every field as business or personal; personal fields should be zero for most projects.
Test a sample. Request a sample in 24 hours on your own SKUs, pincodes or restaurants and check accuracy against the live sites.
Review the paper. NDA, MSA with usage rights, retention, security annex, incident clause and SLA.
Agree on an audit routine. Monthly QA summary, change log for platform changes and a named escalation contact.

What should you put in the contract and RFP?

Scope and exclusions – the field list, plus an explicit statement that no personal data of individuals is collected or delivered.
Usage rights – internal analytics, client deliverables (for consulting firms), model training if relevant, and any limits.
Confidentiality – a mutual NDA covering your SKU lists, competitor sets and strategy.
Retention and deletion – how long the provider keeps raw captures and delivered files, and confirmation of deletion at the end.
Security annex – encryption in transit and at rest, role-based access, logging and monitoring, backup.
Incident notification – a defined notice period and contact; ask how the provider handles CERT-In reporting for its own systems.
SLA – delivery time, freshness, coverage targets, accuracy checks and re-run commitments, stated as targets rather than guarantees.

For the law from the data-team side, read our India DPDP Act and web scraping compliance guide and the GDPR, CCPA and DPDP ethical scraping checklist.

How does Actowiz support enterprise web data buyers in India?

Actowiz Solutions delivers managed web data feeds, APIs and Actowiz Metrics dashboards for Indian brands, retailers, BFSI and consulting teams. For enterprise projects in India we typically provide:

Coverage: Amazon.in, Flipkart, Blinkit, Zepto, Swiggy Instamart, BigBasket, Zomato, Swiggy, MakeMyTrip and other public sites, by city or pincode where the platform shows local data.
Freshness: daily, intraday or weekly refresh, agreed per platform during scoping.
Delivery: API, CSV or JSON, or direct delivery to S3, Snowflake or BigQuery.
QA: automated checks for missing values, price outliers and duplicates, plus manual spot checks; QA summary on request.
Trust paperwork: mutual NDA, field-level data inventory with personal-data exclusion, usage-rights terms, retention schedule and security summary.
Sample in 24 hours on your own SKUs, pincodes or outlets.

Frequently Asked Questions

Does the DPDP Act stop us from buying web data in India?

No. The Act governs personal data. Public business data such as product prices, availability, search rank and aggregate ratings is not personal data. Confirm your specific use case with your counsel.

Is publicly visible personal data exempt under the DPDP Act?

Section 3(c)(ii) excludes personal data made public by the individual or by someone legally required to publish it. Advisers read this narrowly, so reputable providers simply exclude personal fields.

When do the DPDP Rules fully apply?

Most obligations, including security safeguards and breach intimation, apply 18 months after the Rules were notified in November 2025, i.e. around May 2027. MeitY has consulted on shortening this, so check the latest gazette.

Is our web data vendor a Data Processor under DPDP?

Only if it processes personal data on your behalf. If the feed contains no personal data, DPDP processor duties are largely not engaged, but security, NDA and contract terms still matter.

Can the data be stored in India?

Ask your provider. A practical option is delivery straight into your own cloud bucket or warehouse in the region you choose.

What should we request before a trial?

An NDA, a field-level data inventory, usage-rights terms, a security summary and a sample on your own products or locations.

Conclusion

You can also reach us for all your mobile app scraping, data collection, web scraping, and instant data scraper service requirements!