Web Data Vendor Due Diligence in India: An Enterprise Buyer's DPDP Guide (2026)

Introduction

Indian enterprises now buy web data the way they buy any other critical input: through procurement, legal review and an information-security questionnaire. Marketplace prices from Amazon.in and Flipkart, quick-commerce shelf data from Blinkit, Zepto and Swiggy Instamart, and restaurant data from Zomato and Swiggy all feed pricing, category and strategy decisions. The question reviewers ask first is simple: does this data carry personal data, and can the provider prove it does not?

Short answer: Web data vendor due diligence in India means checking that a provider collects only public business data (products, prices, stock, ranks, aggregate ratings), excludes personal fields by design, and backs this with a written data inventory, NDA, clear usage rights, retention rules, security controls, an SLA and an audit trail. The DPDP Act 2023 makes this review a board-level topic.

This guide explains the Digital Personal Data Protection Act and the DPDP Rules in plain words, shows where the line sits between public business data and personal data, and gives procurement and legal teams a ready checklist. It is not legal advice – speak to your counsel about your specific use case.

Why do Indian enterprise buyers ask about DPDP before a trial?

In our recent inquiries from India, enterprise buyers raise the same three topics before they agree to a trial: who owns and may use the delivered data, whether an NDA is in place, and whether any personal data could end up in the feed. That is a healthy sign. It means web data has moved from an analyst's side project into formal vendor onboarding.

The people involved usually include:

• Procurement – vendor onboarding, commercial terms, SLA and exit clauses.
• Legal and compliance reviewers – DPDP exposure, usage rights, NDA, IT Act and platform-terms questions.
• Chief Data Officers and data platform heads – data inventory, security, delivery into Snowflake, BigQuery or an S3 bucket, audit trail.
• Category, pricing and e-commerce heads at FMCG, retail and D2C brands – coverage by platform and pincode, freshness and accuracy.
• BFSI and consulting teams – market, merchant and price signals for research, credit or advisory work, often with stricter information-security reviews.

What do the DPDP Act and DPDP Rules mean in plain words?

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) governs the processing of digital personal data – any data about an individual who can be identified by or in relation to that data. Organisations that decide why and how personal data is processed are "Data Fiduciaries"; vendors that process it on their behalf are "Data Processors". The individual is the "Data Principal".

The DPDP Rules, 2025 were notified by MeitY as G.S.R. 846(E) dated 13 November 2025 and announced in a PIB release. They apply in phases:

In early 2026 MeitY consulted industry on shortening the 18-month window to 12 months (S.S. Rana & Co., February 2026). Check the latest gazette notifications with your counsel before you fix internal deadlines.

Three points matter most to a web data buyer:

• Penalties are significant. The Schedule to the Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards (DPDP Act 2023).
• Security safeguards are spelt out. Rule 6 lists measures such as encryption, masking, access control, logging and monitoring, backups and contract terms with processors (DPDP Rules 2025).
• "Publicly available" is narrower than "visible online". Section 3(c)(ii) excludes personal data made publicly available by the individual or by someone legally required to publish it. Advisers caution that this is a narrower test than "it can be found online", so it is not a blanket licence to collect personal data from websites. The safest design for business intelligence is to avoid personal data altogether.

Two older rules also appear in enterprise questionnaires. The IT Act 2000 remains India's core cyber law, and the CERT-In Directions of 28 April 2022 require covered entities to report specified cyber incidents within 6 hours and to keep ICT system logs for a rolling 180 days within India. Ask your provider how its incident and logging practices line up with these.

Public business data vs personal data: where does the line sit?

Most enterprise use cases – price monitoring, digital shelf analytics, assortment tracking, restaurant and menu intelligence, travel rate shopping – need no personal data at all. Risk only appears in a few specific fields. The table below is a practical starting point for your data inventory review.

In-body image 1: public-business-vs-personal-data-india.png – alt 'Table of web data types and their personal-data risk under India's DPDP Act'.

Which Indian platforms matter, and what data do buyers usually take?

Coverage questions and compliance questions go together: the more platforms in scope, the more important a consistent field policy becomes.

For platform-specific detail, see our pages on quick-commerce data collection and Flipkart and Amazon India marketplace intelligence. Collection is limited to publicly visible pages, respects site terms and never involves logging in to accounts.

Why do reputable providers exclude personal data by design?

• It is not needed. Pricing, availability and shelf metrics answer business questions without any individual's details.
• It lowers your DPDP exposure. If no personal data reaches you, there is far less to secure, retain, notify about or erase.
• The "publicly available" exclusion is narrow. Relying on it for scraped personal data is a legal judgement your counsel should make, not a vendor shortcut.
• Platform terms and other laws still apply. Contract, copyright and IT Act questions exist regardless of the DPDP Act.

What should be on your web data vendor due diligence checklist in India?

Use this table in your RFP or vendor questionnaire. Ask for evidence, not just a yes.

In-body image 2: web-data-vendor-checklist-india.png – alt 'Enterprise checklist for vetting a web data provider in India'.

How to run due diligence in five steps

• Define the use case in one paragraph. Platforms, countries or cities, categories, refresh rate and who will use the output.
• Ask for a field-level data inventory. Mark every field as business or personal; personal fields should be zero for most projects.
• Test a sample. Request a sample in 24 hours on your own SKUs, pincodes or restaurants and check accuracy against the live sites.
• Review the paper. NDA, MSA with usage rights, retention, security annex, incident clause and SLA.
• Agree an audit routine. Monthly QA summary, change log for platform changes and a named escalation contact.

What should you put in the contract and RFP?

• Scope and exclusions – the field list, plus an explicit statement that no personal data of individuals is collected or delivered.
• Usage rights – internal analytics, client deliverables (for consulting firms), model training if relevant, and any limits.
• Confidentiality – a mutual NDA covering your SKU lists, competitor sets and strategy.
• Retention and deletion – how long the provider keeps raw captures and delivered files, and confirmation of deletion at the end.
• Security annex – encryption in transit and at rest, role-based access, logging and monitoring, backup.
• Incident notification – a defined notice period and contact; ask how the provider handles CERT-In reporting for its own systems.
• SLA – delivery time, freshness, coverage targets, accuracy checks and re-run commitments, stated as targets rather than guarantees.

For the law from the data-team side, read our India DPDP Act and web scraping compliance guide and the GDPR, CCPA and DPDP ethical scraping checklist.

How does Actowiz support enterprise web data buyers in India?

Actowiz Solutions delivers managed web data feeds, APIs and Actowiz Metrics dashboards for Indian brands, retailers, BFSI and consulting teams. For enterprise projects in India we typically provide:

• Coverage: Amazon.in, Flipkart, Blinkit, Zepto, Swiggy Instamart, BigBasket, Zomato, Swiggy, MakeMyTrip and other public sites, by city or pincode where the platform shows local data.
• Freshness: daily, intraday or weekly refresh, agreed per platform during scoping.
• Delivery: API, CSV or JSON, or direct delivery to S3, Snowflake or BigQuery.
• QA: automated checks for missing values, price outliers and duplicates, plus manual spot checks; QA summary on request.
• Trust paperwork: mutual NDA, field-level data inventory with personal-data exclusion, usage-rights terms, retention schedule and security summary.
• Sample in 24 hours on your own SKUs, pincodes or outlets.

Frequently Asked Questions

Does the DPDP Act stop us from buying web data in India?

No. The Act governs personal data. Public business data such as product prices, availability, search rank and aggregate ratings is not personal data. Confirm your specific use case with your counsel.

Is publicly visible personal data exempt under the DPDP Act?

Section 3(c)(ii) excludes personal data made public by the individual or by someone legally required to publish it. Advisers read this narrowly, so reputable providers simply exclude personal fields.

When do the DPDP Rules fully apply?

Most obligations, including security safeguards and breach intimation, apply 18 months after the Rules were notified in November 2025, i.e. around May 2027. MeitY has consulted on shortening this, so check the latest gazette.

Is our web data vendor a Data Processor under DPDP?

Only if it processes personal data on your behalf. If the feed contains no personal data, DPDP processor duties are largely not engaged, but security, NDA and contract terms still matter.

Can the data be stored in India?

Ask your provider. A practical option is delivery straight into your own cloud bucket or warehouse in the region you choose.

What should we request before a trial?

An NDA, a field-level data inventory, usage-rights terms, a security summary and a sample on your own products or locations.

Conclusion

You can also reach us for all your mobile app scraping, data collection, web scraping, and instant data scraper service requirements!