Month: November 2025

As India advances towards becoming a developed nation by 2047, e-commerce stands as both catalyst and exemplar of inclusive progress
India stands at a pivotal moment in its retail evolution. With a market valued at US $1.06 trillion and projected to nearly double US $1.93 trillion by 2030, e-commerce is set to contribute close to 16 per cent. What was once seen as a convenient alternative has now become the preferred shopping channel for millions of households.

This festive season alone, the share of households choosing e-commerce as their primary mode of shopping surged by 115 per cent, with more than 60 per cent urban families planning to shop online, according to a recent LocalCircles report. These shifts mark more than a festive upswing—they signal a structural transformation in buying behaviour that is reshaping retail, widening opportunities for small businesses, and fueling India’s digital and economic momentum.

Central to this change is the growing trust in digital platforms that offer wider product choices, unmatched convenience, and the assurance of easy returns and refunds. What makes this transformation even more significant is its penetration beyond metros. The Deloitte-FICCI report highlights that Tier II and III cities now generate over 60 per cent of all e-commerce transactions in India. This democratisation of opportunity has been powered by affordable smartphones, seamless digital payments, and trustworthy delivery infrastructure.

The true promise of India’s e-commerce revolution lies in how it empowers micro, small, and medium enterprises. Digital marketplaces now connect millions of small sellers—many from India’s heartland—with customers nationwide, ensuring that festive prosperity flows well beyond metropolitan centers.

Government initiatives such as One District One Product (ODOP) and the Production-Linked Incentive (PLI) scheme are further amplifying this transformation. By providing policy support, market access, and incentives, these programmes are creating structured pathways for local entrepreneurs to participate meaningfully in the digital economy.

E-commerce is also proving to be a powerful employment engine. Each festive season generates substantial employment across logistics, packaging, customer service, and technology roles. This serves as both an economic multiplier and an engine for skills development, particularly for young people in smaller cities and towns.

For India’s digital commerce ecosystem to realise its full potential, trust remains fundamental. The recent LocalCircles survey shows that Indian consumers place the greatest trust in platforms with transparent and effective returns and refund processes, with Amazon emerging as the most preferred among e-commerce sites, while Big Basket leads among quick commerce platforms. Nearly 90 per cent households also cite quality assurance, fair pricing, and hassle-free returns as decisive factors in their shopping choices. The takeaway is clear: customer trust is key, and platforms that prioritise consumer protection are not only driving festive sales but also building lasting customer relationships that sustain growth year-round.

The shift to digital payments further illustrates this trust transformation, with over 90 per cent of urban households expected to transact digitally this festive season. Embedded payment solutions, streamlined checkouts, and robust security measures have made online commerce safer and more frictionless than ever, reducing cash dependence while creating efficiencies throughout the value chain.

As India advances towards becoming a developed nation by 2047, e-commerce stands as both catalyst and exemplar of inclusive progress. By connecting remote artisans with global markets, digitising traditional businesses, and creating economic opportunities across the socioeconomic spectrum, e-commerce demonstrates how technology can drive equitable growth and global value chain integration.

The festive season of 2025 may indeed mark a turning point—not just in sales figures but in how we conceptualise commerce itself. By harmonising technological innovation with trust and inclusivity, India’s digital marketplace can establish global benchmarks for responsible retail.

As the lights of celebration brighten homes across our nation, we must reflect on a deeper truth: true progress isn’t measured solely by transaction volumes or growth percentages, but by how we empower communities, preserve cultural heritage, and create opportunities for all Indians. In this journey, e-commerce isn’t simply facilitating commerce—it’s helping write the next chapter of India’s economic story, where every business, consumer, and community has the opportunity to thrive.

India is, therefore, uniquely positioned to drive e-commerce policy discussions in the APAC region by hosting the 2nd APAC E-commerce Policy Summit on November 3-4, 2025, in New Delhi. The summit provides a unique opportunity for all stakeholders in the ecosystem to interact with an objective that digital transformation leaves no one behind.

The author is professor, Indian Council for Research on International Economic Relation

The Digital Personal Data Protection Rules, 2025 provide the operational framework for implementing the Digital Personal Data Protection Act, 2023. They define procedural requirements, compliance mechanisms, consent management norms, data breach obligations, children’s data safeguards, and the functioning of the Data Protection Board (DPB).

These Rules significantly strengthen India’s digital governance architecture, improving consumer trust, enabling global interoperability, and operationalizing state capacity for data protection at scale. They also introduce graded compliance obligations for Significant Data Fiduciaries (SDFs), establish a regulated ecosystem for Consent Managers, and create a digital-first regulatory enforcement system.

The Rules operationalize the DPDP Act by ensuring that digital personal data of Indian citizens is processed lawfully, fairly, and transparently. The core actors under this framework are Data Fiduciaries (entities processing data), Data Principals (individuals), and Consent Managers.

Consent is positioned at the heart of the regime. It must be explicit, verifiable, and based on clear, understandable notices. For children and persons with disabilities, consent must come from parents or lawful guardians through verifiable methods. Individuals are granted straightforward mechanisms to withdraw consent, request access to their data, seek corrections, or demand erasure.

Data Fiduciaries are required to implement strong security safeguards including encryption, access controls, logging, and risk-mitigation processes. In the event of a breach, both the affected Data Principals and the DPB must be informed within 72 hours. Logs of consent and data access must be preserved for at least one year, while Consent Managers must retain consent logs for seven years.

Only the minimum necessary data for a specified purpose may be collected or processed. Once the purpose is fulfilled, the data must be erased unless legal requirements warrant further retention, and individuals must be duly notified of such erasure.

Significant Data Fiduciaries face enhanced responsibilities: they must conduct regular data protection impact assessments and undergo independent audits. Cross-border transfers are permitted, but only under conditions that guarantee adequate protection, with India retaining the right to restrict transfers for national security or strategic considerations.

The Rules empower individuals with clear rights to access, correct, or delete their personal data. They also guarantee an enforceable right to grievance redressal through digital mechanisms, ensuring transparency and timely responses from Data Fiduciaries.

The Rules represent India’s most decisive step in safeguarding digital privacy, reinforcing the fundamental right to privacy under Article 21 of the Constitution. While inspired by global frameworks such as the EU’s GDPR, they remain tailored to India’s unique digital and socio-economic landscape.

By mandating transparent consent processes, strong security standards, and effective redressal pathways, the Rules aim to reinforce trust in digital services. This trust is critical to sustaining growth in India’s digital economy, startup ecosystem, and innovation sectors.

The 18-month phased rollout offers organizations time to redesign systems, update processes, and align operations with the new compliance architecture. The intention is to ensure smooth adaptation while encouraging proactive compliance.

For businesses, especially those handling large volumes of data or engaging in cross-border data flows—the Rules necessitate significant changes in data governance, consumer interaction, and operational practices. The financial and regulatory penalties for non-compliance serve as strong incentives for organizations to adopt a privacy-first approach.

“The DPDP Rules 2025 mark an important and decisive step in building a coherent, implementable data protection framework for India. By defining the consent architecture, strengthening breach-notification obligations, and establishing greater accountability for data fiduciaries including state entities, the Rules enhance transparency in data processing and improve grievance redressal. These elements are essential for accelerating trust in India’s digital economy and aligning the country more closely with global best practices.”

“These rules will enable building digital trust among the people, better compliance by enterprises and quicker decisions by Data Protection Board being digital borne. Principle based approach, severity-based compliance and penalty mechanism and decriminalisation framework will promote technology, innovation and startups. Rules give a clear road map for planning and implementation guidelines regarding children’s data, significant fiduciaries and organisations which will ensure robust personal data privacy and secure data governance. A staggered implementation approach may help in course corrections as different provisions come into effect.”

“Our 2024 study surveying Indian companies on DPDPA implementation revealed a stark reality: most firms estimate at least 24 months to comply, grappling with the immense complexity of mapping data processes, overhauling technical architectures, and redefining product compliance. This aligns with global precedents – two years in Brazil, Japan, and the EU – yet with resource constraints forcing sequential rollouts, a longer grace period is essential to avoid chaos. As deadlines loom, expect widespread calls for extensions to the government. Compounding this, the rules’ failure to exempt behavioral monitoring, tracking, and targeted ads for products that are beneficial for children will deliver a devastating blow to child-focused industries like animation, toys, and publishing.”