Sreeraman MG, Founder, Fynd, writes that AI-driven commerce needs purpose-led data systems rather than more consent screens, with purpose tagging and usage controls built into retail technology stacks
India’s Digital Personal Data Protection Rules became operational in November 2025, with partial enforcement over eighteen months, and businesses building AI shopping agents right now are responding predictably: tightening consent language and treating compliance as a checklist.
A better consent notice solves only one part of the problem, since most retail systems store a customer’s phone number, address, or preferences with no record of why.
I spend most of my time on the systems that run catalogs and orders for retailers and sellers. Most were never built to answer a basic question: why do you have this data, and what are you allowed to do with it?
Take a phone number entered at checkout so a courier can call before delivery. Nobody records why it was collected. So if marketing later pulls the same number for a WhatsApp campaign, the system has no way of knowing it was collected for a different reason.
Digital Personal Data Protection (DPDP) solves half the problem
DPDP does help: it requires businesses to state why they’re collecting personal data before asking for consent. The maximum penalty, ₹250 crore, is specific to failures in security safeguards, with lower caps for other violations, and these provisions are themselves subjected to phased commencement.
But consent is only one part of the problem. What happens when an agent uses that data to make a decision? If it picks a cheaper brand of rice, the consequences are small. If it decides a return looks fraudulent and holds back a refund, or changes what someone pays based on their spending, the stakes are very different. GDPR lets people challenge certain decisions made entirely by machines and have a person review them. DPDP doesn’t have the same provision.
Europe already has these principles: purpose limitation and the right to challenge a fully automated decision have existed under GDPR since 2018. What is being worked out is how those rules apply once an agent, not a person, is acting. Spain’s regulator published a 71-page guidance document on exactly this in February 2026, and the UK’s regulator raised similar questions a month earlier, though it called its own report an early view.
Having the principles in place has not made this simple, which is why no Indian business should wait for a regulator to hand over a ready-made answer. Instead they should build one.
What India needs to build: a purpose ledger
The missing layer is what I call a purpose ledger. Based on what breaks in retail systems today, it needs two things sitting underneath any commerce stack an agent touches.
The first is purpose tagging at the point of capture: when a phone number, an address or a preference gets collected, the system records why, right then. India’s Account Aggregator framework already does this for financial data. Every request states its purpose, duration and the specific fields involved, visible to the person they approve it. By September 2025, more than 112 million people had linked accounts this way, with over 2.2 billion accounts enabled.
The second is ensuring the data retains the purpose it was collected for. A phone number entered for a delivery call shouldn’t be usable by marketing just because the two systems share a database. Anyone using the number could then check whether that particular use was approved.
Tagging correctly can prevent mistakes, but it cannot stop someone who chooses to misuse the data.
Where India already has a head start
This claim needs a caveat of its own. Large retailers, in India and globally, already hold enormous amounts of customer data, but the constraint is not the data itself. It is whether that data was ever captured with a purpose attached, and India already has a head start.
The Account Aggregator model proved that consent naming a specific purpose, with a clear expiry, can run at real scale, tested on more than a hundred million people. Retail has not adopted that discipline yet, but the pattern already exists more than most markets building agentic commerce can say.
Getting there means building systems that already have the answer, whether the question comes from an agent, a regulator, or a customer.
