---
title: "E-commerce and quick commerce apps: your rights and how to complain"
description: "Online shopping and 10 minute delivery apps: orders, returns, fake calls and your data. Plain steps, helplines and templates."
url: "https://dpdpr.in/rights/ecommerce/"
canonical: "https://dpdpr.in/rights/ecommerce/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# E-commerce and quick commerce apps: your rights and how to complain

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

## What data they hold

- Name, phone, email and delivery addresses.
- Everything you bought, searched for and viewed.
- Payment details (often held by a payment company).
- Location while the app is open.

## Your rights under current law

- The Consumer Protection (E-Commerce) Rules, 2020 apply to all online sellers and marketplaces, including quick commerce. Each must appoint a grievance officer and show the officer's name and contact on the platform (rule 4(4)).
- The grievance officer must acknowledge your complaint within 48 hours and resolve it within one month (rule 4(5)).
- An e-commerce site may not charge you for cancelling unless it also bears similar charges when it cancels on you.
- If the company does not fix it, the National Consumer Helpline (1915) can take it up. Then the Consumer Commission.

## Your DPDP rights once in force

Sections 11 to 14 of the DPDP Act (your rights) and the duties of companies in sections 4 to 10 start on **13 May 2027** (G.S.R. 843(E)). Until then, use the sector rules on this page. After that date you can use both.

From 13 May 2027 you can ask what personal data they hold about you and who they shared it with (section 11), and ask for correction or erasure (section 12). They must stop using data once you withdraw consent, unless a law requires them to keep it. You can also withdraw consent for marketing as easily as you gave it (section 6(4)).

- Access: a summary of your data and who it was shared with ([section 11](https://dpdpr.in/act/section-11/)).
- Correction, completion, updating and erasure ([section 12](https://dpdpr.in/act/section-12/)).
- Grievance redressal by the company, before going to the Board ([section 13](https://dpdpr.in/act/section-13/)).
- Nominate someone to act after your death or incapacity ([section 14](https://dpdpr.in/act/section-14/)).
- Withdraw consent, as easily as you gave it ([section 6(4)](https://dpdpr.in/act/section-6/)).

## Common problems

- Calls from fake 'delivery partners' asking for an OTP or a fee.
- A fake customer care number found through a search engine.
- Your address and order details used by scammers.
- Endless marketing SMS after you deleted the app.

## Evidence to keep

- Order ID, invoice and screenshots of the order.
- Call log or message from the fake caller.
- Your complaint to the company and its ticket number.
- Payment SMS for any money lost.

See the full [evidence checklist](https://dpdpr.in/rights/evidence-checklist/).

## How to approach, step by step

Go in this order. Start with the company. Move to the next step only when the time limit has passed or the reply is not good enough. If money was lost or you were threatened, go to 1930 or the police first.

### Write to the company's grievance officer

Most apps and websites must name a grievance officer. E-commerce sites, ride apps and platforms such as job portals, dating and matrimony apps all have one under the rules that apply to them.

**Keep this ready before you start:**

- Your account ID, registered mobile or email, and order or booking number.
- Screenshots and dates.
- What you want: delete my data, stop calls, refund, remove a profile.

1. Open the app or website. Look for **Grievance Officer**, **Contact us** or **Privacy policy**. The officer's name and contact must be shown there.
2. Write a short complaint. Use the template on this page.
3. Attach screenshots.
4. Send it. Save the acknowledgement or ticket number and the date.
5. Wait for the time limit for that kind of company (shown in the time limits on this page).
6. If there is no reply, send one reminder with your ticket number.
7. Then go to the next step on this page.

Checked on 1 November 2026 against: [National Consumer Helpline FAQ: Consumer Protection (E-Commerce) Rules, 2020](https://consumerhelpline.gov.in/faq-details.php?fid=E-Commerce), [IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 10 February 2026](https://www.meity.gov.in/documents/act-and-policies/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021-it-rules-2021-IjM5QjMtQWa).

### National Consumer Helpline, then the Consumer Commission

The National Consumer Helpline (NCH) is run by the Department of Consumer Affairs. It forwards your complaint to the company and tracks the reply. If that fails, you can file a case before a Consumer Commission on e-Jagriti.

**Keep this ready before you start:**

- Bill, invoice, order ID or account number.
- Your complaint to the company and its reply, if any.
- Screenshots and dates.

1. Call **1915** or **1800114000** (8 AM to 8 PM), or WhatsApp **+91 8800001915**.
2. Or open [consumerhelpline.gov.in](https://consumerhelpline.gov.in/public/) and click **Register Grievance**. You can also use the NCH app or the UMANG app.
3. Describe the problem, the company and what you want.
4. Save the grievance number you are given.
5. Use **Track Your Grievance** to see the company's reply. Use **Upload Documents** to add proof.
6. If the company still does not fix it, you can file a consumer case on [e-Jagriti](https://e-jagriti.gov.in), the official portal for Consumer Commissions. It uses OTP registration, online fees and virtual hearings.
7. File the case within 2 years of the problem. This is the limit in section 69 of the Consumer Protection Act, 2019.

Checked on 1 November 2026 against: [National Consumer Helpline (Department of Consumer Affairs)](https://consumerhelpline.gov.in/public/), [e-Jagriti: file a case before a Consumer Commission](https://e-jagriti.gov.in/).

### Report a fraud call, SMS or WhatsApp on Chakshu (Sanchar Saathi)

Chakshu is run by the Department of Telecommunications. Use it for calls or messages that try to cheat you, such as fake KYC, fake police, fake customer care, job or loan offers and sextortion. It is for numbers that tried to cheat you. If you already lost money, call 1930 first.

**Keep this ready before you start:**

- A screenshot of the call log or message. The form asks for one.
- The number or SMS header that contacted you.
- Date and time (within the last 30 days).
- Any phone numbers or links mentioned in the message.
- Your own mobile number, to get an OTP.

1. Open [sancharsaathi.gov.in/sfc](https://sancharsaathi.gov.in/sfc/), or open the **Sanchar Saathi** app (Google Play or App Store).
2. On the website, under **Citizen Centric Services**, choose **Chakshu - Report Suspected Fraud Communication**.
3. Under **Report Suspected Fraud**, click **Proceed**.
4. Choose how it came: call, SMS or WhatsApp.
5. Choose the category. The list includes: KYC and Payment related to Bank / Electricity / Gas / Insurance; Impersonation as Police, CBI, Customs, Aadhaar, RBI; Fake Customer Care Helpline; Online job / lottery / gifts / loan offers; Sextortion; IVR / Robo Calls; Malicious link / website; Investment, Stock Market and Trading; Impersonation as DoT / TRAI; Impersonation as a relative / friend; Any Other Suspected Fraud.
6. Attach the screenshot. The portal may fill some details from the image. Check them.
7. Type the number it came from. For an SMS with a name instead of a number, choose **With header** and type the header.
8. Enter the date and the time in HH:MM AM/PM format.
9. In **complaint details**, write at least 30 characters. Say what they asked for and what they claimed.
10. Add any phone numbers and links that were in the message.
11. Enter the mobile number on which you got the call or message.
12. Type the captcha. Click **Verify Mobile via OTP**. Enter the OTP. Click **Verify OTP**.
13. Tick the declaration. Click **Preview**. Check it. Click **Submit**.
14. Take a screenshot of the thank you message. The Department says it will not send you individual results, for privacy reasons.
15. If it came on WhatsApp, also report the chat inside WhatsApp. The portal asks you to do this.

Checked on 1 November 2026 against: [Chakshu: report suspected fraud or spam (Sanchar Saathi)](https://sancharsaathi.gov.in/sfc/), [Sanchar Saathi portal and FAQ (Department of Telecommunications)](https://sancharsaathi.gov.in/).

### Use your DPDP rights (from 13 May 2027)

The rights in sections 11 to 14 of the DPDP Act, and the duties of companies that go with them, start on 13 May 2027 (G.S.R. 843(E)). Until then you can still write to a company and ask. Many will answer. But they are not yet bound by these sections.

**Keep this ready before you start:**

- The company's published method for rights requests. Rule 14 says companies must show it on their website or app.
- The identifier they ask for, such as your username, customer ID or registered mobile number.

1. Find the company's rights or grievance page, or its Data Protection Officer contact.
2. Send a written request using the method they publish. Use our [request letter template](https://dpdpr.in/rights/rights-request-letter/).
3. Ask for what you need: a summary of your data and how it is used, and the names of everyone it was shared with (section 11); correction, completion, updating or erasure (section 12); or a fix for a grievance (section 13). You can also nominate someone to act for you after death or incapacity (section 14), and withdraw consent (section 6(4)).
4. Save the acknowledgement or ticket number.
5. Wait for the time they publish. Rule 14(3) says it cannot be more than 90 days.
6. If they refuse or do not answer, you can complain to the Data Protection Board of India. You must use the company's grievance route first (section 13(3)).
7. The Board works as a digital office. Use the method it publishes on its website and app (rule 19). We will add the link when the Board publishes it.

Checked on 1 November 2026 against: [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf), [Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf), [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf).

## Ready-to-use complaint

Copy, fill the brackets, and send it through the company's official channel. Keep a copy.

To: Grievance Officer, \[company\] Subject: Complaint about order \[order ID\] and use of my data On \[date\] I \[describe the problem: wrong item, refund not received, call from someone quoting my order\]. I want \[refund / replacement / my data deleted / marketing stopped\]. Under rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020 please acknowledge within 48 hours and resolve within one month. \[Name\], \[registered mobile\], \[date\]

## Time limits

- Acknowledgement: 48 hours. Resolution: one month.
- Consumer case: within 2 years.
- Spam complaint about the company's marketing: within 7 days.
- DPDP rights: from 13 May 2027.

## If this happened to you

- [\*\*A delivery person or courier kept my number and is contacting me\*\*A delivery person messages or calls you after delivery, or a 'courier' calls about a parcel.](https://dpdpr.in/rights/scenarios/delivery-partner-misuse/)
- [\*\*A customer care number turned out fake, or a real agent misused my data\*\*A helpline number you found online led to a scammer, or a real support agent misused your details.](https://dpdpr.in/rights/scenarios/fake-customer-care/)
- [\*\*A company keeps sending marketing after I said stop\*\*Calls, SMS or emails continue after you opted out or registered DND.](https://dpdpr.in/rights/scenarios/marketing-after-opt-out/)
- [\*\*A company told me my data was leaked in a breach\*\*You got a breach notice, or read that a company you use was hacked.](https://dpdpr.in/rights/scenarios/breach-notice/)
- [\*\*A self-drive car rental host has my licence, ID and number, and is misusing them\*\*You rented on a platform like Zoomcar where the car belongs to a private host, and the host now contacts you or misuses your documents.](https://dpdpr.in/rights/scenarios/self-drive-rental-host/)
- [\*\*A seller from a shopping app contacted me on WhatsApp or by phone\*\*After an order, a seller messages you directly, to sell, ask for reviews, or offer refunds outside the app.](https://dpdpr.in/rights/scenarios/seller-contacted-off-platform/)
- [\*\*The car rental app's face check failed after I paid and I could not get my money back\*\*You paid for a self drive booking, then the app's identity check failed and the refund is stuck.](https://dpdpr.in/rights/scenarios/rental-face-check-refund/)
- [\*\*As a host, my car was taken by someone who did not match the account\*\*You list your car on a sharing platform, and the person who took it is not the verified guest.](https://dpdpr.in/rights/scenarios/host-car-taken-by-other/)
- [\*\*A self drive rental kept my deposit and stopped responding\*\*Your security deposit was not refunded and support does not reply.](https://dpdpr.in/rights/scenarios/self-drive-deposit-kept/)
- [\*\*I got a cash on delivery parcel I never ordered, or someone placed orders in my name\*\*A courier brings a parcel you did not order and asks for cash, or orders appear under your name.](https://dpdpr.in/rights/scenarios/cod-parcel-never-ordered/)
- [\*\*Right after an online order, scammers called with my order details\*\*Callers knew what you ordered and asked for payment, an OTP or a 'refund' step.](https://dpdpr.in/rights/scenarios/scam-call-after-order/)
- [\*\*I bought from a brand's own website and scammers knew my order\*\*After buying directly from a brand, callers quoted your order.](https://dpdpr.in/rights/scenarios/brand-website-order-leak/)
- [\*\*A home service professional contacted me outside the app, or I am unsure who sees my details\*\*You booked a plumber, cleaner or beautician through an app and want to know where your details go.](https://dpdpr.in/rights/scenarios/home-service-professional/)
- [\*\*The movers app subcontracted my move and I could not get support\*\*You booked packers and movers through an app, a different firm turned up, and things went wrong.](https://dpdpr.in/rights/scenarios/movers-subcontracted/)
- [\*\*I searched once on a local search app and get calls for months\*\*After one enquiry on a local listings site, vendors call you for months.](https://dpdpr.in/rights/scenarios/local-search-calls/)
- [\*\*After posting on a B2B marketplace, scammers and spam callers reached me\*\*Your business listing or buy request on a trade marketplace brought scam calls.](https://dpdpr.in/rights/scenarios/b2b-listing-spam/)
- [\*\*After buying medicine online, the pharmacy app will not stop calling\*\*An online pharmacy keeps calling and messaging about refills and offers.](https://dpdpr.in/rights/scenarios/pharmacy-app-calls/)
- [\*\*The online lab gave me a wrong report\*\*A home collection or app based lab gave a result that turned out to be wrong.](https://dpdpr.in/rights/scenarios/online-lab-wrong-report/)
- [\*\*I paid for a premium job portal plan and got scam calls instead of jobs\*\*A paid profile boost brought fake recruiters.](https://dpdpr.in/rights/scenarios/premium-job-plan-scam/)
- [\*\*My gym or salon keeps messaging me or shared my details\*\*A gym, salon or fitness app keeps sending offers or passed your number to partners.](https://dpdpr.in/rights/scenarios/gym-shared-my-details/)
- [\*\*The ticketing platform might hand my details to an organiser or someone else\*\*You want to know who sees your name, number or ID when you book event tickets.](https://dpdpr.in/rights/scenarios/ticketing-platform-details/)
- [\*\*I bought cricket or concert tickets from a site that turned out to be fake\*\*You paid for tickets on a lookalike site or a resale post and got nothing.](https://dpdpr.in/rights/scenarios/fake-tickets-site/)

## Official sources

- [National Consumer Helpline FAQ: Consumer Protection (E-Commerce) Rules, 2020](https://consumerhelpline.gov.in/faq-details.php?fid=E-Commerce)
- [PIB, 27 July 2020: Consumer Protection (E-Commerce) Rules, 2020 in force](https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=1641559)
- [National Consumer Helpline (Department of Consumer Affairs)](https://consumerhelpline.gov.in/public/)
- [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf)
- [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf)