Myntra ↗

Overview

Myntra, India’s largest fashion e-commerce platform, collects uniquely personal data compared to general e-commerce. Beyond standard purchase history, Myntra gathers body measurements (for size recommendations), style preferences, fashion behavior patterns, and increasingly, image data (virtual try-on features). This intimate data profile makes DPDP compliance critically important.

DPDP Readiness: Section-by-Section Analysis

Section 6 — Consent & Notice 🔴

Myntra’s consent mechanism is bundled: “By using Myntra, you agree to the collection and use of your information.”

Unique concern for Myntra: The platform collects potentially sensitive personal data:

• Body measurements (height, weight, waist, chest)
• Style preference algorithms
• Image data from virtual try-on features
• Browsing and wishlist behavior

Under DPDP, this level of personal profiling — especially body measurement data — should require explicit, purpose-specific consent, not a blanket acceptance.

Section 7 — Certain Legitimate Uses ⚠️

Myntra processes data for advertising personalization and shares behavioral data with Flipkart’s advertising ecosystem. This extends well beyond legitimate use provisions under DPDP.

Gap: Fashion recommendation algorithms that profile body types and spending patterns don’t qualify as “legitimate use” under Section 7 — they require explicit consent.

Section 8 — Obligations of Data Fiduciary ⚠️

Standard security measures described including encryption and access controls. However:

• No mention of data protection impact assessments for high-risk processing (body data, image analysis)
• No details on how virtual try-on image data is secured and deleted

Section 9 — Data Retention 🔴

No specific retention timelines for:

• Purchase history (retained indefinitely for recommendation engine)
• Body measurement data (how long is your waist size stored?)
• Virtual try-on photos (are they ever deleted?)
• Browsing behavior and wishlist data
• Style preference profiles

Section 11 — Rights of Data Principal 🔴

• No mechanism to request deletion of body measurement data
• No way to opt out of algorithmic style profiling while continuing to use the platform
• No nomination rights
• No data portability for purchase history and preferences

Section 12 — Right of Grievance Redressal ⚠️

Grievance officer designated but no Data Protection Board escalation path.

Section 16 — Cross-Border Data Transfer 🔴

As a Flipkart subsidiary (Walmart), user data may flow through the broader corporate structure spanning India, US, and global entities. The policy doesn’t clarify:

• What data is shared with Flipkart/Walmart
• Which jurisdictions receive Myntra user data
• Whether body measurement and style data is shared with the parent company’s consumer analytics division

Risk Assessment

Recommendations

1. Implement separate consent for body data — “We’ll use your measurements for size recommendations only. Share for style analytics? [Optional]”
2. Create virtual try-on data deletion policy — “Photos used for virtual try-on are deleted within 24 hours / processed locally on your device”
3. Separate Flipkart/Walmart data sharing — Clear disclosure of what data flows beyond Myntra and for what purpose
4. Define retention schedules by data category — Body measurements, purchase history, and style profiles need distinct timelines
5. Build granular preference controls — Allow users to manage body data, style profiling, and ad targeting independently

How Does Your Policy Compare?

🔍 Run Your Free DPDP Audit →

Take the free 60-second DPDP Audit to check your own company’s liability under the DPDP Act — 16 quick questions, instant risk report.

Analysis conducted by DPDP Consulting, a Meridian Bridge Strategy initiative. For a comprehensive compliance roadmap, book a free consultation.