DPDP Stack
The Consent Jet blog
DPDP Act guidance for Indian D2C Shopify stores: what the law asks for, in plain language.
A seven-minute checklist before Section 33 exposure lands
Six plain questions any D2C founder can check in seven minutes, whatever tool or process their store actually uses.
Abandoned-cart WhatsApp messages: the consent question nobody asks
A recovery message sent over WhatsApp is its own processing purpose, separate from the number you took to ship an order.
Breach vs incident: what the Rules actually require you to do
A security incident and a reportable breach are not the same thing, and the response still runs through your own tools.
COD and GST invoices: the customer data you're already collecting
Cash-on-delivery capture and GST invoicing already count as personal data processing under India's DPDP Act.
Consent vs notice: the difference every D2C founder confuses
Why publishing a privacy notice is not the same as getting a shopper's consent, and why a DPDP-ready store needs both.
DPDP Act vs GDPR: what Indian D2C founders get wrong by assuming they're the same
The DPDP Act is not GDPR with an Indian accent. Its roles, mechanics, and penalty structure are built differently.
Deletion requests: what you can and can't promise a shopper
A shopper asking you to delete their data deserves an honest answer about what actually happens next, and when.
Marketplace sellers vs D2C: who DPDP hits harder
Selling on a marketplace and running your own Shopify store put very different amounts of DPDP work on your plate.
Meta Pixel, Klaviyo, WhatsApp: your real processor list under DPDP
A walk through the common tools in a D2C stack and why each one makes the merchant responsible for that data flow under DPDP.
Reading the fine print: what withdrawal of consent must look like
Consent you can give in one click but can only withdraw through a support ticket is not real consent under the DPDP Act.
Section 33 penalties explained: what triggers them, what doesn't
What Section 33 of the DPDP Act actually penalises, who decides, and what kind of merchant behaviour draws attention.
The 13 May 2027 deadline: what changes before and after
What practically changes for a D2C Shopify store before and after full Section 33 exposure begins on 13 May 2027.
The myth that you're too small for the DPDP Act to apply
Store size does not decide whether the DPDP Act applies. Collecting shopper data does.
The obligations every e-commerce D2C store carries
Notice, purpose limitation, consent, withdrawal, shopper rights and breach records: the obligation categories every Shopify store carries.
What a consent manager is, and why most apps aren't one
The DPDP Act defines a specific 'Consent Manager' role. Most consent tools, including ours, are not one.
What a processor scan finds, and why most founders are surprised
Most D2C founders underestimate how many tools their store quietly sends customer data to. Here is why.
What counts as a data principal request, and the 90-day clock
Access, correction and erasure requests from shoppers come with a response window of up to 90 days under the Rules.
What investors and auditors are starting to ask Indian D2C founders
DPDP readiness is starting to show up as a due diligence line item for Indian D2C founders raising capital.
What the DPDP Act actually asks of a Shopify store
A plain-English walk through what India's DPDP Act expects from a D2C Shopify store, with no legal background assumed.
Why 'Accept All' cookie banners don't satisfy DPDP consent
A GDPR-style cookie banner with one Accept All button does not meet the DPDP Act's purpose-specific consent bar.