Most Indian D2C founders think data protection law is something that applies to tech companies with databases full of user profiles. It is worth sitting with a simpler fact: if your store takes cash on delivery and issues a GST invoice, you are already processing personal data under the Digital Personal Data Protection Act, 2023. You do not need an app, a CRM, or an analytics stack to be in scope. The two things nearly every Indian Shopify store does by default already qualify.
Take cash on delivery first. A COD order requires a name, a phone number, and a full delivery address, sometimes down to a landmark and a floor number. That is personal data by any reasonable reading of the Act, and it moves through more hands than most founders realise. It sits in your order management system, it gets handed to your 3PL or courier partner for the last mile, and it is often read aloud or typed again by a delivery executive at the doorstep. Each of those is a point where the data is processed, not just stored.
Now take GST invoicing. A compliant tax invoice for a B2C sale carries the buyer's name and address, and if the buyer has supplied a GSTIN for a business purchase, that too. Your invoicing tool, whether it is a Shopify app or a separate accounting system, is a processor the moment it touches that invoice. If that tool is cloud-hosted, which most are, the data has left your own systems and is sitting with a third party you have a commercial relationship with but may never have mapped.
The part founders usually miss
The DPDP Act does not only apply to data you deliberately set out to collect for marketing or analytics. It applies to digital personal data generally, which means the operational exhaust of running an e-commerce business, address fields, phone numbers on a courier manifest, names on an invoice PDF, falls inside it too. A founder who has never run an ad campaign or built an email list can still be processing personal data at meaningful volume simply by fulfilling orders and staying tax compliant.
This matters because most Indian D2C stores run more processors than they can list from memory. A typical setup sends customer data to a pixel for ad tracking, an email or SMS platform for marketing, a WhatsApp Business Solution Provider for order and cart messages, the 3PL for delivery, a reviews app that emails customers after delivery, a payment gateway such as Razorpay, and whatever tool generates the GST invoice. Each of those is a separate place your customers' personal data now lives, with its own retention, its own access controls, and its own risk if something goes wrong.
None of this means a store needs to overhaul how it operates. COD and GST invoicing are not optional for most Indian D2C businesses, and the Act does not ask you to stop doing either. What it does ask is that customers are told, in plain terms, who their data goes to and why, and that the store can actually produce that list if asked. The honest starting point for most founders is simply not knowing the full list of tools their checkout and fulfilment flow sends data to.
That is the practical first step before anything else: a straight accounting of which third-party tools your store sends customer data to, from the pixel on your product pages to the courier partner on your last order. Consent Jet runs that scan against your actual Shopify store, lists every processor it finds with Meta Pixel, Klaviyo-style ESPs, WhatsApp BSPs, 3PLs and review apps as the usual names, and uses that list to fill a plain-English privacy notice, so the notice on your storefront reflects what your store genuinely does rather than a generic template.