Most founders encounter the Digital Personal Data Protection Act in fragments, a notice from a marketplace, a clause in an investor's due diligence checklist, a line in a vendor contract. It is worth stepping back and laying out the shape of what the Act actually asks of a D2C store running on Shopify, in plain order, without the legal density that usually comes attached.
Notice
Before or at the point you collect personal data, the shopper is meant to be told what you are collecting it for, in clear language, not buried in a long-form privacy policy nobody reads. For a D2C store this means the privacy notice on your site should actually describe what your checkout, your marketing tools, and your fulfilment chain do with a customer's name, number, and address, rather than being a generic template copied from elsewhere. If your notice does not mention WhatsApp order updates but you send them, the notice and the practice have already drifted apart.
Purpose limitation
Data collected for one purpose should be used for that purpose, not quietly repurposed because it happened to be sitting there. A phone number collected to confirm a COD delivery is not automatically fair game for a WhatsApp marketing broadcast six months later, unless that use was part of what the shopper was told and agreed to. This is the obligation that is easiest to drift into without noticing, because the data is already in your systems and reusing it feels like no extra step at all.
Consent
Where consent is the basis for processing, it needs to be specific to the purpose, not a single bundled yes that covers everything from analytics to retargeting to email marketing in one click. A banner that only offers "Accept All" is answering a different, older question than the one DPDP asks.
Withdrawal
Whatever consent was given has to be as easy to take back as it was to give. A shopper who agreed to marketing emails should be able to withdraw that agreement without needing to write in, wait, or chase support. If withdrawal is harder than consent was, the mechanism is not doing its job.
Data principal rights
Shoppers can ask to access what you hold about them, correct it if it is wrong, or have it erased once it is no longer needed. The Rules give a store a response window of up to 90 days to act on these requests, which is generous, but only if someone is actually tracking which requests have come in and how much of that window is left.
Breach record keeping
Where personal data is actually accessed, disclosed, or lost without authorisation, that is a different category of event from a routine security hiccup, and it carries its own notification obligations with a countdown attached. Keeping a dated record of what happened, when it was identified, and what was done about it matters both for your own accountability and for showing, if ever asked, that the clock was being watched rather than ignored.
Where most stores actually sit
None of these obligations individually require a legal department to meet. What trips up most Rs 1 to 20 crore D2C stores is that each one lives in a different place, a notice nobody has updated since launch, a consent banner left on its factory settings, a support inbox where shopper requests arrive and sit, no record of what happened the one time something went wrong with a vendor. The obligations are manageable one at a time. The failure mode is usually neglect spread across all six, rather than any single dramatic gap.
Consent Jet covers this ground for a Shopify store in one pass, it scans your store for the processors you actually use, builds a privacy notice from what it finds, puts a purpose-specific consent banner on your storefront with tamper-evident logging, and gives you a place to record shopper requests and breach incidents with their statutory countdowns attached.