Under the Digital Personal Data Protection Act, a customer is called a "data principal", the person whose data you hold. The Act gives that person a specific set of rights over data your store holds about them, and it gives your store a window to respond. For a founder running a single Shopify store with no legal team, the question that actually matters is practical: what does a request look like when it lands, and what are you meant to do with it.
The three requests you should expect
The rights that show up in day to day operation are access, correction, and erasure. An access request is a customer asking what data you hold about them and who you have shared it with, for instance a shopper who wants to know whether their phone number went to your WhatsApp provider as well as your courier. A correction request is someone asking you to fix a wrong detail, a misspelt name, an old address still attached to their account, a phone number that changed hands. An erasure request is a customer asking you to delete their data once it is no longer needed for the purpose you collected it for, say a one-time buyer who wants their details removed after the order is long delivered and any statutory retention period has passed.
None of these need to arrive as a formal legal notice. They can come in through a contact form, an email to your support inbox, a DM, or a line in a WhatsApp chat with your support number. The form does not change what it is. If a shopper is asking to see, fix, or remove their personal data, it is a data principal request, and it starts a clock.
The 90-day window, and what it actually covers
The Rules under the Act allow a response window of up to 90 days for these requests. That is the outer limit, not a target, and it exists so a small operation is not expected to turn around a correction or deletion overnight. But the window only protects you if you are actually tracking it. A request that sits unread in a shared inbox for ten weeks because nobody owns it is the same, in practice, as never responding at all.
This is where most D2C stores are quietly exposed. There is rarely one named person who owns "shopper data requests" the way there is a named person who owns refunds or shipping delays. The request arrives, gets forwarded between the founder and whoever is handling support that week, and the clock nobody is watching keeps running. A store does not need legal sophistication to handle this well. It needs a place where every request is logged with a date, so anyone on the team can see what is outstanding and how many days are left, and a clear owner who is responsible for actually completing the access, correction, or erasure in whatever tool the data sits in, whether that is your order system, your ESP, or your WhatsApp platform.
It is worth being honest about where the limits sit too. Logging and tracking a request is different from executing it everywhere the data has travelled. If a customer's record needs to come out of your email platform or your WhatsApp provider, someone still has to go into that tool and do it. A deletion request does not propagate on its own once it is logged.
Consent Jet gives a store a single place to receive these shopper requests and record them with that 90-day countdown attached, so a founder or a single ops person can see at a glance what is open, how long is left, and what still needs doing in each connected tool.