Among founders running smaller D2C stores on Shopify, a common reaction to the DPDP Act is some version of "that's for the big companies, not a store doing a few lakh a month." It is an understandable assumption, and it is not correct. The Act's obligations attach to what you do with personal data, not to how big your revenue line is.
What actually triggers the Act
The Digital Personal Data Protection Act, 2023 treats an organisation as a "data fiduciary" once it determines the purpose and means of processing someone's personal data. A Shopify store does this the moment it takes an order: a customer's name, phone number, email, address, and payment details all count as personal data, and the store is the one deciding what happens to that information, where it is sent, and why. That determination does not scale with revenue. A store doing ten orders a month and a store doing ten thousand are both, in this respect, doing the same thing: collecting personal data and deciding where it goes.
There is no threshold in the Act's text that exempts a business because it is small, and nothing in the publicly available material on the Act suggests one is coming. If a specific revenue or user-count exemption is introduced at some point, it would need to come from the statute or its rules, not from assumption. Until then, the safest working premise for a founder is the plain one: if your store collects shopper data, the obligations the Act describes apply to that collection, regardless of your order volume.
Why the "too small" instinct is understandable anyway
It is not an unreasonable instinct. Enforcement attention, in most regulatory regimes, tends to follow visibility, and a large, well-known brand is a more obvious target than a small one. It is also true that full Section 33 exposure, the point from which financial penalties under the Act become enforceable against stores that have not acted, begins 13 May 2027, which gives smaller stores more runway than headlines about the Act sometimes suggest.
But runway is not the same as exemption. A hypothetical example: a small home-goods store running four orders a day through Shopify is processing exactly the same categories of personal data, name, phone, address, payment reference, as a store doing four hundred. The data flows to the same kinds of processors too, a payment gateway, maybe an email tool, maybe a logistics partner. Size changes the volume of records, not the nature of the obligation.
What this means for a small store today
The practical implication is not that a small store needs a legal team or a six-figure compliance budget. The underlying obligations described in the Act boil down to things any single ops person can do: know which tools your store sends customer data to, tell shoppers plainly what happens to their data, get their consent rather than just displaying a notice, and have a way to handle a shopper's request to access, correct, or delete their data, with the Rules allowing a response window of up to 90 days for that.
None of that scales with revenue either. A store with one founder and no dedicated ops person can do all four of these things in an afternoon once the stack is mapped out, and the mapping itself does not take long for a typical setup of three or four third-party tools.
Consent Jet is built around exactly that starting point, regardless of store size: it scans whatever tools your Shopify store actually uses, builds your privacy notice from what it finds, puts a consent banner on your storefront with a logged record of each shopper's answer, and gives you a place to track access, correction, and deletion requests against their clock.