If you run a D2C store on Shopify in India, you have probably heard the phrase "DPDP Act" from a marketplace onboarding form, an investor due diligence checklist, or a legal notice nobody wants to open twice. Most founders have not read the Act, and most do not need to. What they need is a working answer to one question: what does this law actually want from a store like mine.
The Digital Personal Data Protection Act, 2023 is India's first comprehensive personal data law. It treats your store as a "data fiduciary" the moment you collect a customer's name, phone number, email, or address, which is every order you have ever taken. The law does not care that you are small. It cares that you are collecting personal data and deciding what happens to it.
The four things the Act actually asks for
Strip away the legal language and the obligations collapse into four practical requirements.
Know where customer data goes. Your checkout sends data to payment gateways. Your marketing stack sends it to an ad pixel, an email tool, a WhatsApp provider. Your fulfilment sends it to a logistics partner. The Act expects you to know this list, not guess at it.
Tell shoppers, plainly. A privacy notice is not a legal formality buried in a footer link nobody reads. It needs to say, in plain language, what you collect and why, and which third parties see it.
Get consent, not just display a notice. Publishing a notice and recording that a shopper agreed to it are two different acts. The Act requires the second one, not just the first.
Handle requests and incidents on a timeline. A shopper can ask what data you hold, ask you to correct it, or ask you to delete it. The Rules allow a response window of up to 90 days for these requests. Separately, if something goes wrong with how data was handled, there is a countdown to notify that starts running, and a merchant has to act on it in their own tools, not assume it handles itself.
What this looks like for an actual store
Take a hypothetical Mumbai apparel store running the usual stack: Meta Pixel for ads, an email tool like Klaviyo for abandoned carts, WhatsApp through a business solution provider for order updates, and a 3PL for delivery. Every one of those four tools is a point where customer data leaves the store's own hands. Under the Act, the store is responsible for knowing that flow exists, telling shoppers about it, and getting their consent before or alongside it, not after the fact when someone complains.
This is not about becoming a compliance department. It is about having an honest, current answer to "where does our customer data go, and did the shopper agree to that" the day someone asks, whether that someone is a shopper, a marketplace partner, or eventually the Data Protection Board.
Where most stores actually sit today
Very few Indian D2C stores have done this work, mostly because nobody explained it as four concrete steps rather than one intimidating Act. The gap is not that merchants are ignoring the law on purpose. It is that nobody translated the statute into a checklist a single ops person can execute on a Tuesday afternoon.
That is the gap Consent Jet is built to close: it scans your store's actual tools to find who your data goes to, builds a privacy notice from what it finds, puts a consent banner on your storefront that logs every shopper's answer, and gives you a place to record access, correction, and deletion requests on their statutory clock.