The deadline is fixed. The work takes time.
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data privacy law. It received Presidential assent on 11 August 2023, and the DPDP Rules were notified on 13 November 2025. The core duties for your store, notice, consent, security, breach reporting, retention and data principal rights, become fully enforceable on 13 May 2027. That is 18 months after the Rules were notified. Waiting until April 2027 still leaves you late, because a data map, an app inventory and new legal text rarely finish in a weekend. This guide is general information. Check your own situation with a lawyer.
Who it applies to
There is no general exemption based on turnover or the number of employees. If you process digital personal data of people in India, the law applies to you. A D2C brand is a Data Fiduciary, the organisation that determines the purpose and means of processing. Your customers are Data Principals, the individuals the data belongs to. If you have a contact form, a checkout page or a newsletter signup, it applies to you.
What it costs to get it wrong
Penalties sit with the Data Protection Board of India, and they scale by violation type.
| Failure | Penalty |
|---|---|
| Failing reasonable security safeguards | Up to ₹250 crore |
| Failing to notify a breach | Up to ₹200 crore |
| Children's data violations | Up to ₹200 crore |
| Notice, consent or rights violations | Up to ₹50 crore |
Consent: the change most stores miss
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action. Consent boxes must start unticked. Bundled consent is prohibited. A cookie banner alone does not make a store compliant. Tracking identifiers that can identify a person are personal data, so firing analytics or marketing scripts before consent is processing without notice. Block Google Analytics, Meta Pixel and all ad scripts until the visitor chooses. Keep a record of each consent and each withdrawal, with the time.
Cookies and tracking
Your Meta Pixel and CAPI setup is now a compliance question as well as a tracking question. If the pixel fires before consent, you are processing personal data without a lawful basis. Tracking through CAPI does not remove the consent duty, it only changes how the data moves. Map every tracker on your store, list what each one collects, and gate them behind consent. This is where most D2C stores have their biggest gap.
Data principal rights
Your customers have the right to access their data, correct inaccuracies, erase data, nominate a successor and raise grievances. You must respond within the prescribed timelines. The DPDP Rules give you 90 days to respond to access, correction and erasure requests. Build a simple process now: one inbox or form for requests, one person who owns them, and a log that records the request, the identity check and the closure.
Children's data
Verifiable parental or guardian consent is required before processing data of anyone under 18. Behavioural tracking and targeted advertising to minors are banned. If your brand sells to teenagers, or your ads reach them, this section needs a lawyer's eye.
Breach notification
Notify the Data Protection Board and every affected person without delay when a breach happens. The Board needs a detailed report within 72 hours of you becoming aware. CERT-In directions require intimation of certain cyber incidents within 6 hours. Write the runbook now, while nothing is on fire. Name who does what in the first 72 hours, and keep the contact list current.
The checklist
- Map your data: list what you collect, where it comes from, where it is stored and who can access it.
- Remove what you do not need: stop collecting data you have no clear use for.
- Write a short notice in plain language for each collection point, and link your privacy policy.
- Put a consent banner on your site that blocks ad and analytics trackers until the visitor chooses.
- Keep a record of each consent and each withdrawal, with the time.
- Complete a vendor contract pass: your processors, Shopify apps, email tool and support tool need matching clauses.
- Write retention and deletion runbooks for Shopify, your email tool and your support tool.
- Publish a grievance contact and a simple rights request process.
- Write a breach runbook: who does what in the first 72 hours.
The law gives you until 13 May 2027. The work takes months, not a weekend.
The fastest win is also the biggest risk. If your Meta Pixel or analytics fires before consent, you are processing personal data without a lawful basis. Gate the trackers first, then work through the rest of the list.
