DPDP Rules 2025: What Shopify Stores in India Must Do Before May 2027

The DPDP Rules 2025 give Indian Shopify stores until May 2027 to comply. The timeline, what consent, notices, marketing opt-in, breach reporting and data rights mean for a D2C store, and a plan to get there.

The DPDP Rules 2025 are the rules that bring India's Digital Personal Data Protection Act, 2023 into force, and every Shopify store in India that collects a customer's name, phone number, email or address falls within their reach. The Rules were notified in November 2025 and phase in over eighteen months, so most of the obligations that matter to an online store apply from mid-May 2027. That sounds far away. For a D2C brand in the middle of its festive season, with a busy first quarter to follow, it is closer than it looks.

This post explains the DPDP timeline for D2C stores and what each part means in practice: consent, notices, marketing opt-in, security, breach reporting, customer rights and your app stack. It is written by a software company, not a law firm, and it is not legal advice. It is a plain-language map of what the Act and the Rules say, drawn from the Rules as notified, PIB's explainer on them and the Act itself, so you can have a better-informed conversation with your lawyer and your developers.

The DPDP Rules 2025 timeline in one place

Parliament enacted the Digital Personal Data Protection Act on 11 August 2023. The Rules that make it work were notified by the Ministry of Electronics and Information Technology as G.S.R. 846(E), dated 13 November 2025, and published in the Gazette of India on 14 November 2025. PIB's explainer gives 14 November as the notification date; many guides use 13 November. Either way, the Rules come into force in three phases, measured from publication.

• November 2025, on publication: the definitions and the rules that set up the Data Protection Board of India came into force immediately.
• November 2026, one year after publication: the rules on registration and obligations of Consent Managers come into force. Registration for Consent Managers opens around 13 to 14 November 2026.
• May 2027, eighteen months after publication: everything else that matters to a store comes into force, including notices, security safeguards, breach reporting, children's data, rights of Data Principals and grievance handling. Guides differ on whether the exact date is 13 or 14 May 2027, so plan for the earlier one.

The Act itself sets the penalties. According to PIB's explainer, the highest penalty, up to ₹250 crore, applies to a failure to maintain reasonable security safeguards. Failing to notify the Board or affected individuals of a personal data breach, and breaching the obligations on children's data, can each attract up to ₹200 crore. Any other violation of the Act or Rules can attract up to ₹50 crore. These are maximums set by law, not typical fines, but they tell you where the law puts its weight: security and breach reporting.

Who is who: your store, your customers and your apps

The Act uses a few terms you will see everywhere, and it helps to map them to a Shopify store before going further.

• Data Fiduciary: whoever decides why and how personal data is processed. For a D2C store, that is you, the brand.
• Data Principal: the person the data is about. Your customers, subscribers and anyone who fills in a form on your site.
• Data Processor: anyone who processes personal data on your behalf. Shopify, your payment gateway, your courier aggregator, your email and WhatsApp tools, and most of your apps fall here.
• Consent Manager: a registered, India-based entity that offers people a single platform to give, manage, review and withdraw consent. Using one is an option for businesses, not a requirement.
• Data Protection Board of India: the digital-first regulator that handles complaints and breaches. PIB says citizens will be able to file complaints online and track them through a portal and app.

The point that matters most is that responsibility sits with the fiduciary. When an app or service provider processes your customers' data on your behalf, the Act still holds you responsible for that processing. That is why the app stack section later in this post is not optional reading.

Consent: what the Act asks for

Under the Act, consent has to be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action, and limited to the personal data needed for the stated purpose. People must be able to withdraw consent at any time, and the Rules say withdrawal must be as easy as giving consent in the first place.

For an online store, a few practical readings follow, though the details are exactly what to confirm with a lawyer.

• Bundled consent is hard to defend. A single checkbox that covers order processing, marketing emails, WhatsApp messages and sharing with ad platforms is not specific.
• A pre-ticked box is hard to square with a clear affirmative action. If the customer did nothing, it is difficult to say they agreed.
• Asking for more than you need is a problem in itself. If a field on your checkout or sign-up form does not serve the stated purpose, question whether you should collect it.
• Withdrawal has to work in practice. An unsubscribe link that works, a WhatsApp stop keyword that is honoured, and an account setting that actually changes something.

The Act also recognises some legitimate uses that do not need separate consent, including where a person voluntarily provides their data for a specified purpose and has not objected. Many stores will reasonably rely on this for fulfilling an order. Where the line sits for your store, particularly for anything beyond fulfilling the order, is a question for your legal adviser.

Notices: what a DPDP consent notice must contain

Rule 3 sets out what a notice must look like. It must be understandable on its own, without the customer having to read another document, and written in clear and plain language. It must give an itemised description of the personal data being collected and the specific purpose for each item, and describe the goods, services or uses that the processing enables. It must also give the customer a way to withdraw consent, to exercise their rights, and to complain to the Board, with links or other accessible means.

Compare that with a typical Shopify store's privacy policy: one long page, often adapted from a template, linked in the footer and read by nobody. The Rules point towards something different: short, itemised notices shown at the moment data is collected, in plain language. PIB's explainer adds that every Data Fiduciary must issue a separate consent notice that explains the specific purpose for which personal data is collected and used.

Where a store collects data is where a notice probably belongs:

• Checkout, where name, phone, email and address are collected to fulfil the order.
• Newsletter and popup sign-ups, where an email or phone number is collected for marketing.
• Account creation and login, especially phone-number login with OTP.
• WhatsApp opt-in widgets and back-in-stock alerts.
• Contact forms, reviews and any quiz or survey that asks personal questions.

Your full privacy policy still matters as a complete reference. The change is that the short notice at the point of collection has to stand on its own.

Marketing opt-in on a Shopify store

Marketing is where most D2C stores collect consent every day, and where habits are most likely to need changing. Shopify's checkout settings include a marketing opt-in checkbox for email, and, according to Shopify's help centre, you can choose whether that checkbox is preselected, either automatically by region or for regions you pick yourself. You can also choose no regions, so the box is never preselected and every customer has to tick it themselves.

Given the Act's requirement for a clear affirmative action, reviewing that setting is a reasonable early step. More broadly, look at every place your store adds people to a marketing list:

• Checkout email and SMS opt-ins, and whether either is preselected for India.
• Popups that offer a discount in exchange for an email or phone number, and what the popup says the number will be used for.
• WhatsApp opt-ins, including any added by an app during checkout or on the order confirmation page.
• Lists imported from a marketplace, an event or an old platform, where you may have no record of how consent was given.
• Customers added to marketing because they created an account, rather than because they asked for marketing.

Keeping a record matters as much as the checkbox. If a customer later disputes that they agreed, you want to be able to show when and how consent was given. Shopify records a customer's email and SMS marketing consent status on the customer profile; check what your email and WhatsApp tools record as well, and whether they keep that record when a list is exported or moved.

Security safeguards: the ₹250 crore obligation

Rule 6 describes reasonable security safeguards: measures such as encryption, obfuscation, masking or the use of virtual tokens; access controls; and logging, monitoring and review of access, with logs kept so that unauthorised access can be detected and investigated. Rule 8 separately requires personal data and the associated logs of processing to be retained for at least one year from the date of processing.

Shopify handles much of the platform security for your store. What it cannot handle is your own practice: who has staff accounts, what permissions they have, which apps can read customer data, and where exports end up. For most D2C stores, the risks are ordinary and close to home.

• Staff and agency accounts that were never removed after someone left.
• Customer and order exports saved to laptops, shared drives and chat groups.
• Apps installed for a one-off campaign that still have access to customer data months later.
• Shared logins for courier, payment and marketing dashboards.
• Spreadsheets of COD customers or RTO addresses passed between teams without any control.

Closing these gaps costs little and reduces both the chance of a breach and the size of one if it happens.

Breach reporting: without delay, and 72 hours for the Board

Rule 7 is one of the most concrete obligations in the Rules. When a Data Fiduciary becomes aware of any personal data breach, it must, to the best of its knowledge, inform each affected Data Principal without delay, in a concise, clear and plain manner. The message must describe the breach, its likely consequences, what is being done to mitigate the risk, what the person can do to protect themselves, and who to contact.

The fiduciary must also inform the Board without delay, and then, within 72 hours of becoming aware of the breach, or a longer period if the Board allows on request, provide a detailed report: the facts and circumstances, mitigation measures, findings about who caused it, remedial steps and the reports made to affected people. The Rules set no minimum size for a breach before these duties apply.

Seventy-two hours is not long if you have never thought about it. A store that finds out on a Friday evening that an agency's shared login leaked an order export needs to already know who decides, who writes the message to customers, how it is sent and who files the report. Write that down now, as a one-page plan, and include your key app and service providers, because many breaches start with them.

Customer rights and the 90-day response

The Act gives people rights over their data, and the Rules make them practical. According to PIB, individuals can ask for access to their personal data, correction, updating and erasure, and can nominate someone to exercise these rights on their behalf. Data Fiduciaries must respond to such requests within a maximum of ninety days. Rule 9 requires you to publish the business contact information of a person who can answer questions about the processing of personal data.

For a Shopify store, the most common requests will be deleting an account, stopping marketing, and correcting an address or phone number. Shopify supports customer data requests and redaction for individual customer records, but your data also lives in your apps, your email tools, your courier accounts and your spreadsheets. A request process that only covers Shopify is not a complete one.

1. 1Publish a contact for data questions, such as a dedicated email address, on your privacy page and in your notices.
2. 2Write down the list of places customer data lives, from Shopify to the last spreadsheet.
3. 3Decide who handles a request, and how you verify that the person asking is the customer.
4. 4Test the process once with a colleague's test account, end to end, including your apps.
5. 5Keep a simple log of requests and the date each was completed, so you can show you met the ninety-day limit.

Retention and erasure

The Act requires personal data to be erased once the purpose it was collected for is no longer being served, unless another law requires it to be kept. The Rules add specific periods for some large platforms in the Third Schedule. For e-commerce entities with at least two crore registered users in India, personal data must be erased three years after the person last interacted, with at least 48 hours' notice to the person before erasure.

Most D2C Shopify stores are far below two crore registered users, so that specific schedule will not apply to them. The general principle still does: keep what you need, for as long as you need it, and have a reason for anything you keep longer. Tax and accounting law will require you to keep invoices and some order records for years. That is a legitimate reason to retain them. A marketing list of people who have not opened an email since 2021 is harder to justify.

Children's data

Under the Act, a child is anyone under 18, and processing a child's personal data requires verifiable consent from a parent or lawful guardian, with limited exceptions. Most D2C stores sell to adults, including stores that sell children's products, since the buyer is usually a parent. Where a store knowingly collects data from teenagers, for example through a quiz, a community or a student discount, it should take specific advice before May 2027, because this is one of the areas the Act penalises most heavily.

Your app stack is part of your compliance

Because the fiduciary is responsible for processing done on its behalf, every app with access to customer data is part of your compliance picture. Most Shopify stores run a dozen or more apps, and many of them read customer or order data. Now is a good time to list them and ask each developer a few direct questions.

• What customer data does your app read, and what does it store on its own servers?
• Where is that data stored, and for how long?
• What happens to our customers' data when we uninstall the app?
• How will you tell us about a breach, and how quickly?
• Do you share any of our customers' data with third parties, including for advertising?

Uninstall anything you do not use. An unused app with access to customer data is risk without benefit.

Where SellRank stands

We build SellRank, a Shopify app that sorts collections by what sells, so we asked ourselves the same questions. SellRank's storefront component is a web pixel installed through Shopify's Web Pixels API. It counts product views and add-to-carts per product, per day, as aggregate numbers. It records no customer identifiers. For ranking, a collection needs to know that a product was viewed 140 times yesterday, not who viewed it, so the pixel never collects that.

We mention it because it is a useful test for any app you evaluate: does it need personal data to do its job? A merchandising tool does not. A marketing tool does. The more of your stack that works on aggregates, the smaller your compliance surface.

Five common misreadings of the DPDP Rules

• It only applies to big companies. The Act applies to any business processing digital personal data in India. Some duties are heavier for Significant Data Fiduciaries, which the government designates, but the core obligations apply to a small D2C store too.
• Shopify handles it for us. Shopify is a processor for much of your data and handles platform security, but the fiduciary duties, such as notices, consent, rights requests and breach reporting, are yours.
• Nothing applies until May 2027. The main store obligations do start then, but the work to meet them, especially changes to checkout, apps and marketing lists, takes months. Starting in May is starting late.
• A privacy policy is enough. The Rules require notices that stand on their own and itemise what is collected and why. A long policy in the footer does not do that job by itself.
• Only customer data counts. Staff, job applicants, wholesale contacts and influencer partners are Data Principals too, so their personal data is covered as well.

Each of these is an easy assumption to make, and each one would leave a gap that is expensive to close in a hurry.

A realistic plan to May 2027

Most D2C teams are small, and this has to fit around trading. Here is a sequence that does.

• October to early November 2026: nothing that touches checkout. Use the festive season to note where data is collected and which apps touch it.
• Mid-November to December 2026: map your data, review marketing opt-in settings, remove unused apps and old staff accounts, and send the app questionnaire above.
• January to February 2027: rewrite notices for each point of collection and your privacy policy with legal help. Set up a data-request contact and process.
• March 2027: write the breach response plan, including your key providers, and rehearse it once.
• April 2027: implement the new notices and consent flows, test them on mobile, and check your apps' changes are live.
• By mid-May 2027: everything in place, with a simple record of what you did and when.

Watch for further guidance from MeitY and the Data Protection Board over the coming months. The Board's processes, and any clarifications on how the Rules apply to small businesses, may change the detail of this plan, though not its shape.

If you want help working out what your store's apps and integrations actually do with customer data, it is part of the Shopify app stack reviews we do for Indian brands. Get in touch through our contact page, and take the legal questions to a lawyer.