India's DPDP Rules for D2C Sellers: What to Do With Customer Data

Yes, the DPDP Rules for D2C sellers in India reach small online stores too: we found no small business exemption in the Rules, so a Shopify or WooCommerce store with a few thousand customers that keeps names, phone numbers and delivery addresses should plan as if it is covered. The timing gives you room. On or about 13 November 2026, only Rule 4, which covers Consent Managers, comes into force. The notice, security, breach, request and children's data duties that change how a store runs start on or about 13 May 2027, so this month is for preparing.

The problem usually arrives as one message. A customer on WhatsApp asks you to delete everything you hold about her, or the order sheet you shared with a courier partner turns up in a stranger's inbox, and you realise you do not know where your customer data lives, who can see it, or how fast you must act. This guide turns the Gazette text into a plain checklist for a small store: notices, consent, breaches, requests, retention, children and vendors. It does not settle who is responsible for marketplace order data, and the channel choice itself is weighed up in Flipkart vs Amazon for sellers.

Also ReadThe Real Cost of Selling on Amazon vs Shopify (After Fees, FBA, PPC)

›

Does India's DPDP law apply to a small online store?

Yes, as far as we can tell from the Rules, India's DPDP framework applies to a small online store that collects customer data, because we found no small business exemption in the Rules. In plain terms, the Rules use Data Fiduciary for the business holding the data, Data Principal for the customer, and Data Processor for a vendor that handles the data for you.

The only user count we found that matters for stores sits in the Third Schedule, which sets a timed erasure class for a "Data Fiduciary who is an e-commerce entity having not less than two crore registered users in India." The same entry adds that this "does not include a seller offering her goods or services for sale on a marketplace e-commerce entity". A store with a few thousand customers is nowhere near that class, but that only means one specific timer does not reach you. The notice, security, breach, request and contact duties below have no size threshold that we found.

Think about every place a customer's details land: the checkout form, the order confirmation email, the courier label, the WhatsApp chat, the review request and the abandoned cart app. On your own Shopify or WooCommerce store, the safest working assumption is that the duties for all of those sit with you. If you sell on Amazon, Flipkart or Meesho as well, whether you count as the Data Fiduciary for marketplace orders is not settled in anything we read, so ask an adviser before assuming either way.

A few limits on scope. This guide does not cover GST, consumer protection law, cross-border transfers, Significant Data Fiduciary duties or Consent Manager registration, and it is written for India only. General information, not legal advice. If you also sell to shoppers in Europe, separate rules apply there, including the EU AI Act disclosure rules.

When do the DPDP Rules for D2C sellers start, and what changes on 13 November 2026?

The DPDP Rules start in three phases over eighteen months: Rules 1, 2 and 17 to 21 came into force on publication, Rule 4 on Consent Managers comes into force on or about 13 November 2026, and Rules 3, 5 to 16, 22 and 23 come into force on or about 13 May 2027. The Rules are G.S.R. 846(E), in the Gazette of India dated 13 November 2025. The Gazette says "Rule 4 shall come into force one year after the date of publication of this Gazette." and "Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette."

PIB's backgrounder says "The Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025 on 14 November 2025." Because the Gazette date and the PIB date differ by a day, the start dates below are our own arithmetic and may be a day off, so treat each one as on or about. PIB also confirms the overall window: "The Rules introduce an eighteen-month period for phased compliance." The document readers can open is the PIB backgrounder on the DPDP Rules.

What changes this month is narrow. PIB defines a Consent Manager as "An entity that provides a single, transparent and interoperable platform through which a Data Principal may give, manage, review or withdraw consent." Nothing we read requires a small store to become one or to appoint one. We have also not confirmed whether Consent Manager registration or the Data Protection Board is accepting applications and reports on 13 November 2026, so do not build a plan around either yet.

What must a D2C store put in its customer notice and consent screens?

A D2C store needs a separate, plain-language consent notice that lists each item of personal data you collect, makes sense on its own, and lets customers withdraw consent as easily as they gave it. PIB puts it simply: "Every Data Fiduciary must issue a separate consent notice that is clear and easy to understand." Rule 3 says the notice must "give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, which shall include, at the minimum, an itemised description of such personal data".

Two more lines in Rule 3 change how most stores handle this today. The notice must "be presented and be understandable independently of any other information" you publish, so a checkbox that says "I agree to the privacy policy" is not enough on its own. And customers must be able to "withdraw her consent, with the ease of doing so being comparable to that with which such consent was given". If consent took one tap at checkout, withdrawal should not need an email thread.

For a typical store, the itemised list is shorter than it looks:

• Name, phone number and email address, for order updates and account login.
• Delivery address, shared with your courier partner to ship the order.
• Order history and payment status (card details normally stay with your payment gateway).
• WhatsApp or SMS number for marketing, listed as a separate, optional choice.
• Device, IP and browsing data collected by analytics, pixel and chat tools on your site.

Show the notice where consent happens, at checkout and account creation, and keep a full version on its own page. Write it at the reading level of your customers, not your lawyer, and test it on someone who has never seen your store. If most of your buyers shop in Hindi or another Indian language, consider a version in that language as well, the same thinking that goes into product images in local languages.

What counts as a data breach, and who do I have to tell and when?

Treat any loss, leak or unauthorised access to customer data as a possible personal data breach, because Rule 7 requires you to tell each affected customer without delay and to send the Data Protection Board a detailed report within 72 hours of becoming aware of it. The Act carries the formal definition of a personal data breach, so read that definition with your adviser rather than relying on a summary.

Rule 7(1) says that on becoming aware of a breach, you "shall, to the best of its knowledge, intimate to each affected Data Principal, in a concise, clear and plain manner and without delay". Rule 7(2) adds the detailed report to the Board "within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing in this behalf." The clock starts when you know, not when you finish investigating.

In a small store, breaches rarely look like a movie hack. They look like this:

• An order export emailed to the wrong courier contact or a former employee.
• A shared spreadsheet of customer addresses set to anyone with the link.
• A staff login to the store admin phished, or a laptop with exports stolen.
• A vendor, such as an email, review or WhatsApp tool, telling you it was breached.

Write a one-page plan before May 2027: who decides that an incident is a breach, who drafts the customer message, which vendors to call, and where you record the time you became aware. Keep a short customer message template ready that says what happened, which data was involved and what the customer should do next. We have not confirmed the official channel the Board will use for reports, so check it before the duties start and add it to the plan.

How do I handle customer requests to see, fix or delete their data?

Answer every request to access, correct, update or erase personal data within 90 days at most, and publish a named contact who can answer data questions. PIB says "Data Fiduciaries are required to address all requests related to access, correction, updating or erasure within a maximum of ninety days, ensuring timely action and accountability." Rule 14 sets the same ceiling for grievances, "a reasonable period not exceeding ninety days".

Of all the DPDP Rules for D2C sellers, this is the one customers will test first, and Rule 9 makes the contact public. You must "prominently publish on its website or app, and mention in every response" the contact details of a Data Protection Officer, if you have one, or "a person who is able to answer on behalf of the Data Fiduciary the questions of the Data Principal about the processing of her personal data." For a small brand, that is usually the founder or one named team member, with a dedicated email address in the site footer.

Also ReadAI Agent Rules for Sellers: A Do Alone, Ask First, Never Template

›

A simple request routine works for a store with a few thousand customers:

1. Log each request with the date received, the customer and what they asked for.
2. Confirm the request comes from the customer, for example from the phone or email on the order.
3. Search every system: store admin, email tool, WhatsApp tool, courier dashboard, spreadsheets and backups you control.
4. Act on it, and reply from the published contact, keeping the contact details in the reply.
5. Close the log entry with the date, well inside the 90 day limit.

The search step is where stores slip, because customer data spreads quietly. Keep a written map of every tool that holds customer details and update it whenever you connect something new, since each connection is another place a deletion request has to reach. The same map helps whenever you decide to automate listings across marketplaces.

How long should I keep order records, and when do I have to delete data?

Keep personal data, traffic data and processing logs for at least one year from the date of processing, then delete what you no longer need, including on a customer's request, unless another law requires you to keep it. Rule 8(3) says a Data Fiduciary "shall retain" such personal data, "associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing", including processing done by a Data Processor on your behalf.

Rule 6(1)(e) points the same way for security logs, saying you must "retain such logs and personal data for a period of one year, unless compliance with any law for the time being in force requires otherwise". In practice, before acting on a deletion request, a store needs to know which records it must keep for a set period and which are simply leftovers. Tax and invoice records are outside this guide, so ask your accountant how long your GST records must stay.

Write a one-line retention rule for each data type: order records, courier labels, marketing lists, chat histories and analytics data. Marketing lists are the easiest win, because a customer who unsubscribed years ago and never ordered again is data you are protecting for no reason. Old exports on laptops and in email attachments are the riskiest, so delete them first.

What do I have to do if my store collects data about children?

If your store may process a child's personal data, Rule 10 requires verifiable consent from a parent before you process it. The rule says you "shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child". The Act sets the age at which someone counts as a child, so check that definition before deciding your store is not affected.

Stores selling toys, school supplies, kids' clothing or baby products usually sell to parents, which keeps most orders simple. The risk sits in the extras: a child creating an account, a birthday club that asks for the child's name and date of birth, a contest entry, or a personalised gift that prints a child's name. Either collect those details from the parent with a clear consent step, or stop collecting them. PIB notes that violations of obligations relating to children can attract penalties of up to ₹200 crore, the same ceiling as a missed breach notice.

Also ReadThe EU AI Act Now Requires You to Disclose AI Product Images to European Shoppers

›

Which of my apps and vendors handle customer data, and what should I ask them?

Any app, tool or partner that handles customer data for you, such as your store platform, email and WhatsApp tools, courier aggregator, payment gateway, review app and any AI tool given order data, is likely a Data Processor, and Rule 6(1)(f) expects your contract with each one to carry security terms. The rule asks for an "appropriate provision in the contract entered into between such Data Fiduciary and such a Data Processor, wherever applicable, for taking reasonable security safeguards".

Rule 6 also names the kind of safeguards it means: "appropriate data security measures, such as securing of personal data through encryption, obfuscation, masking or the use of virtual tokens mapped to that personal data". Use that line as your question list for every vendor:

• What customer data do you store, and in which country and service?
• Is it encrypted at rest, and how are store access tokens protected?
• How do you verify that webhooks and incoming data really come from my store?
• Can I export and delete my customers' data myself, without a support ticket?
• How quickly will you tell me about a breach, given my 72 hour reporting window?
• Does our contract include a security safeguards clause?

Start with the tools that should not need customer data at all. A tool that only turns your product photos into marketplace-sized images, A+ pages and listing copy works from your catalogue, not your customer list, so it should never ask for an order export. Before you connect any tool, read exactly what it generates and what it connects to, for example on the ListingRVA AI features page.

Expect specific answers. When sellers put these questions to ListingRVA AI, the answer is that store tokens are encrypted at rest, webhooks are signature-checked, and sellers can export and erase their own data. That is the kind of concrete reply to look for from every vendor, and it is not a claim about anyone's overall DPDP status. A vague line about taking security seriously is not an answer.

AI agents deserve their own line in the map. An agent with access to your store admin can usually read orders and customer details as well as products, so decide in writing what it may do alone, what it must ask about first, and what it must never touch, such as exporting customer lists. A ready-made way to set that up is a rules template for AI agents.

What are the penalties, and what is the simple checklist for this month?

DPDP penalties are maximums, not fixed fines: PIB says "The highest penalty up to ₹250 crore applies to failure of a Data Fiduciary to maintain reasonable security safeguards." It adds that not notifying the Board or affected individuals of a breach, and violations of obligations relating to children, "can each attract penalties of up to ₹200 crore", and that any other violation "may attract penalties up to ₹50 crore." We did not find a separate start date for penalties on a primary page, so read these as the ceilings set by the Act, as PIB reports them.

Those numbers are ceilings for the worst cases, not a price list, but they explain why the cheap fixes are worth doing early. A small store can get most of the way in a few working days spread across the next six months. Here is the order we would follow this month to get the DPDP Rules for D2C sellers under control:

1. Map every tool, sheet and inbox that holds customer data, and who can open it.
2. Draft a stand-alone consent notice that itemises the data, with marketing as a separate choice.
3. Make withdrawal one tap or one click, matching how consent was given.
4. Publish a named contact for data questions in your footer and reply template.
5. Write a one-page breach plan with the 72 hour clock and vendor contacts.
6. Start a request log with a 90 day deadline column.
7. Send every vendor the six questions above and add security terms to contracts.
8. Set a retention rule per data type, keeping logs for at least one year.
9. Put a monthly reminder to check MeitY for any change to the May 2027 date.

None of this needs a lawyer to start, but a lawyer should review the notice and the breach plan before May 2027, especially if you sell to children, run a large customer list or send data outside India. The DPDP Rules for D2C sellers are mostly about knowing where data lives and answering people on time, and both get easier the earlier you start.

Frequently asked questions

When do the DPDP Rules for D2C sellers come into force?

In phases. Rules 1, 2 and 17 to 21 came into force on publication of G.S.R. 846(E), dated 13 November 2025. Rule 4 on Consent Managers comes into force on or about 13 November 2026. Rules 3, 5 to 16, 22 and 23, which hold most store duties, come into force on or about 13 May 2027. The dates are our arithmetic from the Gazette, so treat them as on or about.

Is there a small business exemption in the DPDP Rules?

We found no small business exemption in the Rules. The one user threshold we found that matters for stores is the Third Schedule class of e-commerce entities with not less than two crore registered users in India, which is about timed erasure, not about whether the law applies. Plan as if your store is covered.

Does my store have to use or become a Consent Manager?

Nothing we read requires a small store to become or appoint one. PIB describes a Consent Manager as an entity that provides a single, transparent and interoperable platform through which a person may give, manage, review or withdraw consent. Rule 4, which covers them, is the part that starts on or about 13 November 2026.

How fast do I have to report a customer data breach?

Under Rule 7, tell each affected customer without delay, in a concise, clear and plain manner, and send the Data Protection Board a detailed report within 72 hours of becoming aware of the breach, or within a longer period the Board allows on a written request. These duties start on or about 13 May 2027.

How long do I have to answer a request to delete customer data?

PIB says Data Fiduciaries must address requests for access, correction, updating or erasure within a maximum of ninety days. Rule 14 sets the same 90 day ceiling for grievances. Log the date each request arrives so you can show you met it.

Has the 18 month compliance period been shortened to 12 months?

Not that we have seen. MeitY has floated shortening it to twelve months, but do not treat that as a change. Check MeitY before relying on the May 2027 date, and plan to be ready early in case it moves.

What are the maximum DPDP penalties for a store?

PIB lists penalties of up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore each for not notifying a breach or breaking obligations on children's data, and up to ₹50 crore for any other violation. These are maximums, not fixed fines.

Published by Aashirvad Kumar, founder of ListingRVA AI. Drafted with AI assistance; the rules, figures and claims are checked against the sources linked in this article before publishing.