Does India's DPDP Act apply to your Shopify store?
If you sell to customers in India, the Digital Personal Data Protection Act, 2023 is about your store, not only about big platforms. Here is what the Act itself says about who it covers.
Who the Act covers
Section 3 says the Act applies to the processing of digital personal data within India. It also applies to processing outside India when that processing is connected to offering goods or services to people within India.
In practice: if your Shopify store is run from India, it is covered. If it is run from somewhere else but you sell to shoppers in India and collect their details, the Act can still reach it.
What counts as personal data in a store
The Act defines personal data as data about an individual who is identifiable from it. A customer's name, email address, phone number, delivery address and order history all qualify, and so do the identifiers your analytics and advertising tools attach to a visitor.
There is no minimum size
Nothing in the Act exempts a store because it is small. Some duties are heavier for businesses the government designates as Significant Data Fiduciaries, but the core duties (a notice, valid consent, honouring customers' rights, keeping data safe) are written for every business that decides why and how personal data is processed. The Act calls that business a Data Fiduciary. As a store owner, that is you.
What you owe your customers
- A notice that says what data you collect, why, how customers can exercise their rights and how to complain (Section 5).
- Valid consent where consent is your basis for processing (Section 6).
- Ways to act on their rights: access, correction, erasure and grievance redressal (Sections 11 to 13).
- Reasonable security safeguards, and telling the Data Protection Board and affected customers if there is a breach (Section 8).
Not everything needs consent
Section 7 lists "legitimate uses" where you can process data without asking, such as using the details a customer gave you to fulfil the order they placed. Consent matters most for the optional parts: marketing, analytics and similar tracking.
When it starts
The DPDP Rules, 2025 were notified in November 2025, and most of the duties for businesses begin in phases after that. The date widely cited for the consent, notice and customer-rights duties is May 2027. Check the current position with a lawyer when you plan your timeline.