DPDP Rules for Shopify Stores: What to Fix Before May 2027
The DPDP Rules give Indian stores until May 2027. What a Shopify brand must change: consent notices, apps that touch data, breach plans.
India's Digital Personal Data Protection Rules, 2025 were published in the Gazette in November 2025. Most of the duties they create switch on 18 months later, which puts the deadline in May 2027. If you run a Shopify store in India, you collect names, phone numbers, addresses and order history, so the Act applies to you.
This post maps the Rules to the places customer data actually goes on a typical Shopify store. It isn't legal advice. Use it to get organised, then check the details with a lawyer.
The dates
The Rules (G.S.R. 846(E), dated 13 November 2025) come into force in three steps:
| When | What applies |
|---|---|
| On publication, November 2025 | Definitions and the rules setting up the Data Protection Board |
| One year later, November 2026 | Rule 4, on registered Consent Managers |
| 18 months later, May 2027 | The main duties: notices, security safeguards, breach reporting, retention, rights requests |
So there's still time, but not much once you count how many apps and vendors you need to check.
Does it apply to a small store?
Yes. Under the Act, any business that decides why and how personal data is processed is a Data Fiduciary, and size doesn't change that. A few duties are tied to size. For example, the rule on erasing data once its purpose is over has a specific clause for e-commerce businesses with at least two crore registered users in India. Most of the other duties apply to every store.
Start with a data map
You can't write an honest notice until you know where data goes. On most Shopify stores we audit, customer data reaches far more places than the owner expects:
- Shopify itself, plus every app with access to customers or orders
- tracking pixels and the Meta Conversions API
- your WhatsApp provider and email tool
- the courier and any 3PL warehouse
- one-click checkout and payment providers
- a CRM, a Google Sheet, or an agency's reporting tool
List each one, what it receives and why. Remove anything you no longer use. An app nobody remembers installing still has access to your customer list, which is a good reason to run an app audit anyway.
Notices and consent
The Rules require a notice that a customer can understand on its own, listing the personal data you collect and the specific purposes. It also has to tell people how to withdraw consent and how to complain to the Board. For a store, that usually means rewriting the privacy policy in plain language, plus a short notice wherever you collect data for something beyond the order: marketing on WhatsApp, newsletters, reviews.
A cookie banner doesn't cover this. Consent to cookies isn't consent to WhatsApp marketing, and the notice has to match what you actually do with the data.
Contracts with apps and agencies
Section 8(2) of the Act says a Data Fiduciary can use a Data Processor only under a valid contract. Your apps, your courier, your WhatsApp provider and your agency are all processors. Check each one's terms, and for agencies and freelancers, put data handling in writing. This fits with getting your ownership and handover terms right.
Security and breaches
Rule 6 lists reasonable security safeguards, including encryption, masking and access controls, with logs kept for at least a year. Rule 7 says that after a breach you tell affected people without delay, and send the Board a detailed report within 72 hours of becoming aware of it.
In practice:
- remove staff and agency accounts that no longer need access
- turn on two-step login for everyone on the Shopify admin
- stop exporting full customer lists to spreadsheets that get emailed around
- write a one-page breach plan: who decides, who writes the notice, who contacts the Board
Rights requests
Customers can ask to see, correct or erase their data. The government's explainer says these requests must be answered within 90 days. Set up one inbox and a short procedure, and remember that erasing a customer in Shopify doesn't erase them in your WhatsApp tool or email list.
Penalties
Penalties go up to ₹250 crore for failing to keep reasonable security safeguards, and up to ₹200 crore for failing to report a breach. A small store is unlikely to see numbers like that, but they show what the Board considers serious: security and breach reporting.
Where to start
Do the data map this month. Most of the remaining work follows from it, and it usually turns up apps and exports you can simply switch off. If you want an outside view, our commerce audit covers apps, tracking and access as part of the review.
