DPDP for Indian D2C sellers, what actually changes for your data

Author : Robnu Technologies LLP | Published On : 10 Nov 2026

India's DPDP Act is now the framework for how you handle buyer personal data. The headlines made it sound scarier than it is. Here is the practical version, the five duties, what does not apply yet, and what Robnu handles versus what you still own.

India’s Digital Personal Data Protection Act (DPDP), passed in 2023, is now the framework for how you handle buyer personal data. If you are a D2C seller running a Shopify store, an AJIO account, and a customer-service WhatsApp, this affects you. The headlines made it sound scarier than it is. Here is the practical version.

The five things you need to do

1. Notice. Tell people what you collect, why, and how long you keep it. This is what your privacy policy is for. If you have a Shopify store, your privacy policy needs an India-specific section.

2. Consent. Do not auto-opt-in to marketing. Do not default the WhatsApp checkbox to checked. Get explicit, granular, withdrawable consent.

3. Purpose limitation. If you collected an email for shipping confirmations, do not use it for promotions without separate consent.

4. Retention limits. Do not keep buyer data forever. Set a retention window per category and delete after.

5. Breach notification. If something leaks, notify the Data Protection Board (the regulator) within seventy-two hours. Notify affected users without undue delay.

VISIT US:-   https://robnu.com/blog/dpdp-for-d2c-sellers