DPDP Act for D2C Brands: What You Need to Change Before 2027

What Is the DPDP Act?

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s first comprehensive data privacy law — I think of it as India’s GDPR. It governs how any business collects, stores, processes, and shares personal data of Indian citizens.

Almost every D2C brand I work with collects customer names, phone numbers, email addresses, shipping addresses, or payment information — you are a ‘Data Fiduciary’ under this law. I make sure my clients meet these obligations.

Key Requirements for D2C Brands

1. Consent Before Collection

• I tell clients to get explicit, informed consent before they collect any personal data.
• Pre-ticked checkboxes don’t count in my book. The customer must actively opt in.
• Your privacy policy must clearly state what data you collect, why, how long you keep it, and who you share it with. I check this.
• Action: Add a clear consent checkbox at checkout and account creation. Update your privacy policy. My first fix.

2. Purpose Limitation

• I remind clients: you can only use data for the purpose you stated when you collected it.
• Collected email for order updates? You can’t auto-add it to your marketing list without separate consent. I flag this.
• Collected phone number for delivery? You can’t share it with a marketing partner. I check this.
• Action: Separate transactional consent (order processing) from marketing consent (newsletters, WhatsApp broadcasts) — I use two checkboxes.

3. Data Minimization

• Only collect data you actually need. My rule, always.
• Does your checkout really need date of birth? Anniversary? If you’re not using it for personalization, don’t collect it. I ask this.
• Action: Audit your checkout fields and forms. Remove anything you don’t actively use — I check this first.

4. Right to Erasure

• Customers can request deletion of their personal data — I’ve had clients ask.
• You must delete it within a ‘reasonable’ timeframe (guidelines suggest 30 days), which I plan around.
• Exception: data required for legal compliance (tax records, GST invoices) can be retained — I keep this separate.
• Action: Build or configure a data deletion workflow. Shopify has built-in customer data request handling. My starting point.

5. Data Breach Notification

• If you suffer a data breach, you must notify the Data Protection Board of India AND affected customers. I explain this every time.
• There’s no specific timeline in the Act yet, but I tell clients to expect 72-hour requirements similar to GDPR.
• Action: Have an incident response plan, and I make sure clients know who to contact and what to communicate.

Penalties

These are maximum penalties. I expect early enforcement to focus on large companies, but building compliance now protects you as enforcement scales.

Compliance Checklist for D2C Brands

1. Update your Privacy Policy — Make it clear, in simple language, what data you collect and why. Link it in your footer and checkout. My first step.
2. Add consent mechanisms — Checkbox at checkout for marketing communication, separate from order processing consent. My rule: two fields.
3. Audit third-party data sharing — Who has access to your customer data? Analytics tools, ad platforms, CRMs, courier partners. I make clients document every processor.
4. Set up data deletion workflows — Enable customers to request data deletion. I respond within 30 days for every client.
5. Secure your data — Use HTTPS everywhere. Encrypt stored data. Use strong passwords and 2FA on all admin accounts — non-negotiable on my builds.
6. Train your team — Anyone who handles customer data (support team, marketing team) should understand basic data protection principles. I train my team too.

Need Help With DPDP Compliance?

At Growww Tech, my team and I help D2C brands audit their data practices and implement DPDP-compliant workflows. Don’t wait for enforcement — get compliant now.

Related reading:

• GST for Ecommerce Sellers
• FSSAI Registration Guide
• Best Shopify Apps for Indian Stores