India's DPDP Act for Shopify Stores: What to Fix Before May 2027

The main duties of India’s Digital Personal Data Protection (DPDP) Act apply from 13 May 2027, 18 months after the DPDP Rules were published on 13 November 2025. They apply to any online store that processes personal data of people in India. That means Indian D2C brands, and also stores elsewhere that sell to Indian customers. Under Shopify’s own data processing terms, Shopify is a data processor and your store is the data fiduciary, so the duties are yours.

This is a practical guide to what the law says, written by a Shopify agency, not a law firm. It isn’t legal advice. Confirm your obligations with a lawyer, especially on the points marked as interpretation.

The short version: before May 2027, a store needs to

1. Know what personal data it collects, where it goes, and which apps touch it.
2. Publish a standalone privacy notice that lists that data, says what each piece is for, and links to withdraw consent, exercise rights and complain.
3. Get clear consent for anything beyond fulfilling an order, such as marketing emails and ad tracking, and keep a record of it.
4. Put basic security in place, including access controls, logs kept for a year and backups.
5. Have a breach plan that can notify affected customers without delay and the Data Protection Board within 72 hours.
6. Delete data once its purpose ends, while keeping order records and logs for at least a year.
7. Name a contact person, and answer grievances within a published period of no more than 90 days.

Diagram — the three roles under the Act, and the three dates. The duties sit with your store, not with Shopify.

When does the DPDP Act apply to online stores?

The Rules’ own text sets the date: Rules 3 and 5 to 16 “shall come into force eighteen months after the date of publication”. The Gazette is dated 13 November 2025, but it went online on 14 November, so some sources say 14 May 2027. Plan for the 13th. Until then, India’s existing data rules under section 43A of the IT Act still apply.

Two things could still change:

• The deadline could move earlier. In January 2026, MeitY proposed cutting the 18 months to 12. As of October 2026 no amendment had been notified, so 13 May 2027 stands.
• The Board isn’t working yet. MeitY says it has established the Data Protection Board, which enforces the Act, and advertised for its members in May 2026. In October 2026 the Kerala High Court said it expected the Board to be functional within eight weeks (LiveLaw).

Does the DPDP Act apply to my Shopify store?

Almost certainly, if you sell to people in India. The Act covers digital personal data processed in India. Section 3(b) also covers processing outside India “in connection with any activity related to offering of goods or services to Data Principals within the territory of India”. A US or UK store shipping to Indian customers is in scope for those customers’ data.

Who is responsible for what:

Shopify’s Data Processing Addendum says: “Shopify shall act as a Data Processor with respect to the processing of Your Customer Personal Data”. It also says the merchant must give customers “all disclosures necessary”. There is one exception: Shopify acts as a controller for its network-level “Enhanced Services”, which you can switch off by disabling Shopify Network Intelligence.

Being the fiduciary matters because of section 8(1). You stay responsible “irrespective of any agreement to the contrary”, including for processing an app does for you. You may use a processor “only under a valid contract”. Shopify’s DPA covers Shopify. Check that the apps that handle customer data, such as email, reviews, loyalty, subscriptions and support, have terms that cover it too.

The Act allows the government to exempt classes of businesses, “including startups”, from some duties, and to designate large processors as Significant Data Fiduciaries with extra duties. As of late 2026, neither had been notified.

What must a DPDP privacy notice say?

Rule 3 sets the content. The notice must be standalone, “understandable independently of any other information”, and in clear and plain language. At minimum it must give:

• An itemised description of the personal data you collect.
• The specific purpose of each kind of processing, and the goods or services it enables.
• A link customers can use to withdraw consent (as easily as they gave it), exercise their rights, and complain to the Board.

In practice, for a Shopify store, the itemised list usually looks like this:

Two details catch stores out:

• Language. Section 5(3) requires the option to read the notice “in English or any language specified in the Eighth Schedule to the Constitution”. Lawyers read this differently. Some say any one scheduled language is enough; others advise offering several. At minimum, offer English and the main language your customers use.
• Existing customers. For people who gave consent before the Act, section 5(2) requires you to send the notice “as soon as practicable”, by email or another effective method. If you have an existing customer or email list, plan a notice email before May 2027.

When do you need consent, and when don’t you?

Consent under section 6(1) must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action”, and limited to the data needed for the purpose. A pre-ticked box isn’t consent. Customers must be able to withdraw it as easily as they gave it, and when they do, your processors must stop too, so your email tool and ad pixels must respect the withdrawal.

Not everything needs consent. Section 7(a) allows processing for a purpose the customer “voluntarily provided her personal data” for. The Act’s own example is a shop sending a payment receipt. Our reading, not a legal opinion: fulfilling and delivering an order the customer placed fits this, while marketing emails, retargeting and ad tracking need consent.

The Act includes an ecommerce example on withdrawal. If a customer withdraws consent, the store “may stop enabling X to use the app or website for placing orders, but may not stop the processing for supply of the goods already ordered and paid for”.

Because section 6(10) puts the burden of proving consent on you, keep a log: what the customer agreed to, when, and which notice they saw.

On Shopify:

• Shopify’s cookie banner sets itself up automatically only for the UK and the EEA, but you can use it in any region, including India.
• Third-party consent apps work properly only if they’re integrated with Shopify’s Customer Privacy API. The API sorts tracking into categories (analytics, marketing, preferences and sale of data), so pixels fire only when the visitor has agreed.
• Marketing sign-ups should use an unticked checkbox and a clear statement of what the customer will receive.

What security does the DPDP Rules require?

Rule 6 lists minimum measures for every fiduciary:

• Encryption, masking or tokenisation of personal data.
• Access controls on the systems that hold it.
• Logs and monitoring of who accesses it.
• Backups.
• Keeping those logs, and the data needed to investigate, for a year.
• Security terms in your contracts with processors.
• Appropriate technical and organisational measures.

Shopify handles hosting, encryption and platform security. What’s left to you on a Shopify store is mostly people and exports:

• Give staff only the admin permissions they need, and remove former staff and agencies promptly.
• Review app access. Under Settings > Apps, see which apps can read customer data, and remove the ones you no longer use.
• Control customer exports. A CSV of customers on a laptop or in a shared drive is personal data outside Shopify’s protection.
• Require two-step sign-in for every staff account. The Rules don’t name it, but it’s the simplest access control there is.

What happens if there’s a data breach?

Rule 7 sets two duties:

1. Tell each affected customer without delay, through their account, email or phone. Say what happened and when, the likely consequences for them, what you’re doing about it, what they can do, and who to contact.
2. Tell the Data Protection Board without delay, then send a fuller report within 72 hours of becoming aware of the breach. It covers the facts, the cause, mitigation, any findings on who caused it, and what you told customers.

A separate rule from India’s cyber-security agency, CERT-In, requires certain cyber incidents to be reported within six hours, according to law-firm summaries. Write down who decides that a breach has happened, who contacts customers, and who files the reports, before you need to.

On a Shopify store, the likeliest breaches aren’t attacks on Shopify. They are a compromised staff login, a leaked export, or a misconfigured app.

How long can you keep customer data under DPDP?

Three rules work together:

• Delete what you no longer need. Under section 8(7), every store must erase personal data when the customer withdraws consent or when “it is reasonable to assume that the specified purpose is no longer being served”, whichever comes first. Its processors must erase it too.
• But keep a year of records. Rule 8(3) requires every fiduciary to keep personal data, traffic data and processing logs for at least one year from the date of processing, for legal and security purposes. The Rules’ example is an online purchase: the store “must retain the order details, personal data, and logs of the processing… for at least one year from the date of the transaction, even if X deletes her account.”
• The three-year rule is for very large stores only. The Third Schedule’s fixed three-year inactivity rule, with 48 hours’ notice before erasure, applies to ecommerce entities with at least two crore (20 million) registered users in India. Sellers on a marketplace are excluded from that definition. Most Shopify stores are well below the threshold, but the general duty above still applies.

Shopify’s admin has tools for both sides: request a customer’s data, or erase it. Erasure keeps order and sales records, and you have 10 days to cancel a pending erasure. Data held by the Shop app and Shop Pay isn’t erased this way.

What does the DPDP Act say about children’s data?

Under the Act, a child is anyone under 18, not 13 as in many other countries. Two duties follow:

• Verifiable parental consent before processing a child’s personal data. Rule 10 requires checking that the person giving consent is an identifiable adult, either from details you already hold or through a verified token such as DigiLocker.
• No tracking, behavioural monitoring or targeted advertising directed at children. Under section 9(3) this is a flat ban. Commentators read it as one that parental consent doesn’t override.

If you sell products young people buy, such as fashion, gaming accessories or stationery, decide how you’ll handle under-18 customers before May 2027. The Rules exempt processing done only to confirm that a customer is not a child.

Who must you name as a contact?

Rule 9 requires you to publish, prominently on your website, the contact details of a Data Protection Officer or “a person who is able to answer” questions about your processing. Include that contact in every response to a data request. Rule 14 requires you to publish how customers can make requests and a grievance response period of no more than 90 days. Customers must go through your process before complaining to the Board, so a working one is your first line of defence.

Can Shopify store Indian customers’ data outside India?

Yes, for now. Section 16 lets the government restrict transfers to specific countries by notification, a “negative list”. As of late 2026 no country had been listed. Shopify’s terms say data may be processed in countries including Singapore and Canada. Rule 15 lets the government set conditions on making data available to foreign states, and data localisation can only be imposed on Significant Data Fiduciaries. Watch for notifications, but there is nothing to change today.

What are the penalties under the DPDP Act?

The Schedule to the Act sets maximum penalties:

These are ceilings, not fines per breach. Under section 33, the Board can impose them only where a breach “is significant”, after an inquiry, and must weigh factors such as the harm, the mitigation steps you took and proportionality.

A DPDP plan for Shopify stores, November 2026 to May 2027

The other Shopify deadlines in the same months, such as script tags on 1 March and app token cut-offs on 1 April, are in our list of every Shopify deadline for 2027. Our 2027 trends post covers the wider Indian market.

Getting help

We’re a Shopify agency, not lawyers, so we can’t tell you what the law requires of your business. What we can do is the store side of it: an inventory of apps and data flows, a consent banner wired to Shopify’s Customer Privacy API, notice and contact pages, and tested data-request and erasure processes. That kind of upkeep is what our monthly store retainers cover. Or book a free 30-minute call to talk it through.

FAQs

When does the DPDP Act apply to online stores?

The main duties of India’s DPDP Act, including notice, consent, security, breach notification, erasure, children’s data and grievances, apply from 13 May 2027. That is 18 months after the DPDP Rules were published in the Gazette dated 13 November 2025. Some sources count from online publication on 14 November.

Does the DPDP Act apply to a Shopify store outside India?

Yes, if it sells to people in India. Section 3(b) applies the Act to processing outside India that is connected with offering goods or services to people in India. A store in the US or UK that ships to Indian customers must follow the Act for those customers’ personal data.

Is Shopify a data fiduciary or a data processor under DPDP?

Shopify’s Data Processing Addendum says Shopify acts as a data processor for merchants’ customer data, which makes the store the data fiduciary that carries the Act’s duties. The exception is Shopify’s network-level Enhanced Services, where Shopify acts as a controller, and which merchants can switch off by disabling Shopify Network Intelligence.

Do I need a cookie banner for Indian visitors?

The DPDP Act doesn’t mention cookies. But tracking that processes personal data for analytics or advertising generally needs consent, unless a legitimate use applies. Shopify’s own cookie banner can be enabled for any region, and third-party consent apps must integrate with Shopify’s Customer Privacy API to control pixels properly.

How long must I keep customer data under the DPDP Rules?

Every store must keep personal data, traffic data and processing logs for at least one year from the date of processing, even if the customer deletes their account. Beyond that, data must be erased once its purpose ends or consent is withdrawn. The fixed three-year inactivity rule applies only to ecommerce entities with at least two crore registered users in India.

What are the penalties under the DPDP Act?

Maximum penalties are ₹250 crore for failing to protect data, ₹200 crore each for failing to notify a breach and for breaching the duties on children’s data, ₹150 crore for Significant Data Fiduciary duties, and ₹50 crore for other breaches. The Data Protection Board can impose them only for significant breaches, after an inquiry, weighing proportionality.

Is a person under 18 a child under the DPDP Act?

Yes. The Act defines a child as anyone who has not turned 18. Stores need verifiable consent from a parent before processing a child’s personal data, and may not track, behaviourally monitor or target advertising at children.