Shopper data and the DPDP Act for store owners

The situation

A Bengaluru accessories brand has about forty thousand customer records. Each holds a name, phone number, email and delivery address, with order history. Over time the team has also collected more: WhatsApp opt-ins from a giveaway, a sheet of phone numbers from a college fest stall, and abandoned cart details that a marketing tool messages automatically. Customer data now sits in the store, the courier aggregator's panel, the WhatsApp tool, an email tool and several spreadsheets on team laptops.

Nobody did anything unusual. This is how most Indian stores grow. But under the Digital Personal Data Protection Act, 2023, the brand is responsible for all of it, wherever it sits.

As of October 2026, the Act and the DPDP Rules notified in November 2025 are being brought into force in phases, with most duties for businesses due to apply about eighteen months after the Rules were notified. Check the current dates and how the law applies to your business with a lawyer.

Who is responsible for what

The Act uses a few terms worth knowing:

• Data principal: the person the data is about, your shopper.
• Data fiduciary: whoever decides why and how the data is used. For your store, that is you.
• Data processor: a business that handles data on your behalf, such as the platform that hosts your store, your email tool or a courier aggregator, when it acts on your instructions.

As the fiduciary, you answer for what your processors do with your shoppers' data. That makes your contracts with them, and your choice of tools, part of compliance.

What the law expects, in practice

A lawful reason for each use

You may process personal data with the person's consent, or for certain legitimate uses the Act lists. One of these covers data a person gives voluntarily for a specific purpose, such as an address given so an order can be delivered. Using the same address and phone number for marketing is a different purpose and generally needs consent.

A clear notice

When you ask for consent, you give a notice that says what data you collect, why, how the person can withdraw consent, and how they can complain to the Data Protection Board of India. It has to be in plain language, and the person should be able to read it in English or in one of the languages listed in the Eighth Schedule to the Constitution.

Consent that means something

Consent must be free, specific, informed and given by a clear action. A pre-ticked marketing box at checkout does not qualify. Withdrawing consent should be as easy as giving it, so every marketing message needs a working way to stop it.

Shopper rights

Shoppers can ask what data you hold and how it is used, ask for corrections, ask for erasure where it is no longer needed, and raise grievances. You need a published contact and a process to answer within the time the Rules set.

Security and breaches

You must take reasonable security safeguards. If a breach happens, you must inform the Data Protection Board and the affected shoppers. A shared spreadsheet of customer phone numbers on a personal laptop is exactly the kind of thing that turns into a breach.

Delete what you no longer need

Once the purpose is served, data should be erased unless another law requires you to keep it. Tax law, for example, requires invoices and order records to be kept for a set number of years, so you will keep those and delete the rest, such as stale marketing lists.

Children

Processing data of anyone under eighteen needs verifiable consent from a parent or guardian. Stores selling toys, school supplies or teen fashion should think about this carefully.

Steps to take now

Map the data

List every place shopper data lives: the store, payment gateway, courier aggregator, WhatsApp and email tools, spreadsheets, team phones. For each, note what data, why, who has access and how long it is kept. For the Bengaluru brand this took two afternoons and found eleven spreadsheets.

Separate order data from marketing data

Keep consent for marketing separate from the checkout. Add an unticked opt-in for offers on WhatsApp or email, record when and how each person opted in, and stop messaging those who never did.

Tighten access

Give staff only the access their job needs. Remove former employees and agencies from every tool. Stop exporting customer lists to personal devices.

Write the notice and the request process

Publish a privacy notice that matches what you actually do, with a contact for requests. Decide who answers them and how you will find a shopper's data across every tool.

Check your contracts

Ask each processor how they protect data, where they store it, and how they help with erasure and breach notice.

How ShopenUp fits

On ShopenUp, customer profiles and order history sit in one place, and role based access for the admin lets you limit what each staff member can see from day one. Two factor authentication for the admin is built for you if you need it. Hosting and updates are managed by the Code Colonies team, and card data stays with your payment gateway.

For consent records, privacy notices and handling shopper requests in a structured way, the group's DPDP compliance product, TrustOS, can work alongside your store.

Limits

No platform makes a store compliant on its own. Compliance depends on what you collect, why, what you tell shoppers and what your team does with spreadsheets and phones. Guidance from the Board will shape how some duties are read.

Checklist

• Every place shopper data lives listed, with purpose and access.
• Marketing consent separate from checkout, unticked, recorded.
• Easy opt-out on every marketing message.
• Privacy notice published in plain language.
• A named person and process for shopper requests.
• Staff access limited, old accounts removed.
• No customer lists on personal devices.
• Retention periods set, stale lists deleted.
• Processor contracts checked.
• A breach response plan written down.

For how ShopenUp handles admin access, hosting and payment data, read security.