DPDP by sector
Draft. Awaiting approval.
DPDP for shops and retail
A shop that keeps personal data in digital form is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3). Typical work: Counter and WhatsApp orders, UPI payments, a credit (udhaar) register.
Where personal data sits
- Shop phone and WhatsApp number used for orders
- Staff phones used for orders or delivery
- Photos of the order book or credit register
- UPI or payment app
- CCTV
- Shop counter (paper bills and the credit register)
What Fohrkast maps
- Customer name
- Mobile or WhatsApp number
- Delivery address
- Orders, bills and credit entries
- UPI payment details
- CCTV footage
- Staff names, phone numbers and salary records
Each use of the data is recorded as a purpose:
- Orders, bills and delivery. Take your order on WhatsApp or at the counter, make your bill, deliver it and handle returns.
- Credit (udhaar) account. Record what you buy on credit and what you have paid.
- Offers on WhatsApp and SMS. Send you festival offers and news of new stock.
Which duties weigh most
- Security safeguards. Encryption or masking, control over who opens the systems that hold personal data, access logs, backups, and logs kept for one year (s.8(5), Rule 6(1)). Penalty up to ₹250 crore (s.33, Schedule item 1).
- Breaches. Every personal data breach, with no size threshold: each affected person and the Board told without delay, and the detailed report to the Board within 72 hours (Rule 7). Penalty up to ₹200 crore (s.33, Schedule item 2).
- Requests. A person can ask to see a summary of the data held (s.11), have it corrected or erased (s.12), raise a grievance (s.13) or name a nominee (s.14).
- Vendors. A vendor that handles personal data for the business needs a valid contract with reasonable security safeguards; the business stays responsible (s.8(1), s.8(2)).
Sector rules
The sector regulator's rules for a shop: not set.
A short case
Case: not set. Figures: not set. Customers: not set.
When do the duties start?
| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |
Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.
Next
- Privacy Check: a look at the website's notices, trackers and forms.
- Plans and prices in INR.
- Book a demo.
Not legal advice.