Founder Notice · 3 November 2026
Consent Is Now Law: What India’s DPDP Act Means for D2C Founders
From 13 May 2027, every Indian D2C brand that collects customer data must prove it had valid consent to use it. Here is what changes, and what to do before the deadline.
The carousel, as shared on social media
Swipe or scroll to see all 8 slides.
A notice to every D2C founder
From 13 May 2027, every Indian D2C brand that collects customer data must prove it had valid consent to use it. That date is about six months away, and the clock moves again on 13 November 2026, when Consent Manager registration opens.
If you run a D2C brand, you collect personal data every single day. A phone number at checkout. An address for delivery. A WhatsApp opt-in. A pixel that follows a visitor from your site to Instagram. Until now, most of this happened on autopilot, buried in a privacy policy nobody read.
That era is over. The Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 turn consent from a checkbox into a legal obligation. Consent is now law. This piece is your plain-English notice: what is changing, how it hits a D2C business specifically, and the exact actions to take before the deadline.
This article is general guidance for founders, not legal advice. Work with a lawyer or compliance advisor on your specific data flows.
The timeline: where we stand today
The government notified the DPDP Rules on 13 November 2025 and gave businesses an 18-month runway in three phases (Mondaq).
- 13 November 2025 — Foundation. Definitions and the Data Protection Board of India came into force immediately.
- 13 November 2026 — Consent Managers. Rule 4 kicks in. Registered Consent Managers, a new class of regulated intermediaries, can then help customers give, review and withdraw consent across brands (Vinsys).
- 13 May 2027 — Full enforcement. Notice, consent, security, breach reporting, children’s data, retention and grievance duties all become enforceable, with penalties (SetIndiaBiz).
We are now in the implementation window. The months between November 2026 and May 2027 are for deploying and testing controls, not for starting to read about the law. Brands that begin in April will not finish in May.
Why D2C brands will feel it first
D2C is a data business disguised as a product business. Your moat is the first-party relationship: the customer list, the repeat-purchase data, the WhatsApp community, the retargeting audience. That is exactly what the DPDP Act regulates.
Industry observers put D2C alongside apps, gaming and ad-tech among the sectors that will see the earliest and biggest changes (exchange4media). D2C brands lean heavily on CRM and first-party data, so they will need to validate consent, re-seek it for historical data and tighten retention and deletion.
Under the Act, your brand is a Data Fiduciary: the business that decides why and how customer data is used. Your customer is the Data Principal. Your agencies, logistics partners, payment gateways, CRM tools and WhatsApp vendors are Data Processors acting on your behalf. The legal responsibility stays with you, even when the breach happens at a vendor.
Here is the data a typical D2C brand touches, all of it covered:
- Name, phone, email and delivery address at checkout
- Order history, cart abandonment and browsing behaviour
- WhatsApp, SMS and email marketing lists
- Pixel and cookie data shared with Meta and Google
- Reviews, UGC photos and influencer submissions
- Loyalty, subscription and referral programme data
- Customer support chats and call recordings
Eight ways the law changes how a D2C brand operates
1. Consent must be real, specific and opt-in
Consent under the Act must be free, specific, informed, unconditional and given through a clear affirmative action. Pre-ticked boxes, “by continuing you agree” banners and silence do not count. Consent also has to be purpose by purpose: agreeing to receive an order update is not agreeing to marketing.
The practical shift: you cannot make marketing consent a condition of buying. Order delivery and promotional WhatsApp messages need separate, unbundled choices.
2. Your privacy notice must be rewritten in plain language
The Rules require a notice that stands on its own, is easy to understand and lists the data you collect and the specific purpose for each. It must tell customers how to withdraw consent, exercise their rights and complain to the Data Protection Board. Customers can ask for it in English or any of the 22 languages in the Eighth Schedule.
A 4,000-word legal policy in the footer will not meet this bar. Think a short, itemised notice shown at the point of collection: checkout, sign-up, WhatsApp opt-in.
3. Withdrawal must be as easy as giving consent
If a customer opted in with one tap, they must be able to opt out with one tap. No support tickets, no hunting through account settings. Once they withdraw, you and every vendor processing that data on your behalf must stop within a reasonable time.
4. Your existing customer database needs a fresh notice
For data collected before the law came into force, the Act requires you to send customers a notice as soon as reasonably practicable. You can keep processing until they withdraw. In practice, this means a re-permission campaign to your legacy list, and a clean split between customers who have engaged and those you can no longer prove consent for.
5. Pixels, cookies and retargeting move behind consent
Many Indian D2C sites fire marketing tags the moment a page loads, before a visitor touches any consent banner (Agency Reporter). Under DPDP, non-essential trackers (Meta Pixel, Google Ads tags, heatmaps, de-anonymisation tools) should fire only after the visitor says yes. Expect smaller retargeting audiences and noisier attribution in the short term.
6. Children’s data has its own rules
Anyone under 18 is a child under the Act. You need verifiable parental consent before processing their data, and you cannot track, behaviourally monitor or run targeted ads at children. This matters directly for baby care, kids’ nutrition, toys, school supplies, teen skincare and gaming brands.
7. Data has an expiry date
You must erase personal data once its purpose is served or consent is withdrawn, unless another law requires you to keep it (GST and accounting records, for example). Large e-commerce entities with two crore or more registered users must erase data after three years of user inactivity, with 48 hours’ warning to the customer. Every brand needs a written retention schedule.
8. Security, breach reporting and vendors are now your liability
You must put reasonable security safeguards in place: encryption, access controls, logs and backups. If a breach happens, you must inform the Board and every affected customer without delay, followed by a detailed report to the Board within 72 hours. Contracts with your 3PL, CRM, agency and WhatsApp BSP must reflect these duties, because their breach is your breach.
Customers also gain enforceable rights: to see a summary of their data, correct or erase it, nominate someone to act for them, and have grievances resolved within 90 days.
What non-compliance costs
The Data Protection Board can impose penalties per breach of the Act, not per year. These are maximums; the Board weighs severity, duration and how the business responded.
| Failure | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards to prevent a breach | ₹250 crore |
| Failing to notify the Board and customers of a breach | ₹200 crore |
| Breaking the rules on children’s data | ₹200 crore |
| Any other breach of the Act or Rules | ₹50 crore |
For an early-stage brand, the bigger risk is often not the fine itself. It is the customer complaint that triggers an inquiry, the breach headline that kills repeat purchase, or the investor who walks away during diligence.
Your D2C action plan before 13 May 2027
Most D2C brands will not be notified as Significant Data Fiduciaries, so the to-do list is manageable. It is a clean consent flow, a proper notice, tighter vendors and a few written processes. Work through it in three blocks.
November–December 2026
Map and audit
- Build a data map: every touchpoint where you collect personal data (website, app, marketplace, WhatsApp, Instagram DMs, events, offline stores, influencer forms)
- For each data item, write down the purpose you use it for, and delete fields you do not need (birthday, gender, pin code “just in case”)
- List every vendor that touches customer data: Shopify apps, CRM, email/SMS/WhatsApp tools, 3PL, payment gateway, ad agency, analytics
- Audit your site’s tags and pixels: which fire before consent today?
- Check whether any product, campaign or community reaches under-18s
January–February 2027
Fix the front end
- Rewrite your privacy notice as a short, itemised, plain-language notice, with Hindi and regional versions for your core markets
- Redesign checkout and sign-up with separate, unticked choices for order updates and for marketing
- Install a consent banner or Consent Management Platform so non-essential trackers fire only after a yes
- Add a one-tap unsubscribe or withdraw option on every channel: email footer, WhatsApp keyword, account page
- Evaluate whether integrating with a registered Consent Manager suits your scale
- Run a re-permission campaign to your legacy customer list
March–April 2027
Build the back end
- Sign data processing terms with every vendor covering security, breach reporting and deletion
- Write a retention schedule and set up automatic deletion where you can
- Write a breach response plan: who finds out, who decides, who notifies the Board and customers within 72 hours
- Publish a grievance contact and set up a process to answer rights requests within 90 days
- Turn on encryption, role-based access and logging in your CRM and order systems; keep logs for at least a year
- Train your customer support and marketing teams on what has changed
The upside nobody talks about
Consent-first data is cleaner data. A smaller list of customers who chose to hear from you converts better, costs less to reach and is far less likely to mark you as spam. Brands that rebuild growth around owned channels, loyalty and genuine storytelling will come out of this transition stronger than those trying to hold on to bulk messaging and blind retargeting (exchange4media).
Why this matters for your next fundraise
Investors are already adding DPDP readiness to their diligence checklists. A D2C brand’s valuation rests on its customer data: repeat rate, CAC payback, LTV, the size of its owned audience. If you cannot show that this data was collected with valid consent, the asset an investor is paying for becomes a liability they are inheriting.
Founders who can show a clean data map, a consent log and signed vendor terms walk into a data room with one fewer red flag. Founders who cannot will find the question coming up in the term sheet as a condition precedent.
Treat DPDP compliance as part of your fundraising readiness, not a separate legal chore. It signals the same thing investors look for everywhere else in your business: that you run a tight operation and respect your customers.
Consent is now law. Make it part of your brand story.
Want a second pair of eyes before May 2027?
At Colab Alpha, I work with D2C and food brand founders on fundraising readiness, investor mapping and the operating foundations investors check for.
Book a Discovery Call →Sources
- DPDP Act and Rules 2025: the 2026 compliance milestones — Mondaq
- DPDP Act compliance deadline: Consent Managers, November 2026 — Vinsys
- DPDP Consent Manager milestone — SetIndiaBiz
- How CMPs are becoming critical after the DPDP Act — Agency Reporter
- Anil Pandit on how DPDP will redraw the data economy — exchange4media
- How DPDP will rewrite growth playbooks for Indian brands — exchange4media
- Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 — MeitY