Under the DPDPA, obtaining consent is a detailed process that starts by providing individuals with clear, accessible, and comprehensive information about what data will be collected, how it will be processed, the purposes for its use, who it will be shared with, and the duration of its retention. This means presenting the information in plain language (free of legal jargon) so that individuals can easily understand what they are agreeing to. Consent must be explicit and given through an affirmative action, such as checking an opt-in box or clicking an "I agree" button; pre-ticked boxes or implied consent (e.g., through inactivity) are not acceptable.

Additionally, consent should be granular, allowing users to consent to different processing activities separately if needed. It must also be freely given without any form of coercion, and individuals should be informed of their right to withdraw consent at any time, with the withdrawal process being as straightforward as providing consent. Also, organizations should keep records of the consent obtained to demonstrate compliance.

The DPDPA is enforced by the Delaware Department of Justice, which is responsible for overseeing compliance through both proactive and reactive measures. The Department conducts audits, risk assessments, and investigations based on consumer complaints, ensuring that organizations adhere to the data protection standards set forth by the Act. When violations are detected, the Delaware Department of Justice has the authority to impose fines, corrective action orders, and other penalties to enforce compliance and protect individuals' data privacy rights.

Making your business compliant with the DPDPA is really about taking a few practical steps. Start by mapping out all the personal data you collect—what you gather, how you process it, where you store it, and who you share it with. Once you have that clear picture, update your privacy policies and consent forms so they're easy to understand and accurately explain how the data is used. It’s also important to put robust security measures in place and set up clear procedures for handling requests from individuals who want to access, update, or delete their information. Regular training for your team and routine checks can keep everything running smoothly.
‍
Shopify merchants can streamline compliance by leveraging tools like Consentmo, which offers automated solutions for managing cookie consent, generating privacy notices, and processing data subject requests.