Customer data requests (privacy law)
Customers can download their data or delete their account themselves; here is what stays and why.
What it is
India's data protection law (DPDP) gives a customer the right to a copy of their data and to erasure. Your shop handles both without you: under Your Account → Your data a customer can download everything (JSON, or orders as a spreadsheet) and delete their account after entering a code sent to their phone or email.
What deletion does
Name, phone, email, addresses, wishlist, cart, notes and tags are removed and the customer is signed out everywhere. Orders, invoices and credit notes stay — GST law requires you to keep them — but they are no longer linked to a name, phone or email. In your Customers list the person shows as "Deleted customer".
If a customer asks you by message
Point them to Your Account → Your data in the shop. You do not need to do anything by hand.