Last Updated:
The new rule stipulates that phone numbers can be stored only till needed, up to three years or as per rules. After this, or if consent is withdrawn, retailers must delete the data
Under the new data protection law, retailers cannot refuse service if a customer opts not to share their mobile number. (Representative/News18 Hindi)
The government is set to roll out a new data protection law aimed at safeguarding consumer mobile numbers. This legislation will ban the practice of requesting mobile numbers from customers at various retail stores.
Retail companies have previously collected millions of customer mobile numbers, allegedly selling them for significant sums. However, this will no longer be permissible under the new law, which seeks to enhance mobile number security and restrict its distribution.
Recommended Stories
What Comes Next As An Option?
Currently, retailers and shopkeepers often ask for customer mobile numbers at the billing counter, either to include them in loyalty schemes or send bills directly to their phones. Customers have typically complied, considering it necessary. However, the new data protection law will deem these practices a violation of data protection interests. Instead, alternative systems like keypad entry may be implemented to maintain privacy and security.
The law stipulates that customers must be informed of why their data is being collected, for how long, and when it will be deleted. Consent must be clear and explicit, eliminating indirect consent.
According to a Times of India report, the Digital Personal Data Protection Act will push companies to reassess how they collect and use customer details like mobile numbers, which currently serve as identifiers for loyalty programmes. The changes are expected to disrupt such conventional systems.
“Small process tweaks, such as replacing oral disclosure of mobile numbers with keypad entry, can significantly improve privacy safeguards. The law mandates that customers must be told why their data is collected, how long it will be stored, and when it will be deleted. Implied consent will no longer be valid — every consent must be explicit,” said S Chandrasekhar, head of digital and cyber practice at K&S Partners, in an interview with the newspaper.
Shopkeepers Barred From Refusing Service
Under the new data protection law, retailers cannot refuse service if a customer opts not to share their mobile number. Retail stores will need to offer options such as sending physical receipts or email receipts. Additionally, the re-sale of data collected from customers will be banned, addressing a widespread issue.
The Times of India report noted that even basic visitor management systems will now be required to clearly state why they are collecting phone numbers and provide assurances that the data will not be misused, resold, or retained beyond its stated purpose.
“The broader intent is not to disrupt business but to enforce accountability, ensuring data is used only for the stated purpose and then deleted,” Chandrasekhar said. He explained that the framework aligns India with global standards such as the GDPR, underlining how personal data has become a key resource for modern enterprises.
While large retailers are already preparing to comply with the new law, the rules will also extend to visitor entry systems and housing societies that routinely record phone numbers. According to the report, these entities will now need to shift to structured, system-driven processes to remain compliant.
New Rules Tighten Personal Data Use
The Digital Personal Data Protection (DPDP) Act, 2023, spearheaded by the Ministry of Electronics and IT, outlines these provisions. Draft DPDP Rules, 2025, facilitate the operationalisation of the Act, set for implementation by August 2025.
Personal data, including phone numbers, can only be retained for the period necessary to serve the original purpose, up to three years from the last user interaction or until the deadline specified in the rules. Post this period or upon withdrawal of consent, retail stores must delete the data. Organisations must ensure strict safeguards to stop any unauthorised collection, misuse, or leakage of customer phone numbers.
Loading comments…
Read More
