Soon, retailers may no longer be able to force you to share your phone number at billing counters

Enterprise retailers could soon run afoul of India’s new data-protection rules. Currently, many stores ask customers to verbally share their mobile numbers at billing counters to enroll them in loyalty programs or issue digital receipts. While shoppers may give consent, speaking personal details aloud in a public space risks exposing sensitive information—potentially violating the law’s mandate for firms to implement reasonable safeguards during data collection, reported TOI.

According to the report, the rules under the new Digital Personal Data Protection Act will require companies to rethink how they collect and handle customer information such as mobile numbers, which they use as identifiers.

"Small process tweaks, such as replacing oral disclosure of mobile numbers with keypad entry, can significantly improve privacy safeguards. The law mandates that customers must be told why their data is collected, how long it will be stored, and when it will be deleted. Implied consent will no longer be valid - every consent must be explicit," S Chandrasekhar, head of digital and cyber practice at K&S Partners, an intellectual property law firm told TOI.

What will not be allowed under new laws?

Businesses will no longer be allowed to deny services to customers who refuse to share their mobile numbers, except where the number is essential, such as for mobile recharges or Digi Yatra verification. Retailers will be required to provide alternatives, including email receipts or printed copies. Even visitor management systems must clearly disclose why numbers are being collected and guarantee that the data will not be reused or sold.

While enterprise retail are the ones that are working on dealing with the new law, the rules will also apply to visitor management systems, and housing societies that routinely collect numbers. This new laws will compel them to adopt system-driven methods.

Personal data like phone numbers can be stored only for as long as required to fulfill the original purpose—up to three years from the last user interaction or as specified under the rules, according to the TOI report. Once the purpose is achieved or consent is withdrawn, the data must be erased. Companies are also required to put in place safeguards to prevent unauthorized collection, misuse, or leakage of customer information.