SEPTEMBER 26, 2025
In today’s world, our phones carry almost everything about us, which makes data privacy more important than ever. With India’s new Digital Personal Data Protection (DPDP) Act now in effect, retailers are facing a major shift in how they handle customer information.
For years, shops have used details like mobile numbers to run loyalty programs and make shopping smoother. But the new law brings stricter rules on how this data can be collected, stored, and used.
That means the simple act of giving your number at the checkout may soon change. The DPDP Act is asking businesses to take privacy seriously, forcing them to rethink how they manage customer data. For retailers, the big question now is: how do they adapt, and what will it mean for shoppers?
The privacy dilemma: Mobile numbers at checkout
For years, shops have asked customers to provide their mobile numbers at checkout to join loyalty programs or get offers. But the DPDP Act changes that. Sharing numbers aloud isn’t private, so businesses will now need safer ways to collect this information.
As quoted by the Times of India, S Chandrasekhar, a cyber law expert, explains, “Small process tweaks, such as replacing oral disclosure of mobile numbers with keypad entry, can significantly improve privacy safeguards. The law mandates that customers must be told why their data is collected, how long it will be stored, and when it will be deleted. Implied consent will no longer be valid– every consent must be explicit.”
This shift is designed to minimize the risk of personal data exposure and ensure greater transparency in data handling.
Loyalty programs: Navigating the new rules
Loyalty programs have long relied on mobile numbers to track purchases and send offers. But under the DPDP Act, retailers can’t assume consent anymore. Customers must be told why their data is being collected and given clear permission– and they should be able to say no without losing service.
This could change how loyalty programs work, especially for businesses that rely heavily on phone numbers to connect with customers.
Data retention: How long can you keep customer information?
According to the report, another big change under the DPDP Act is how long businesses can keep customer data. Retailers can no longer store personal details like mobile numbers forever. Data can only be kept for as long as it’s needed for the purpose it was collected.
Once that purpose is served– or if a customer takes back their consent– the information has to be deleted. To follow this rule, companies will need better systems to manage and automatically clear old data.
For retailers who’ve been holding on to huge amounts of customer information for years, this will mean rethinking how they handle and store data.
Accountability: A new standard for data handling
The DPDP Act puts accountability first. Businesses now have to clearly explain why they collect data, how it will be used, and how long it will be kept. They also need to be transparent about any risks and make sure personal information is protected from misuse or unauthorized access.
As mentioned in the Times of India report, as S Chandrasekhar notes, “The broader intent is not to disrupt business but to enforce accountability, ensuring data is used only for the stated purpose and then deleted.”
While the DPDP Act does not seek to limit business operations, it does put in place stricter guidelines for how personal data is used. Companies will need to reassess their current data handling policies to ensure they are in compliance with the new law.
Courtesy/Source: Entertainment Time / PTI
