Abstract: The collection of customer phone numbers has become a common feature of retail transactions in India. Retail establishments frequently request phone numbers for purposes such as digital invoicing, warranty registration, delivery coordination, customer support, loyalty programes , promotional communications, and business analytics. While such practices may facilitate operational efficiency and customer convenience, they also raise significant concerns regarding privacy, transparency, excessive data collection, and the lawful processing of personal data.
The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) has introduced a comprehensive framework governing the processing of digital personal data in India. Customer phone numbers constitute personal data under the Act and their collection, storage, use, sharing, and retention are therefore subject to statutory obligations imposed upon data fiduciaries. Contrary to the assumption that all phone number collection requires express consent, the DPDP Act recognises both consent-based processing and certain lawful processing activities under Section 7 relating to legitimate uses. Consequently, the legality of retail data collection depends upon the purpose, necessity, transparency, and manner of processing rather than the mere act of collection itself.
This article examines the legal framework governing customer phone number collection by retail stores under the DPDP Act, 2023. It analyses consent requirements, legitimate uses, data retention obligations, loyalty programmes, third-party sharing practices, and compliance challenges faced by retailers. The article argues that the Act seeks to balance commercial efficiency with individual privacy by promoting responsible data governance, transparency, accountability, and consumer trust.
Keywords: Digital Personal Data Protection Act, 2023; Personal Data; Retail Sector; Customer Phone Numbers; Consent; Legitimate Uses; Data Fiduciary; Privacy.
Introduction: The digital transformation of the retail sector has significantly increased the collection and processing of customer information during routine commercial transactions. Customers purchasing goods from supermarkets, pharmacies, clothing stores, electronic outlets, and online-assisted retail platforms are frequently requested to provide their phone numbers at billing counters. Retailers often justify such collection on grounds including digital invoice generation, warranty registration, product delivery, customer support services, loyalty programmes, membership benefits, promotional communication, and business management purposes.
Although these practices may improve customer experience and operational efficiency, they also raise important legal questions concerning privacy, transparency, informed consent, data retention, and the subsequent use of personal information. Customers are often unaware of how their phone numbers will be stored, shared, analysed, or retained after the completion of a transaction. Such concerns have become increasingly significant in an economy where personal data possesses substantial commercial value.
The Digital Personal Data Protection Act, 2023 represents India’s first comprehensive legislation specifically regulating the processing of digital personal data. The Act establishes rights for individuals and corresponding obligations for entities that collect and process personal information. Importantly, the legislation does not prohibit the collection of customer phone numbers. Instead, it regulates the circumstances under which such collection may lawfully occur and imposes accountability obligations upon organisations processing personal data.
The legality of customer phone number collection must therefore be assessed by examining the purpose of collection, the existence of valid consent where required, the applicability of legitimate uses under Section 7, compliance with notice obligations, and adherence to principles of responsible data governance. Accordingly, the DPDP Act transforms what was previously regarded as a routine business practice into a regulated legal activity subject to statutory oversight and compliance obligations.
Constitutional and Privacy Background
The protection of personal data in India is closely connected with the constitutional recognition of privacy. Article 21 of the Constitution guarantees the right to life and personal liberty. Judicial interpretation has expanded the scope of Article 21 to include various dimensions of personal autonomy, dignity, and informational privacy.[1]
In Justice K.S. Puttaswamy (Retd.) v. Union of India, the Supreme Court recognised privacy as a constitutionally protected right and acknowledged informational privacy as an important component of individual autonomy.[2] The Court emphasised that individuals should possess meaningful control over information relating to them. However, the judgment did not specifically address retail billing practices or customer phone number collection. Its relevance lies in providing the broader constitutional foundation for modern data protection legislation in India. Similarly, constitutional principles concerning proportionality and procedural safeguards provide useful guidance when evaluating data collection practices. However, the legality of customer phone number collection by retail stores must primarily be assessed through the statutory framework of the DPDP Act rather than through direct application of constitutional jurisprudence. Accordingly, judicial precedents serve only as contextual support, while the primary source of legal regulation remains the DPDP Act, 2023.
Legal Framework Under the Digital Personal Data Protection Act, 2023
The DPDP Act establishes a rights-based framework governing the processing of digital personal data. Several provisions are particularly relevant to the collection of customer phone numbers by retail establishments.
Customer Phone Numbers as Personal Data: Section 2(t) defines personal data as any data about an individual who is identifiable by or in relation to such data. [3]A customer’s phone number clearly falls within this definition because it directly identifies or is capable of identifying a particular individual. Consequently, whenever a retail store collects, stores, uses, shares, analyses, or deletes customer phone numbers in digital form, such activities constitute processing of personal data under the Act and must comply with its requirements.
Data Principal and Data Fiduciary: The DPDP Act recognises two key participants in the data processing relationship. A customer whose phone number is collected constitutes a Data Principal.[4] The retail store that determines why and how the phone number will be processed generally functions as a Data Fiduciary.[5] The classification is significant because data fiduciaries are subject to statutory obligations relating to transparency, security, accuracy, grievance redressal, retention practices, and lawful processing of personal data.
Lawful Processing of Personal Data: Section 4 provides that personal data may be processed only for lawful purposes in accordance with the provisions of the Act.[6]
Importantly, the Act does not establish a consent-only model. Processing may occur either:
(a) on the basis of valid consent under Section 6; or
(b) under certain legitimate uses recognised by Section 7.
This distinction is particularly important in the retail sector because some forms of customer phone number collection may be justified by operational necessity, while others may require explicit consent.
Notice Requirement: Before requesting personal data, the data fiduciary must provide notice containing information regarding:
– the personal data proposed to be processed;
– the purpose of processing;
– the manner in which rights may be exercised; and
– grievance redressal mechanisms available to the data principal.[7]
For retail stores, this means that customers should receive adequate information regarding why their phone number is being collected and how it will be used.
Consent Requirements Under the DPDP Act, 2023: Consent constitutes one of the principal legal bases for processing personal data under the DPDP Act. Section 6 requires consent to be free, specific, informed, unconditional, unambiguous, and communicated through a clear affirmative action.[8]The Act seeks to ensure that individuals retain meaningful control over the use of their personal information and are aware of the purposes for which such information is being processed.
In the retail context, consent becomes particularly important when a customer’s phone number is collected for activities extending beyond the immediate transaction. For example, where a retailer seeks to use customer phone numbers for promotional messages, targeted advertising, customer profiling, marketing campaigns, or other secondary purposes, valid consent is generally necessary. Customers should be informed of these purposes before their data is collected and should not be compelled to provide consent through misleading or coercive practices. The Act also recognises the right of a Data Principal to withdraw consent. Consequently, retailers relying on consent as a legal basis must establish mechanisms enabling customers to revoke their consent without unnecessary obstacles. [9]Upon withdrawal, further processing based solely upon that consent must cease unless another lawful basis exists under the Act.
Accordingly, consent cannot be treated as a mere formality. Retailers must ensure that customers are adequately informed regarding the intended use of their phone numbers and are provided with a genuine opportunity to exercise choice.
Section 7 and Legitimate Uses in Retail Transactions: One of the most significant features of the DPDP Act is the recognition of certain lawful processing activities under Section 7. The Act therefore does not establish a purely consent-based regime. Instead, it acknowledges that certain processing activities may be necessary to facilitate legitimate interactions between individuals and organisations. [10]For retail establishments, Section 7 is particularly relevant because many routine business activities involve processing customer information to provide services requested by customers themselves.
Customer-Initiated Transactions: Where a customer voluntarily approaches a retailer seeking goods or services and reasonably expects the processing of certain personal information for the completion of that transaction, such processing may fall within legitimate use provisions. For example, a customer purchasing an appliance and requesting warranty registration may reasonably expect the retailer to collect contact information necessary to complete that process. Similarly, customers requesting home delivery services may expect retailers to collect and use phone numbers for delivery coordination.
Digital Invoices and E-Receipts: Many retail establishments now offer digital invoices instead of printed receipts. In such circumstances, collection of a phone number for transmitting an invoice may be reasonably connected with the service requested by the customer. However, the lawful collection of a phone number for issuing a digital receipt does not automatically authorise the retailer to use the same number for unrelated promotional activities. The purpose for which data is collected remains an important consideration under the Act.
Warranty Registration and After-Sales Support: Retailers frequently assist customers with warranty activation, service requests, product replacement procedures, and customer support services. These activities often require contact information to facilitate communication between the customer, retailer, and manufacturer.
Where the phone number is collected solely for such operational purposes, the processing may be justified by the nature of the service requested. Nevertheless, retailers should remain transparent regarding how long the information will be retained and whether it will be shared with third parties involved in providing those services.
Delivery and Logistics Services: Home delivery, order tracking, installation support, and logistics coordination commonly require customer contact information. In such cases, the collection and use of phone numbers are generally connected to the fulfilment of the transaction itself.
The legality of processing in these situations depends upon necessity, transparency, and purpose limitation. Retailers should avoid retaining such information indefinitely once the purpose has been fulfilled.
Distinguishing Lawful, Excessive, Coercive and Deceptive Collection: A major compliance issue in retail environments is the failure to distinguish between different forms of data collection. Not every request for a customer’s phone number is unlawful; however, not every collection practice is necessarily compliant.
Lawful Collection: Collection may be regarded as lawful where:
– the purpose is clearly communicated;
– the information collected is reasonably necessary;
– processing is supported by consent or a legitimate use under the Act;
– the customer receives appropriate notice; and
– the information is handled in accordance with statutory obligations.
For instance, obtaining a phone number to send an electronic invoice requested by the customer may constitute a lawful collection practice.
Excessive Collection: Collection may become excessive where the information requested bears little relationship to the stated purpose. For example, requiring extensive personal details for a simple cash purchase may raise concerns regarding necessity and proportionality. Data minimisation principles suggest that organisations should collect only the information reasonably required for a legitimate objective.
Coercive Collection: Coercive collection occurs where customers are effectively denied goods or services unless they provide information that is not genuinely necessary for the transaction.
If a retailer refuses to complete an ordinary purchase unless a customer discloses a phone number despite no operational need for such information, questions may arise regarding the voluntariness of consent and the fairness of the collection practice.
Deceptive Collection: Deceptive collection occurs when customers are misled regarding the purpose for which their information is collected. For example, collecting a phone number under the representation that it is required for billing purposes while subsequently using it for unsolicited marketing communications without adequate disclosure may undermine transparency obligations under the Act.
The distinction between lawful, excessive, coercive, and deceptive collection is crucial because the legality of phone number collection depends not merely upon the fact of collection but upon the purpose, necessity, transparency, and manner in which the information is processed.
Loyalty Programmes, Membership Schemes and Reward Systems:
Modern retailers increasingly rely upon loyalty programmes, membership schemes, reward points systems, and personalised customer engagement initiatives. These programmes often require customers to provide phone numbers to create accounts, track purchases, accumulate rewards, and receive promotional benefits.
Unlike routine billing activities, participation in loyalty programmes is generally voluntary. Consequently, retailers should clearly explain:
– the benefits associated with membership;
– the categories of personal data being collected;
– the purposes for which such data will be used;
– whether profiling or personalised marketing will occur; and
– the rights available to participants under the DPDP Act.
Where participation is genuinely optional, customers should retain the ability to purchase goods without enrolling in loyalty programmes unless membership itself forms part of the service being requested. Retailers must also avoid bundling unrelated processing activities into loyalty programme enrolment. A customer who agrees to receive reward points does not automatically consent to unrestricted marketing communications or extensive data-sharing arrangements unless such activities have been adequately disclosed.
The increasing commercial value of customer analytics and behavioural data makes transparency particularly important in loyalty programme operations. Responsible data governance requires retailers to ensure that customers understand the implications of participation and are able to make informed choices regarding the use of their personal information.
Data Retention, Storage and Deletion Obligations: The collection of customer phone numbers creates responsibilities that extend beyond the initial act of collection. The DPDP Act requires data fiduciaries to ensure that personal data is retained only for as long as necessary to fulfil the purpose for which it was processed.[11]
In the retail sector, retention periods may vary depending upon the nature of the transaction. Information collected for issuing an electronic invoice, processing a delivery request, facilitating customer support, or completing warranty registration may need to be retained for a limited period to fulfil contractual, operational, or legal requirements. However, indefinite retention of customer phone numbers without a legitimate purpose may be inconsistent with the objectives of responsible data governance.
Retailers should therefore establish clear internal policies governing:
– retention periods for customer data;
– storage practices and access controls;
– periodic review of stored information;
– deletion procedures upon fulfilment of purpose; and
– mechanisms for responding to customer requests concerning personal data.
Effective retention policies not only promote compliance with statutory obligations but also reduce the risks associated with unauthorised access, data breaches, and misuse of customer information.
The DPDP Act encourages organisations to ensure that personal data is erased when retention is no longer necessary for the purpose for which it was collected, unless retention is required by law. Consequently, retailers should avoid treating customer databases as permanent repositories of information accumulated through routine transactions.
Third-Party Sharing of Customer Phone Numbers: The commercial value of customer information has increased significantly in the digital economy. As a result, customer phone numbers may be shared with service providers, logistics partners, marketing agencies, technology vendors, manufacturers, and affiliated business entities. Such sharing raises important legal and compliance concerns.
Sharing with Service Providers: Retailers may legitimately share customer phone numbers with delivery companies, warranty service providers, payment processors, customer support vendors, and technology partners where such sharing is necessary to facilitate services requested by customers. However, retailers remain responsible for ensuring that appropriate safeguards exist and that third-party processing remains consistent with the purposes for which the information was originally collected.
Sharing for Marketing and Advertising: Greater legal scrutiny arises where customer phone numbers are shared for advertising, promotional campaigns, behavioural profiling, or targeted marketing activities. If a retailer intends to use customer information for promotional communications or share such information with advertising partners, customers should be clearly informed of such practices. Transparency regarding marketing-related processing is essential to maintaining consumer trust and ensuring compliance with the principles underlying the DPDP framework.
Sharing with Affiliates and Group Entities: Large retail chains often operate through networks of affiliated entities. Customer information collected by one entity may be valuable to another entity within the same corporate group.
Nevertheless, organisational convenience alone should not justify unrestricted circulation of customer data. Retailers should clearly communicate the circumstances in which customer information may be shared within corporate groups and ensure that such processing remains consistent with lawful purposes. The legality of third-party sharing therefore depends not only upon the existence of a commercial relationship but also upon transparency, necessity, accountability, and compliance with the obligations imposed by the DPDP Act.
Compliance Challenges Faced by Retailers: Although the DPDP Act establishes a structured framework for personal data protection, practical implementation presents several challenges for retail businesses.
Lack of Consumer Awareness: Many customers remain unaware of their rights regarding personal data. As a result, individuals frequently provide phone numbers without understanding how the information may subsequently be used or retained.
Inconsistent Collection Practices: Retail environments often involve multiple employees interacting directly with customers. Without adequate training, staff members may provide inconsistent explanations regarding why phone numbers are requested, resulting in confusion and potential compliance concerns.
Legacy Business Practices: Many retailers historically collected customer phone numbers as a routine business practice without implementing comprehensive privacy policies or retention procedures. Transitioning to a compliance-oriented framework requires organisational adjustments and investment in data governance systems.
Managing Consent and Withdrawal Requests: Where retailers rely upon consent, they must establish systems capable of recording, managing, and responding to consent-related requests. Operational difficulties may arise where large customer databases have accumulated over extended periods.
Third-Party Risk Management: Retailers frequently depend upon external service providers for logistics, customer support, digital marketing, and analytics functions. Ensuring compliance across multiple service providers may present practical and contractual challenges.
These issues demonstrate that compliance under the DPDP Act extends beyond legal documentation and requires the adoption of effective organisational, technical, and administrative safeguards
Recommendations: To promote compliance and strengthen consumer trust, retail establishments should adopt the following measures:
Clearly communicate the purpose for which customer phone numbers are collected.
Distinguish between data required for completing a transaction and data sought for optional services or marketing activities.
Avoid requesting phone numbers where no genuine operational need exists.
Ensure that participation in loyalty programmes remains voluntary and transparent.
Develop written retention and deletion policies governing customer information.
Conclusion: The collection of customer phone numbers has become an integral component of modern retail operations. Retailers utilise such information for a wide range of purposes, including digital invoicing, warranty registration, customer support, delivery coordination, loyalty programmes, and promotional engagement. While these practices may offer operational and commercial benefits, they also involve the processing of personal data and therefore fall within the scope of the Digital Personal Data Protection Act, 2023.
The DPDP Act does not prohibit the collection of customer phone numbers. Rather, it establishes a legal framework governing the circumstances under which such collection and processing may occur. Importantly, the Act recognises both consent-based processing and certain legitimate uses under Section 7.
Consequently, the legality of retail data collection cannot be assessed through a simplistic consent-only approach. Instead, it depends upon the purpose of processing, transparency, necessity, accountability, and compliance with statutory obligations. A distinction must be drawn between lawful collection practices that facilitate customer-requested services and problematic practices involving excessive, coercive, or deceptive collection. Similarly, issues relating to loyalty programmes, third-party sharing, retention periods, and deletion obligations require careful consideration within the broader framework of responsible data governance.
As India’s data protection regime continues to evolve, retailers must move beyond viewing customer phone numbers merely as commercial assets and instead recognise them as personal data subject to legal protection. Effective compliance with the DPDP Act not only reduces legal risk but also promotes consumer confidence, trust, and long-term business sustainability.
Bibliography:
Legislation:
Constitution of India.
Digital Personal Data Protection Act, No. 22 of 2023 (India).
Digital Personal Data Protection Bill, 2023.
Cases:
Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
Committee Reports:
Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians (2018).
Books:
Graham Greenleaf, Asian Data Privacy Laws: Trade and Human Rights Perspectives (Oxford University Press 2014).
Journal Articles:
Anubha Sinha, Data Protection and Informational Privacy in India, 15 Indian Journal of Law and Technology (2019).
Rahul Matthan, Privacy, Consent and Data Governance Under India’s Emerging Data Protection Framework, 12 NUJS Law Review (2019).
[1] Constitution of India, art. 21.
[2] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
[3] Digital Personal Data Protection Act, 2023, s. 2(t).
[4] Digital Personal Data Protection Act, 2023, s. 2(j).
[5] Digital Personal Data Protection Act, 2023, s. 2(i).
[6] Digital Personal Data Protection Act, 2023, s. 4.
[7] Digital Personal Data Protection Act, 2023, s. 5.
[8] Digital Personal Data Protection Act, 2023, s. 6.
[9] Digital Personal Data Protection Act, 2023, s. 6(4).
[10] Digital Personal Data Protection Act, 2023, s. 7.
[11] Digital Personal Data Protection Act, 2023, s. 8.
