Soon, retailers across India may no longer be able to ask you for your mobile number at the checkout counter. New rules under the Digital Personal Data Protection Act are poised to change how businesses collect and handle customer information, particularly mobile numbers, which are often used as identifiers.

Currently, many retailers request your mobile number to enroll you in loyalty programs or to send digital receipts. While customers may provide this information, doing so verbally in a public setting can expose personal data, potentially violating the upcoming law's requirement for reasonable data protection safeguards.

The new regulations will mandate that customers be informed about why their data is being collected, how long it will be stored, and when it will be deleted. Personal data, like phone numbers, can only be retained as long as necessary to fulfill the original purpose, with a maximum retention period of three years from the last user interaction, unless otherwise specified. Once the purpose is achieved or consent is withdrawn, the data must be deleted.

Businesses will also be prohibited from denying services to customers who refuse to share their mobile numbers unless the number is integral to the service, such as mobile top-ups or Digi Yatra. Retailers will be required to offer alternative options like email receipts or physical copies. Even visitor entry systems will need to clearly state the purpose of collecting mobile numbers and assure users that the data will not be reused or sold.

The aim is not to disrupt business but to enforce accountability, ensuring data is used only for the stated purpose and then deleted. Small adjustments, such as using keypad entry instead of oral disclosure of mobile numbers, can significantly improve privacy protections.

Many consumers are already wary of sharing their mobile numbers due to the influx of spam SMS messages, unwanted WhatsApp business messages, and marketing or scam calls. This practice of collecting mobile numbers is widespread, with many shops requesting it for billing purposes, even when it's not legally required.

The Ministry of Consumer Affairs has stated that forcing customers to provide a mobile number to complete a transaction is an "unfair and restrictive trade practice" under the Consumer Protection Act. Consumer courts have also supported this stance, affirming that retailers cannot deny a sale if a customer declines to share their contact details.

Under the Digital Personal Data Protection Act (DPDP), retailers cannot assume they have the right to use or store your phone number for marketing purposes without explicit consent. If data is collected for billing, it cannot be repurposed for telemarketing or shared with third parties without permission. Moreover, consumers have the right to request the deletion of their data at any time.

Until these regulations are fully implemented, consumers can take steps to protect their privacy. They can politely refuse to provide their number, asking if there is a "guest" or "skip" option. Giving a dummy number is another option, although it may complicate returns or exchanges. Using a unique UPI ID instead of one that displays your phone number can also help. Consumers should only opt-in to share their number when necessary and use email for e-receipts to limit phone-based spam. It's also important to be aware of your rights under the Consumer Protection Act and the new Data Protection Act.