Your Billing Counter Collects Phone Numbers. Customer Data Privacy Law Now Asks Why.

India’s Digital Personal Data Protection Act, 2023 allows penalties up to Rs 250 crore for failing to secure customer data. Most restaurant operators in Ahmedabad, Pune, or Surat have never read a page of it. Yet every billing counter that asks for a phone number now handles regulated personal data. Customer data privacy stopped being an IT problem the day Parliament passed that Act.

I have seen the same pattern in almost every restaurant setup I have audited. Owners collect phone numbers with great care and then handle them with none. The numbers sit in the POS, get copied into WhatsApp, and leave on staff phones. That worked when nobody was checking. It will not work much longer.

What Does Customer Data Privacy Law Mean for Restaurants?

It means every phone number, birthday, and address you collect needs a clear purpose. For most marketing, it also needs recorded consent. Under the DPDP Act, your restaurant is a data fiduciary. Data fiduciary means the business that decides why and how personal data gets used. You carry the liability even when the data sits on Petpooja or Posist servers.

Personal data means any information that identifies a guest. For a restaurant, that covers names, phone numbers, delivery addresses, birthdays, and order history linked to a number. CCTV footage of identifiable diners counts too. If your system can connect a person to a record, the Act applies to that record.

The Act covers personal data collected digitally. It also covers paper data you digitise later. So the handwritten reservation register stays outside it until someone types it into Google Sheets. After that, it is regulated data like everything else on your systems.

The government notified the Digital Personal Data Protection Rules in November 2025. Most operational duties phase in over 18 months, so restaurants have a window, not an exemption. Before you plan around any date, confirm commencement timelines on the MeitY data protection framework page.

When I worked in restaurant operations in Germany, GDPR had already made consent a reflex. No guest went onto a mailing list without a ticked box and a stored record. Operators here need the same reflex now, and most have not started building it.

Before: Where Is Your Restaurant’s Guest Data Sitting Right Now?

In most restaurants, guest data sits in four or five places with no consent record attached. Think of the POS, a WhatsApp broadcast list, a Wi-Fi login page, a reservation sheet, and the manager’s phone. Nobody owns it, and no one can say where any single number came from.

Picture a 60-cover restaurant in Pune doing around 150 orders a day across dine-in and takeaway. The cashier asks every guest for a phone number to send the e-bill. Over two years, that becomes a few thousand numbers in the POS. Then Diwali arrives, and someone exports the list into WhatsApp Business for a festive thali offer.

The guest gave that number for a bill. Nobody asked whether they wanted festive offers. Under the Act, consent must be specific to a stated purpose. So a number taken for billing does not come with marketing permission attached.

The Leaks Nobody Tracks

The Wi-Fi captive portal collects numbers and OTPs, and the vendor often keeps a copy. Meanwhile, the birthday club form at the counter collects dates of birth, sometimes from 16-year-olds. The table QR code sends guests to a third-party ordering page whose terms you have never read. Each one is a data flow you answer for.

Then there is staff movement. Your last floor manager probably still has the customer export on their phone. Kitchens lose people fast, as the numbers in the restaurant staff turnover crisis show. Multiply that one phone by every manager who left in the last two years.

Why Delivery Makes Operators Hungry for Numbers

Swiggy and Zomato mask most customer contact details on delivery orders. So operators chase numbers through bag inserts, QR stickers, and direct-order coupons. The motive makes sense once you see what aggregator commissions really cost you. Building owned channels, as laid out in using AI to escape aggregator commission, is the right direction. Doing it without consent turns your best growth asset into your biggest legal exposure.

After: What Does a Privacy-Compliant Restaurant Look Like?

A compliant restaurant runs a smaller customer list where every number carries a recorded purpose and consent. Any guest can stop messages with one reply. Only two named people can export data. If a billing laptop gets stolen, the owner knows who to inform and by when.

The list shrinks, and that stings for about a week. However, a list where every guest chose to be there behaves differently. Fewer people block you or report your messages as spam. On the WhatsApp Business Platform, quality rating affects how many people you can message. So a clean list protects your ability to send anything at all.

In my experience across restaurant setups, opted-in guests respond better because they expected the message. Loyalty programs depend on exactly that trust. The ideas in what actually works for Gen Z loyalty programs fall apart when guests feel ambushed by your WhatsApp.

Operationally, the after state looks boring. The cashier asks two questions instead of one. Each customer record carries a tag, either billing-only or marketing-approved. Once a quarter, the manager removes everyone who withdrew consent. Even Instagram marketing for restaurants follows the same rule. A giveaway that collects numbers through a Google Form is data collection with full duties attached.

Bridge: How Do You Build a Consent Ledger for Customer Data Privacy?

Build a consent ledger. A consent ledger means one record showing where each customer contact came from, what the guest agreed to, and when. Every campaign, export, and deletion runs through it. Under the Act, proving consent is your job, so the ledger becomes your evidence.

The logic is one rule. If a number has no ledger entry, it does not get a marketing message. Platforms like Petpooja and Posist have customer modules, so check whether yours supports tags or custom fields. For a single outlet, a restricted Google Sheet also works. The tool matters far less than the rule.

Three Actions That Start the Ledger

1. Split the counter question. Ask for the number to send the e-bill. Then ask separately: ‘Can we send you offers on WhatsApp?’ Log the answer as a tag in the POS. Put a short notice on the table tent in English plus Gujarati, Marathi, or Hindi. The Act lets guests read notices in English or any Eighth Schedule language.
2. Send one notice to your legacy list. The Act expects businesses holding older data to inform those people. Tell them what you hold, why you hold it, and how to opt out with one reply. Remove every opt-out within the week. Get a lawyer to check the wording before it goes out.
3. Cut access and get it in writing. Limit export rights to two named people. Remove former staff from WhatsApp Business and shared drives today. Then get written data processing terms from your POS, Wi-Fi, and CRM vendors. Data processor means a vendor that handles data on your behalf. Their leak still lands on you.

Multi-outlet operators need the ledger in one central place. Three outlets with three spreadsheets recreate the same mess, a pattern I see whenever growth outruns restaurant scaling with discipline. Cloud kitchens with their own ordering pages collect even more data per order. That makes repeat rate, one of the core cloud kitchen profitability metrics, dependent on a clean ledger.

What Happens If Guest Data Leaks?

You must inform the Data Protection Board and every affected guest. Under the 2025 Rules, a detailed report to the Board is due within 72 hours of learning about the breach. Failing to notify can attract a penalty of up to Rs 200 crore.

The Board weighs the nature, gravity, and duration of a breach when setting penalties. A Surat café is unlikely to face a Rs 200 crore bill. Still, the ceiling tells you how seriously the law treats silence. Write a one-page breach plan naming who calls the lawyer, who messages guests, and who files with the Board. Keep the CERT-In incident reporting portal bookmarked as well.

What About Guests Under 18?

Any guest under 18 needs a parent’s verifiable consent before you process their data. The Act also bars tracking and targeted advertising directed at children. A café near an Ahmedabad college running a birthday club sits right in this zone. Add one checkbox reading ‘I am 18 or older.’ Without that tick, do not collect the date of birth.

Key Takeaway for Restaurant Operators

• The DPDP Act allows penalties up to Rs 250 crore for failing to secure personal data.
• A phone number collected for billing does not carry marketing consent.
• Your restaurant stays liable when your POS, Wi-Fi, or CRM vendor leaks guest data.
• Proving consent is your burden, so a consent ledger is your evidence.
• Children’s data needs verifiable parental consent, which puts birthday clubs at risk.

What Should You Do This Week About Customer Data Privacy?

Run a one-hour data audit this week. Sit with your manager and map every place guest data lives, who can open it, and whether any consent record exists. That map tells you exactly where the ledger has to start.

1. Open your POS and check how many staff logins can export the customer list.
2. Check who still has admin access to your WhatsApp Business account, including people who left.
3. Ask your Wi-Fi and CRM vendors in writing where they store guest data and who can see it.
4. Count the birthday sign-ups that have no age confirmation attached.

After that hour, you have two options. Keep blasting the old list and hope no guest complains to the Board. Or spend one week building a ledger that makes every future campaign defensible.

Stop guessing. Start building. Get Design Dine Dominate, the complete restaurant business playbook from someone who has actually done it.