By Lal Singh No, collecting customer data without a privacy policy or proper privacy notice is not legally safe in India. A business can collect customer data for genuine purposes like order delivery, billing, appointment booking, warranty, customer support or account creation. But it must tell customers what data is being collected, why it is being collected, how it will be used, and how customers can exercise their rights.
In today’s business world, data is not a small side detail. A phone number, email ID, address, date of birth, location, Aadhaar detail, payment information, health record or purchase history can reveal a lot about a person. That is why Indian law now treats customer data as a serious responsibility, not just a marketing tool.
What Counts as Customer Data?
Customer data includes any information that can identify a person directly or indirectly. This may include name, mobile number, email, home address, IP address, device ID, location, order details, payment records, photos, feedback, browsing behaviour or complaint history.
For example, a salon taking customer phone numbers for appointments, an online store collecting delivery addresses, a coaching centre collecting student details, or a clinic collecting health information — all are handling personal data.
What Does Indian Law Say?
India’s Digital Personal Data Protection Act, 2023 applies to digital personal data collected in India, and also to certain processing outside India if it relates to offering goods or services to people in India. The Act says personal data may be processed only for lawful purposes and according to the Act. It also requires notice before or along with a request for consent, explaining the personal data being collected and the purpose of processing.
The DPDP Rules, 2025 were notified in November 2025. They say the notice must be understandable on its own, written in clear and plain language, and must include an itemised description of the personal data and the specific purpose for which it is being processed. The notice must also provide a way for the customer to withdraw consent, exercise rights and complain.
So, a hidden or missing privacy policy is not a good practice anymore. It can become a legal weakness.
Privacy Policy vs Consent
A privacy policy is not the same as consent. A privacy policy tells the customer what the business does with data. Consent means the customer agrees to that specific use.
Under the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, with clear affirmative action. It must also be limited to the personal data necessary for the stated purpose.
For example, if a customer gives a phone number for delivery updates, the business should not automatically use it for unrelated promotional WhatsApp messages unless proper consent is taken.
Can a Small Business Collect Data Without a Website Privacy Policy?
A small offline business may not have a website, but it should still give a basic privacy notice if it collects customer data digitally. This can be done through a printed notice at the counter, WhatsApp message, Google Form text, invoice note, booking form, app page or website policy.
For example, a small tiffin service collecting names, addresses and phone numbers can mention: “We collect your name, address and mobile number only for food delivery, billing and customer support. We do not sell your data.”
That simple clarity is better than collecting data silently.
What Is Not Allowed?
A business should not collect unnecessary data. A clothes shop usually does not need Aadhaar details. A café loyalty programme does not need a customer’s full home address unless home delivery is involved. A coaching centre should not collect excessive student or parent data without a clear reason.
It is also risky to sell customer numbers to marketers, add customers to WhatsApp broadcast lists without consent, share data with agents, use customer data for unrelated ads, or keep old data forever without purpose.
Children’s Data Needs Extra Care
If the business collects data of children, the law becomes stricter. The DPDP Act requires verifiable consent from the parent or lawful guardian before processing a child’s personal data. It also restricts processing that may harm a child’s well-being, and bars tracking, behavioural monitoring or targeted advertising directed at children.
This matters for schools, coaching centres, kids’ apps, toy brands, tuition centres, activity classes and children’s healthcare services.
What Can Happen If There Is a Violation?
The DPDP Act allows the Data Protection Board to inquire into breaches and impose monetary penalties. For serious failures, penalties can go very high, including up to ₹250 crore for failure to take reasonable security safeguards, and up to ₹200 crore for failure to notify a personal data breach.
This does not mean every small shop will immediately face a huge penalty. But it clearly shows that privacy compliance is no longer optional.
What Should a Business Do?
A business should create a simple privacy policy or privacy notice covering what data is collected, why it is collected, how long it is stored, whether it is shared with delivery partners or service providers, how customers can withdraw consent, and whom they can contact for complaints.
It should collect only necessary data, protect it with passwords and limited access, avoid sharing customer lists casually, and delete data when it is no longer needed.
Final Answer
Collecting customer data without a privacy policy or privacy notice is not legally safe in India. A business may collect customer data for lawful and genuine purposes, but it must be transparent, take proper consent where required, collect only necessary details, protect the data and give customers a way to exercise their rights.
The clean rule is simple: customer data is not free raw material. If your business collects it, your business must explain it, protect it and use it only for the purpose the customer understands.