Overview

• MeitY has published the draft DPDP Rules, 2025 to operationalise the Digital Personal Data Protection Act, 2023.
• Retailers would be prohibited from denying service if shoppers decline to share mobile numbers and must offer alternatives such as email or printed receipts.
• Consent would need to be explicit and informed, with experts warning that speaking phone numbers aloud at checkout could violate required safeguards; keypad entry is suggested.
• Phone numbers could be retained only as necessary and for up to three years from the last interaction, with deletion mandated once the purpose is met or consent is withdrawn.
• The draft extends obligations to visitor management systems and housing societies, bans resale or misuse of numbers, and requires security controls with significant penalties for breaches under the Act.