Sector reference
DPDP for Retail Shops, Including Pharmacies
- What is processed
- What the shop needs for the purchase, the bill, or a service you asked for, including a phone number you choose to give so that a receipt can reach you.
Why it is allowed, and when
The Act works this through as its own example. A customer at a pharmacy hands over her details and asks for the payment receipt to be sent to her phone, so the pharmacy may use the number to send it.
Where the permission stops
The example authorises the receipt, and only the receipt. It does not, by itself, give the shop a reason to market to you.
Questions people actually ask
Can a pharmacy use my phone number?
Yes, for the reason you gave it. This is the Act's own worked example: you hand a pharmacy your number so it can message you the payment receipt, and it may use it for exactly that.
The number does not arrive with permission to market to you. That is a separate ask.
Can a pharmacy or retail store add me to a WhatsApp broadcast or SMS offers just because I gave my number for a bill?
No. Giving a number so a bill can reach you does not cover promotional messages. Marketing is not on the law's short list of situations where nobody has to be asked, so those need your agreement specifically.
Can a loyalty programme app keep my purchase history after I stop using it?
Only while a live reason remains, or while a law requires it. Once you have stopped using the programme and the reason has ended, it should be deleted rather than kept in case you come back.
The shop asks for my phone number at billing. Do I have to give it?
No. A bill does not need your phone number, and nothing in this law requires you to hand one over in order to buy something.
If you do give it, you have given it for the reason stated, which is usually the receipt. That is the whole of what it covers.
Where a shop treats the number as necessary when it plainly is not, it was never necessary for the purchase, and it does not carry over into anything else.
Can the pharmacy keep a record of the medicines I bought?
Yes, where another law requires it, as it does for some categories of medicine. Where that is the reason, it is the law doing the work and not your agreement.
Outside what those rules require, the ordinary test applies. Keep it while there is a live reason, then delete it.
A record kept because it is required is not a record they may also mine. Using a purchase history to work out who has a long term condition, and market to them, is a different purpose with nothing behind it.
What people get wrong
We need your phone number to complete the bill.
Only what the stated purpose genuinely needs can be required. If the purpose is a paper bill, your number is not needed for it. If you want the receipt by message, that is a purpose you chose, and you can equally decline it.
You gave us your number, so we added you to our offers broadcast.
The Act's own pharmacy example allows the number to be used to send the receipt she asked for. It stops there. Promotional messages are a separate thing. Marketing is not on the law's short list of situations where nobody has to be asked, so it needs your agreement.
Related questions
- Is a phone number personal data?
- Can I send marketing emails under DPDP?
- What is legitimate use under Section 7?
This sector sits inside the full Sector Reference, which covers 26 sectors and 160 questions. To work through your own organisation rather than the general case, the Template Builder starts from your answers.