PDPA Basics for Small Shops Collecting Customer Phone Numbers

This article is general information, not legal advice. For your own situation, read the guidance at pdpc.gov.sg or speak to a qualified adviser.

Does the PDPA apply to a small shop?

If your business collects personal data from customers, the Personal Data Protection Act is relevant to you, whatever the size of the business. A customer’s phone number, especially when it is linked to their name or visit history, is personal data. So is a loyalty record built around it.

Three ideas that matter day to day

• Purpose — have a reasonable reason for collecting the data, and do not collect it first and decide the reason later.
• Notification — tell the customer why you are collecting it.
• Consent — the customer agrees to you collecting and using it for that purpose.

What this looks like at the counter

It does not need to be complicated. When a customer joins a loyalty programme, a staff member can say one short sentence, such as: “We will use your number only for your points and your receipts. Is that okay?” A small sign at the counter that says the same thing makes it consistent.

Marketing messages need extra care

A number given for loyalty points is not automatically permission to send promotions. Get the customer’s clear agreement before you send marketing messages, and if you send marketing by call, text or messaging app to Singapore numbers, check the Do Not Call rules on the PDPC website first.

Keep it secure, and keep it short

• Limit who can see customer data to the staff who need it.
• Remove access when someone leaves.
• Do not keep data you no longer need.
• Make it easy for customers to withdraw their consent or ask what you hold about them.

Someone should be responsible

Organisations are expected to have someone responsible for data protection. In a small shop, that can be the owner or a senior team member, as long as it is clearly assigned.

When something goes wrong

If customer data is lost, or seen by someone who should not have it, do not ignore it. The PDPC publishes guidance on what to do and when to report an incident. Read it before you need it.

Choosing your tools

Whatever system you use for receipts or loyalty, ask where customer data is stored, who can see it, whether you can export it and whether it is ever sold or shared. With loopd, customer data is stored securely and never sold or shared with third parties, and each merchant only sees data from their own customers. Even so, using any tool does not pass your own responsibilities to the tool, so keep your own notice and process in place.

A five-point checklist

• Know what customer data you collect and why.
• Tell customers, and get their agreement.
• Use the data only for the purpose you gave.
• Keep it secure and limit access.
• Know who is responsible, and what you would do if something went wrong.

For more on getting value from customer data responsibly, see our five monthly customer data checks.