DPDP for retail stores, restaurants, salons and gyms

Physical retail and hospitality collect personal data in small moments: a cashier asking for a mobile number, a loyalty form at the till, a Wi-Fi login, a feedback QR code on the table, a reservation under a name, a gym trainer recording weight and waist size. Each moment feels harmless. Added up across hundreds of outlets and franchisees, they produce a large customer database that is used far beyond the reason it was collected, mostly for promotions.

The risk sits in three places. First, marketing on the back of billing: numbers taken “for the bill” that end up in SMS and WhatsApp campaigns. Second, sensitive data in casual places: gym health questionnaires and progress photos, salon allergy and skin notes, CCTV footage, all held on trainers’ phones, shared drives or a DVR anyone can access. Third, many hands: franchisees, store staff, aggregators and vendors all touch the same customer. This guide applies the Data Fiduciary playbook to stores, restaurants, salons and gyms.

Are you a Data Fiduciary, a processor, or both?

• Brand-owned stores, restaurants, salons and gyms: you are the Data Fiduciary for customers, members, guests and staff. Your POS and loyalty vendor, CRM, Wi-Fi provider, SMS and WhatsApp provider, reservation software, CCTV monitoring company and cloud host are your Data Processors.
• Franchise networks: decide this in writing. Usually the franchisor is a fiduciary for the central loyalty programme, app and CRM, and each franchisee is a fiduciary for its own billing, staff and CCTV. Where a franchisee only runs the brand’s POS and loyalty system as instructed, it acts as the brand’s processor for that data. Ambiguity here means nobody answers the customer.
• Restaurants on delivery and booking aggregators: the aggregator is the fiduciary for its own users. You receive limited order data (a name, sometimes a masked number, an address for some delivery models) to fulfil the order. You become a fiduciary for what you receive, but only for fulfilling that order. Copying aggregator customers into your own marketing list without their consent is a breach, and usually a breach of the aggregator contract too.
• Mall operators and shopping centres: you are a fiduciary for mall-wide Wi-Fi, parking, mall loyalty apps and common-area CCTV. Each tenant is a separate fiduciary for its store.
• Gyms and studios with independent trainers: a trainer employed by you processes member data as your staff. A freelance trainer who keeps their own client book is a separate fiduciary for that, and must not take your member list.
• Co-branded cards and partner offers: a bank or wallet running a co-branded loyalty card is a separate fiduciary. Share data with it only with the customer’s consent, naming the partner.

The data you hold

Data category	Where it usually lives	Typical purpose	Sensitivity	Typical retention
Mobile number, name at billing	POS, billing software, e-bill provider	E-bill, returns, warranty	Medium	E-bill and return window, then the one-year log minimum
Loyalty profile: points, tier, birthday, anniversary, preferences	Loyalty platform, CRM, app	Earning and redeeming points, member offers	Medium	While the member is active; points are a virtual token
Purchase history	POS, data warehouse, loyalty platform	Points, returns, analytics, offers	Medium (can reveal health, religion, finances)	Set a limit for analytics; tax law for invoices
Wi-Fi login: phone, OTP log, device MAC, session logs	Captive portal provider, router logs	Internet access, legal logging	Medium	Per telecom requirements and the one-year minimum
CCTV footage	DVR or NVR, cloud camera app, monitoring vendor	Theft prevention, safety, disputes	Medium to high	Short loop (for example 15–30 days) unless an incident is open
Feedback and reviews	Feedback tablets, QR forms, survey tool, Google reviews	Service improvement, complaint handling	Low to medium	6–12 months
Table reservations: name, phone, party size, occasion, dietary notes	Reservation platform, register, WhatsApp	Seating, special requests	Medium (allergies and dietary notes can reveal health or religion)	Until the visit, then a short period
Delivery orders from aggregators	Aggregator merchant app, KOT printer, kitchen display	Preparing and handing over the order	Medium	Until the order and any complaint close
Gym membership and health questionnaire (PAR-Q), medical conditions	Membership software, paper forms, trainer’s phone	Safe training, emergencies	High (health)	During membership; delete detailed health notes on exit
Body measurements, weight, body-fat scans, progress photos	Body-composition machine, gym app, trainer’s WhatsApp	Training plans	High (health, intimate images)	During the programme; delete on exit or request
Salon and spa client cards: skin type, allergies, patch-test results, treatment history	Salon software, notebook, stylist’s phone	Safe treatment, repeat service	High (health-related)	While the client is active
Payment data	Card terminal, UPI provider, payment gateway	Payment, refunds	High	Keep with the payment provider, not with you
Staff records and shift data	HRMS, attendance app, biometric device	Payroll, attendance, safety	High	During employment, then as labour and tax law require
Children’s data: kids’ clubs, birthday parties, junior gym members	Loyalty platform, event registers, membership software	Events, classes	High	See section 9

Risk hotspots

1. “Number for the bill” becoming a marketing list. Cashiers are told to capture a number for every bill, and the number flows into SMS and WhatsApp campaigns. Failure: every promotional message is processing without consent, and refusing a bill without a number makes consent conditional. Control: make the number optional; offer the e-bill under 7(a); ask separately for loyalty and for offers, each unticked, never as a condition of billing.
2. Loyalty programmes with blanket consent. One sign-up form covers points, birthday offers, partner offers, profiling and sharing with co-brands. Failure: bundled consent is not specific (section 6(1)). Control: points and member communications as the core purpose; personalised offers, partner sharing and co-branded cards as separate opt-ins.
3. Store staff and incentives. Staff targets for “numbers captured” push them to enter their own number, a family member’s, or a made-up one. Failure: inaccurate data (section 8(3)) and messages to people who never shopped. Control: drop capture targets; reward consented sign-ups only; OTP-verify loyalty enrolment.
4. CCTV everywhere, kept forever, shared on WhatsApp. Clips of shoplifters, customer disputes or staff incidents get forwarded to groups and social media. Failure: unauthorised disclosure and possible defamation. Control: signage; cameras only where security needs them, never in trial rooms, washrooms or changing areas; short loops; viewing and export restricted to named people; exports logged.
5. Face recognition and footfall analytics. Vendors offer camera-based demographic analytics, repeat-visitor detection and “VIP alerts”. Failure: identifying or profiling people without notice or consent. Control: do not use face recognition on customers for marketing; if you run footfall counting, use systems that do not identify individuals, and document how.
6. Wi-Fi captive portals. Portals collect phone numbers via OTP, then reuse them for marketing and device-level tracking. Control: collect what access and any telecom requirement need; a separate unticked marketing opt-in; no MAC-address tracking of customers’ movement around the store without consent.
7. Gym and salon sensitive data on personal phones. Trainers keep progress photos and measurements on their own WhatsApp; stylists keep allergy notes in personal notebooks. Failure: intimate and health data with no access control, which leaves when the trainer leaves. Control: record health and body data only in the gym’s or salon’s system; no progress photos on personal phones; explicit consent for photos; delete on exit.
8. Aggregator data reuse. Kitchen staff copy customer names and numbers from delivery apps to send offers or “save” regulars. Failure: processing without a ground and a contract breach. Control: use aggregator data only for the order; ask regulars to join your own list through your own consent flow.
9. Feedback forms that ask too much. Table QR forms ask for birthday, anniversary, age and income, and the forms vendor keeps a copy. Control: collect the feedback, and the contact only if the guest wants a reply; marketing as a separate opt-in; a processor contract with the survey tool.
10. Franchisee and vendor sprawl. Hundreds of outlets, each with local WhatsApp groups and exported customer lists. Control: central systems with role-based access; no customer exports at outlet level; franchise agreements with data clauses, audit rights and breach notice to the brand.

Legal basis, purpose by purpose

Purpose	Basis	Notes
Sending an e-bill or payment receipt to the number given	7(a)	The Act’s illustration under section 7(a) is a pharmacy sending a receipt by message. No offers in the same message.
Returns, exchanges and warranty	7(a)	Use the bill and number only for this.
Loyalty points earning and redemption	Consent at enrolment (or 7(a) where the member voluntarily signs up for points only)	Keep the core programme separate from marketing. Points are a virtual token; tell members what happens to unused points.
Birthday and anniversary offers, promotional SMS, WhatsApp and email	Consent, per channel	Also follow TRAI’s commercial-communication rules for SMS and calls.
Personalised offers based on purchase history	Consent	Offer a non-personalised programme.
Sharing with co-brand banks, wallets or partner brands	Consent, naming the partner	Access rights include who you shared with (section 11(1)(b)).
CCTV for theft prevention and safety	Prevention and detection of offences, section 17(1)(c), for security use; 7(i) for staff	A common reading, not a settled one. Sections 8(1) and 8(5) still apply. Do not use footage for marketing or analytics. Confirm with counsel.
Wi-Fi access and any logging a telecom requirement needs	7(a) for access; retention required by law for logs	Marketing from Wi-Fi sign-ups needs consent. Confirm the current Wi-Fi requirement with counsel.
Table reservations and special requests	7(a)	Dietary and allergy notes only for that visit unless the guest asks you to remember them.
Fulfilling aggregator orders	7(a), within the aggregator’s terms	No reuse for marketing.
Gym health questionnaire for safe training	Consent, with a clear explanation of why	Health data is not a separate legal category in DPDP, but treat it as high risk. Limit who sees it.
Body measurements, scans and progress photos	Consent, separately for photos	Members can refuse photos and still train.
Using details in a medical emergency on the floor	7(f)	Narrow: a threat to life or an immediate threat to health.
Staff attendance, shifts, biometric clocks	7(i)	Biometric attendance is high risk; offer an alternative where you can. See employers and HR.

Notices and consent: getting the screens right

Channel	Do	Don’t
POS and billing counter	Ask “E-bill on SMS or WhatsApp?” and take the number only if yes. Show a QR code to the notice on the counter display or card.	Refuse the bill without a number. Ask for loyalty and offers in the same breath.
Loyalty enrolment (tablet, form, app)	Show the itemised notice, then separate unticked toggles for offers, personalisation and partner sharing. OTP-verify the number.	Pre-tick boxes or let staff enrol customers who did not ask.
Wi-Fi captive portal	Show a short notice: what you collect for access and what is logged, plus a separate unticked offers box.	Make marketing consent a condition of Wi-Fi.
Feedback QR or tablet	Ask for contact details only if the guest wants a reply; marketing as a separate choice.	Ask for birthday, age or income on a feedback form.
Reservations (phone, WhatsApp, platform)	Note only what the booking needs; explain why you ask about allergies.	Add every reservation number to your offers list.
Gym and studio sign-up	Give the membership notice, then a separate health questionnaire notice and separate photo consent.	Bundle health data, photos and marketing into the membership form.
Salon client card	Explain why you record allergies and patch tests; keep it on the salon system.	Let stylists keep client notes and photos on personal phones.
CCTV signage	Put signs at entrances, with your contact person and where to find the notice.	Hide cameras or record audio without telling people.
Existing customers and members	Send a section 5(2) notice by SMS, WhatsApp or email with a link to manage choices.	Assume old loyalty forms cover new purposes.

Rule 3 requires every notice to stand on its own, give an itemised list of the data and the purpose for each, describe the goods, services or uses involved, and give a link and other means to withdraw consent, exercise rights and complain to the Board. Notices must be available in English and any of the 22 languages in the Eighth Schedule (section 5(3)). For a chain, start with Hindi and the languages of the states where your outlets are, and keep the rest available on request through the QR link.

Other laws you must line up with

• TRAI TCCCPR: promotional SMS and calls need registered headers, templates and consent. Keep DPDP consent and TRAI preferences in sync.
• Consumer Protection Act, 2019 and the guidelines on dark patterns: forced action, pre-ticked boxes and making a bill conditional on a phone number are consumer-law problems as well as DPDP problems.
• Telecommunications Act, 2023 and DoT requirements for public Wi-Fi: public Wi-Fi may carry authentication and log-retention duties. These are a legal reason to keep certain logs. Confirm the current requirement with counsel.
• Local police, municipal or licensing conditions: some cities and licences (for example for bars, malls or late-night outlets) require CCTV or set how long footage is kept. Confirm the current requirement with counsel.
• Food Safety and Standards Act and FSSAI rules: relevant to allergen and food-safety records, not personal data, but allergy notes about named guests are personal data.
• Shops and Establishments Acts and the labour codes: staff registers, wages and working hours must be kept, which supports retention of staff data.
• GST and income-tax law: retention of invoices and books overrides erasure for those records only.
• RBI rules on card tokenisation and payment aggregators: do not store card numbers; rely on the terminal and gateway.
• IT Act, 2000 and CERT-In Directions (2022): cyber incidents may need reporting to CERT-In on a shorter clock than DPDP. Confirm the current requirement with counsel.

Retention and erasure

1. Section 8(7): erase personal data when consent is withdrawn or the purpose is clearly over, whichever is earlier, unless a law requires you to keep it. Bills: after the return and warranty window. Reservations: shortly after the visit. Gym and salon health notes: when the membership or client relationship ends. CCTV: at the end of the loop unless an incident is open.
2. The one-year minimum: rule 8(3) requires you and your processors to keep personal data, associated traffic data and processing logs for at least one year from the processing, then erase them unless another law requires longer. Build your POS, loyalty and Wi-Fi retention around this.
3. Legal holds: keep the bill, CCTV clip and complaint record when there is a theft, an injury, a consumer complaint or a police request. Record what is held, why and until when.
4. Third Schedule: the three-year inactivity rule applies only to e-commerce entities with 2 crore or more registered users, online gaming intermediaries with 50 lakh or more, and social media intermediaries with 2 crore or more. A store chain is unlikely to meet it. If your online store or app is large enough, see e-commerce and D2C.
5. Loyalty points: points are value the member holds. Before you close a dormant loyalty account, tell the member and let them redeem or keep the account active. Set out your dormancy policy in the programme terms.
6. Processors and franchisees: make the loyalty vendor, CRM, SMS and WhatsApp provider, Wi-Fi provider, reservation platform and franchisees erase on instruction and confirm it.
7. Backups and devices: DVR hard disks, old POS terminals and tablets hold data. Wipe them before disposal or return to the vendor, and make sure restored backups replay erasures.

Rights requests and grievances

• Channels: an in-app privacy section, a web form, a store-level QR code, an email address and the customer-care number. Publish them with the identifier you need, usually the registered mobile number or membership ID (rule 14(1)).
• Identity: verify with an OTP to the registered mobile or email. Do not ask for ID documents you do not already hold. For CCTV requests, ask for the date, time and outlet, not ID.
• Access (section 11): give a summary of the profile, purchases, points, consents, and for gyms, the health and body data you hold. List the fiduciaries and processors you shared data with: loyalty vendor, SMS provider, co-brand partner (if consented), franchisee.
• Correction and erasure (section 12): correct contact details and preferences promptly. Erase loyalty profiles, marketing consents, gym health and body data and salon client cards on request. You may refuse erasure of invoices tax law requires, CCTV under a legal hold, and data needed for an open complaint or recovery of dues. Tell the person what you kept and why.
• CCTV access: a person may ask what footage you hold of them. If you rely on section 17(1)(c) for security CCTV, Chapter III rights do not apply to that processing, but answering is still good practice. Before sharing a clip, blur or crop out other people.
• Grievances: acknowledge quickly. Publish a resolution period within the 90-day ceiling in rule 14(3); 15–30 days is good practice. Name your contact person in every reply (rule 9).
• Nomination (section 14): let members nominate someone, which matters for prepaid memberships, gift cards and loyalty balances.

Breach readiness

Likely scenarios:

• a leaked loyalty database or CRM export
• a compromised SMS or WhatsApp campaign tool
• a franchisee exporting customer lists
• CCTV clips posted on social media
• gym progress photos leaked from a trainer’s phone
• a Wi-Fi portal vendor breach
• ransomware on store POS systems

Run-book:

1. Contain within hours: revoke the vendor’s or franchisee’s credentials, take down posted clips, lock the affected POS or tool.
2. Assess: which data, how many people, and the consequences. Leaked body photos or health data carry a high risk of harm and humiliation; leaked phone lists bring scam calls.
3. Notify each affected person without delay through their account or registered contact, covering every point in rule 7(1): what happened, with its nature, extent and timing; the likely consequences for them; what you are doing to reduce the risk; what they can do (for example, ignore fake “loyalty points” calls asking for OTPs); and who to contact.
4. Notify the Board without delay with a description of the breach, then send the detailed report within 72 hours of becoming aware (rule 7(2)): facts, circumstances and reasons, mitigation, findings about who caused it, remedial steps, and a report on the notices sent to people.
5. Report to CERT-In where its directions apply, inform payment partners if card or UPI data may be involved, and file a police complaint for theft or extortion.
6. Learn: fix the cause, update franchise and vendor contracts, and retrain store staff.

The checklist

Phase 1: discover (days 0–30)

• [DPO] Appoint a DPDP owner and a working group: operations, marketing, IT, legal, HR and a franchise representative.
• [Ops] Map every in-store collection point: POS, loyalty tablet, Wi-Fi portal, feedback QR, reservations, membership desk, salon client card.
• [Eng] Inventory systems: POS, loyalty platform, CRM, data warehouse, app, Wi-Fi portal, reservation tool, CCTV and DVRs, HRMS.
• [Marketing] List every list used for SMS, WhatsApp and email campaigns, and where each list came from.
• [Legal] List processors and franchisees, and collect their contracts and franchise agreements.
• [Ops] Survey CCTV at every outlet: where cameras point, audio, retention, who can view and export.
• [Ops] Find where gym health questionnaires, body scans, progress photos and salon client notes are kept, including staff phones.
• [Ops] Check how aggregator order data is handled in kitchens and whether anyone copies it.
• [Marketing] Check whether any face recognition, footfall or Wi-Fi tracking analytics are running.
• [Ops] Find where children are present: kids’ clubs, birthday parties, junior memberships, family loyalty accounts.

Phase 2: design and build (days 31–90)

• [Legal] Assign a legal basis to each purpose (use the table above) and stop purposes without one.
• [Legal] Write itemised notices for the POS, loyalty, Wi-Fi, feedback, reservations, gym membership, health questionnaire and CCTV.
• [Marketing] Translate notices into Hindi and the languages of your outlet states; make all 22 available through the QR link.
• [Eng] Make the mobile number optional in the POS; separate the e-bill flag from loyalty and offers flags.
• [Eng] Rebuild loyalty enrolment with OTP verification and separate unticked toggles for offers, personalisation and partner sharing.
• [Eng] Check consent before every SMS, WhatsApp, email and audience upload.
• [Eng] Feed withdrawals in real time to the CRM, SMS and WhatsApp tools and franchisee systems.
• [Marketing] Add a one-tap STOP to every promotional message and honour it within a day.
• [Ops] Remove “numbers captured” targets from store staff incentives.
• [Eng] Rebuild the Wi-Fi portal: access notice, separate marketing opt-in, no movement tracking without consent.
• [Ops] Install CCTV signage at every entrance; remove cameras from trial rooms, washrooms and changing areas; turn off audio.
• [Security] Restrict CCTV viewing and export to named roles; log every export; ban forwarding clips to WhatsApp groups.
• [Ops] Set a standard CCTV loop and a process to preserve clips for incidents.
• [Ops] Move gym and salon health, body and photo data into the business system; ban storage on personal phones.
• [Legal] Write a separate consent for gym health questionnaires and another for progress photos.
• [Ops] Instruct kitchens that aggregator data is for the order only; stop any copying.
• [Legal] Add DPDP clauses to processor contracts: security, breach notice, erasure on instruction, one-year logs, sub-processors, audit.
• [Legal] Add data clauses to franchise agreements: roles, no local exports, security, breach notice to the brand, audit rights.
• [Security] Add MFA to the POS back office, loyalty admin, CRM and CCTV cloud apps; one login per person.
• [Eng] Encrypt loyalty and membership data at rest; keep card data with the payment provider.
• [Eng] Keep access logs for at least one year.
• [Eng] Build retention jobs for bills, reservations, feedback, gym health data and CCTV.
• [Product] Publish the privacy page: contact person, request channels, identifier needed, grievance timeline.
• [CX] Set up the rights and grievance workflow with OTP verification, owners and deadlines, including CCTV requests.
• [Marketing] Send the section 5(2) notice to existing loyalty members with a link to manage choices.
• [Marketing] For children, use a parent’s account and verifiable parental consent; no targeted offers or tracking directed at children.
• [HR] Train store, kitchen, salon and gym staff on the new counter script and what not to forward.

Phase 3: operate (ongoing)

• [DPO] Review new campaigns, loyalty partners, vendors and in-store technology before launch.
• [Ops] Audit a sample of outlets every quarter: signage, CCTV access, POS script, phones with customer data.
• [Marketing] Reconcile campaign lists against consent records every month.
• [Security] Run a penetration test on the loyalty app, POS back office and Wi-Fi portal every year.
• [Security] Run a breach drill every year (for example, a leaked loyalty export) against the 72-hour clock.
• [CX] Review rights and grievance timelines every month; investigate overdue cases.
• [Legal] Review processor and franchise contracts and renewal dates every quarter.
• [Ops] Wipe DVR disks, POS terminals and tablets before disposal or return.
• [DPO] Keep evidence: consent records, withdrawal handling, erasure confirmations, training records.
• [HR] Remove access for staff and trainers on their last day, including WhatsApp groups and cloud camera apps.

Where myconsentapp comes in

You need to	With myconsentapp	You still own
Ask for loyalty and offers consent at the counter	A QR code on the counter or receipt opens the hosted consent page, with each purpose (points, WhatsApp offers, SMS offers, personalisation, partner sharing) as a separate toggle, off by default.	The counter script.
Capture consent on your own tablet or app	The embeddable widget and SDKs (TypeScript, Python, Java, Go) add the same purposes to your loyalty tablet, app or Wi-Fi portal.	Wiring it into your POS and portal.
Record paper or phone consents	Record consent captured elsewhere (paper forms, phone bookings, counter), marked as not verified by the person.	Keeping the original form.
Prove consent if a customer complains	Every choice is signed and hash-chained against the exact notice version, with a receipt for the customer and an evidence pack for you.
Check consent before a campaign	The verify API returns not permitted immediately after a withdrawal.	Calling it from your campaign tools.
Make franchisees and vendors stop too	Signed webhooks and a processor registry with per-processor webhooks; processors confirm withdrawals and erasures, and erasure stays open until they do. Contract expiry is flagged.	Signing contracts and franchise terms.
Handle gym health data and photos separately	Define them as their own purposes with high sensitivity and short retention days, so the member chooses each one.	Deciding what the gym records.
Offer notices in outlet languages	English and all 22 Eighth Schedule languages, with machine-translation drafts flagged for review, and the rights and Board-complaint block added automatically.	Reviewing translations.
Handle children	An age gate and guardian verification through DigiLocker; tracking and ad purposes can never be marked child-safe.	Deciding where children take part.
Handle requests and breaches	A rights inbox with SLA timers and nomination, and a breach register with the 72-hour clock, Rule 7 notices and Board documents.	Answers and investigation.

Not included: myconsentapp does not manage your CCTV, scan your POS or tag your website cookies, and it is not a security programme. Your CCTV retention, device security and access control stay with you.

Common mistakes

• Refusing to bill a customer who will not share a phone number.
• One loyalty form that covers points, offers, profiling and co-brand sharing together.
• Staff incentives for “numbers captured”.
• CCTV clips forwarded to WhatsApp groups, or cameras near trial rooms.
• Trainers keeping members’ progress photos and body measurements on personal phones.
• Copying aggregator customers into your own SMS list.
• Wi-Fi portals that track devices around the store without telling anyone.
• Franchise agreements that say nothing about customer data.

Frequently asked questions

Can we ask every customer for their mobile number at billing? You can ask, but you should not require it. An e-bill sent to a number the customer chose to give rests on section 7(a), the same as the Act’s pharmacy example. Using that number for promotions needs separate consent, and refusing the bill without a number makes any consent conditional, which section 6(1) does not allow.

Do we need consent for CCTV? Asking every shopper for consent is not workable. Security CCTV is commonly justified under section 17(1)(c), the prevention and detection of offences, which still requires reasonable security safeguards (section 8(5)). That reading is not settled. Put up signage, keep footage briefly and do not use it for marketing. Confirm with counsel.

Are loyalty points covered by the three-year erasure rule? The Third Schedule applies only to e-commerce entities with 2 crore or more registered users and certain large intermediaries. Even where it applies, data needed to access virtual tokens such as points is excluded. For most chains, follow your programme terms and section 8(7).

Is gym body-composition data “sensitive personal data” under DPDP? The DPDP Act does not have a separate category of sensitive data. It is still health-related and intimate, and a leak would do real harm. Collect it with its own consent, restrict access, and delete it when the member leaves.

Can our franchisee run its own WhatsApp offers to our loyalty members? Only if the members consented to that, and your franchise agreement says who is the fiduciary for those messages. Otherwise the franchisee is using your data for its own purpose without a ground.

A customer asks for the CCTV clip of their visit. Do we have to give it? Not necessarily. Section 11 gives a summary of personal data, not a copy of footage, and if you rely on section 17(1)(c) for security CCTV, Chapter III rights do not apply to that processing. Many businesses still help as good practice. If you share a clip, blur or crop out other people. If the clip is under a legal hold or police request, tell them you are keeping it and why.

Do we need a Data Protection Officer? Only Significant Data Fiduciaries must appoint one, and stores and restaurants are unlikely to be notified. Every fiduciary must publish a contact person who can answer questions (section 8(9), rule 9). Large chains often name a DPO anyway.