DPDP guide
DPDP Consent Notice for a Retail Store: Template for Recording Customer Conversations
A DPDP consent notice for a retail store is the written notice and consent wording a retailer uses, under India's Digital Personal Data Protection Act 2023, to tell customers that conversations may be recorded, for what purpose, for how long, and how to withdraw. Below is a template for each surface: the entrance sign, the desk card, the advisor's spoken line, the consent page and the withdrawal notice, followed by what the Act expects you to be able to show.
What the Act requires of the notice
The DPDP Act makes the retailer the Data Fiduciary. Before or at the time of seeking consent, the fiduciary must give notice of the personal data being collected and the purpose, how the customer can exercise their rights and withdraw consent, and how to complain to the Data Protection Board. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the stated purpose. The Retailers Association of India's guidance for members says the same in retail terms.
Template 1: entrance notice (signage)
Conversations with our advisors in this store may be recorded, with your consent, for quality, training and follow-up. Recordings are transcribed and the audio is deleted. You can decline, and you can withdraw consent at any time. Details and contact: [store name], [privacy email], [phone].
Template 2: desk card (at each counter)
We may record this conversation to serve you better and to train our team. We will ask for your consent first. Say no at any time and nothing will be recorded. Your details are used only to follow up on this enquiry and are kept for [retention period]. Scan to read the full notice.
Template 3: the advisor's disclosure line
Hindi: "Aapki zaroorat sahi se samajhne ke liye, kya main apna digital assistant use kar sakta hoon? Aap apne phone par dekh kar accept kar sakte hain, ya bas haan boliye aur screen par likha code padh dijiye."
To help me capture your requirements accurately without taking notes while we talk, may I use our digital conversation assistant? You can review and accept on your phone, or just say yes and read the code on my screen.
Template 4: consent page (QR or WhatsApp link)
[Retailer] would like to record and transcribe this conversation to understand your requirements, improve our service and follow up on your enquiry. The audio is deleted after transcription. Your name and phone number, if you share them, are used only for follow-up and kept for [retention period]. You can withdraw consent by [method]. Questions and complaints: [privacy email]. You may also approach the Data Protection Board of India. [Accept and start] [Decline]
Template 5: withdrawal and erasure wording
To withdraw consent or ask us to delete your details, message [number] or email [privacy email] with the date and store. We will confirm within [n] working days.
What to keep as a record
- Per conversation: consent method (QR, link, spoken code), time, the notice version shown, and the advisor's disclosure line as part of the transcript.
- Audio deletion timestamp per conversation.
- Transcript retention period and the deletion job that enforces it.
- The withdrawal log: requests received and actions taken.
- The data processing agreement with the software vendor, which acts as Data Processor on your instructions.
Generate your own
The free DPDP consent notice generator at /tools/dpdp-consent-notice-generator/ fills these templates with your store name, purposes, retention period and contact, in English and Hindi, and gives you a printable sign, a desk card and a consent page text in one go. It is not legal advice; have your counsel confirm the wording for your case.
Frequently asked questions
Is signage alone enough consent under DPDP?
Signage is notice, not consent. The Act asks for a clear affirmative action for the stated purpose. A tap on the customer's own phone or a spoken confirmation recorded at the start of the conversation is that action; walking past a sign is not.
What if the customer is under 18?
Consent must come from the parent or guardian. In education counselling and similar settings the parent present is who consents; a minor alone is not recorded.
Do we have to keep the audio?
No, and it is safer not to. Delete after transcription, timestamp the deletion, and keep only the transcript for the agreed window.
Is this legal advice?
No. It is a working template based on the Act and published retail guidance. Confirm the wording with your counsel.
Related reading
- Free DPDP consent notice generator
- Is recording customers legal in an Indian store?
- Capture in-store conversations: consent first
Where Borentis applies this
- Compliance & Consent: Proof of what was said at the counter.
- Walk-in Recovery: The customer who left is still yours.
Borentis is the Agentic Operating System for Customer Interactions, built for Indian retail floors: consented one-tap capture on the advisor's phone, every conversation scored against your playbook with the evidence behind every number, leads created when a number is heard, and coaching from your own best conversations.