At a glanceA business can only ask you for the personal data it genuinely needs for a specific, stated purpose — and nothing more. Under India’s DPDP Act, collection is tied to purpose and your consent must be unconditional, so a business can’t force you to hand over unrelated details (like your Aadhaar for a loyalty card) as the price of a service. If you’re being asked for more than the task requires, you can refuse the extras.
Educational resource only. This explains your rights around over-collection of personal data under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.
The rule: only what the purpose needs
A business may collect only the personal data necessary for the specific purpose it told you about — that principle is called data minimisation.
Under the DPDP Act, a business has to give you a clear notice of why it’s collecting your data (Section 5), and your consent is limited to the data that stated purpose actually needs (Section 6). Put together, that means collection is purpose-bound: the reason justifies the data, not the other way round. A delivery needs an address; it doesn’t need your date of birth. A one-time OTP needs a phone number; it doesn’t need your Aadhaar.
So the honest test when someone asks for a detail is simple: does the thing they’re doing for me actually require this? If not, they’re over-collecting.
What that looks like in everyday situations
Most over-collection happens in routine, in-person moments — and once you see the pattern, it’s easy to spot.
A few common situations, each of which has its own detailed guide in this section:
- Shops and loyalty programmes asking for Aadhaar or full date of birth to issue a points card.
- Gyms, housing societies and clubs demanding ID copies — Aadhaar, PAN, passport, driving licence or Voter ID — or gate apps logging far more than needed.
- Couriers photographing your ID on delivery, or hotels taking a full copy of your passport at check-in.
- Car showrooms or salespeople refusing to help unless you give a phone number.
- Diagnostic labs insisting on your real number for a blood test (often for marketing).
In each case the question is the same — is this detail needed for this transaction? Often it isn’t; it’s collected out of habit, for marketing, or “for records.” That habit is exactly what the DPDP Act’s purpose-and-minimisation rules push back on. (Each scenario above is covered in its own piece — see the related guides.)
Can you refuse? Yes — here’s why
Your consent has to be free and unconditional, so a business generally can’t make an unrelated data demand a condition of service.
The DPDP Act says consent must be free, specific, informed, unconditional and unambiguous. “Unconditional” is the load-bearing word here: a service can require the data it genuinely needs to serve you, but it can’t bundle in unrelated collection as a take-it-or-leave-it condition. A bookshop can take your address to ship a book; it can’t refuse the sale unless you also hand over your Aadhaar for its marketing list.
That doesn’t mean every request is refusable — where a detail is truly necessary (your PAN for a genuine tax-reportable transaction, KYC where the law requires it), you do have to provide it. The line is necessity for the stated purpose, not your preference or theirs.
What to do when a business over-asks
Ask why, give the minimum, and escalate if they make an unnecessary detail a condition.
- Ask the purpose. “Why do you need this, and what will you use it for?” A business should be able to answer plainly; a vague answer is a flag.
- Offer the minimum. Give what the task needs and decline the extras — or offer a masked/alternative (a masked Aadhaar, a secondary email) where an ID is genuinely required.
- Don’t be pressured by “policy.” An internal policy doesn’t override the law’s purpose-and-consent rules.
- Escalate if needed. If a business withholds a service purely because you won’t hand over unrelated data, raise it with their grievance contact, and you can complain to the Data Protection Board of India.
FAQ
Can a shop refuse me service if I don’t give my phone number?
Not if the number isn’t genuinely needed for the service. Consent must be unconditional, so unrelated data can’t be made a condition of a basic sale.
Is a business allowed to ask for my Aadhaar for anything?
Only where it’s genuinely necessary (for example, a legally mandated KYC). For a loyalty card or casual verification, demanding Aadhaar is usually over-collection — and you can offer a masked Aadhaar even where some ID is needed.
They say it’s “company policy” to collect it. Does that override my rights?
No. An internal policy doesn’t override the DPDP Act’s requirement that collection be limited to what the stated purpose needs.
What counts as “necessary” data?
Data the specific task genuinely requires — an address to deliver, a number to send an OTP. If the service works without a detail, that detail isn’t necessary.