DPDP & Compliance

Handling Customer KYC, PAN & Phone Numbers Legally Under India’s New Privacy Laws

Indian jewellers and luxury merchants operate under dual regulatory pressure: Prevention of Money Laundering Act (PMLA) rules require verifying PAN cards for transactions exceeding ₹2 Lakhs, while the DPDP Act 2023 mandates strict privacy safeguards on that exact same data.

2026-09-20·6 min read·By Aman Kumar Singh

Key Takeaways

Rule 114B of Income Tax requires PAN collection for jewellery purchases over ₹2 Lakhs.
DPDP Act requires that collected PAN records be stored with reasonable security safeguards.
Unsecured photo albums of customer PAN/Aadhaar cards on counter phones violate the law.
Vowerole provides encrypted KYC vaults with restricted staff access and purpose-tagged consent.

1. The Legal Conflict: PMLA Compliance vs DPDP Privacy

Jewellers frequently handle high-value transactions subject to strict statutory requirements. Under Rule 114B of the Income Tax Rules and PMLA guidelines, collecting customer PAN numbers for transactions exceeding ₹2,00,000 (Two Lakh Rupees) is mandatory. However, under the DPDP Act 2023, a customer’s PAN and Aadhaar are high-sensitivity personal data identifiers. If a shop collects PAN cards and allows staff to store photo copies casually in personal WhatsApp chats or unencrypted desktop folders, the business faces up to ₹250 Crores in DPDP penalty exposure.

2. Three Dangerous Practices That Must Stop Immediately

Retailers should immediately eliminate these widespread informal habits:

WhatsApp Photo Sharing: Sales staff asking customers to WhatsApp their PAN card photo to the salesman’s personal smartphone.
Unprotected Counter Spreadsheets: Maintaining an Excel sheet called "High_Value_Clients_PAN.xlsx" on a shared counter desktop.
Unrestricted Access: Allowing junior counter trainees or cleaning staff to view KYC files of prominent local citizens and business owners.

3. The Compliant Approach: Encrypted Central KYC Vault

In Vowerole, customer KYC data is stored in an encrypted central vault. Sales staff enter the PAN number or upload documents directly into the verified customer profile. Once submitted:

Access Masking: Personal identifiers are masked so counter staff only see verification status without exposed plaintext data.
Explicit Purpose Binding: The document is tagged strictly for statutory tax verification under Rule 114B.
Zero Personal Phone Leakage: No customer documents ever touch personal staff devices or chat applications.
Instant Audit Tracking: Any administrative retrieval of a customer KYC record is logged with timestamp, user ID, and IP address.

4. Summary: Protect Both Your Compliance and Your Reputation

High-net-worth clients entrust jewellers with significant purchases and sensitive personal identity records. Demonstrating world-class privacy and DPDP compliance is not merely avoiding fines—it is a powerful competitive advantage that builds generational customer trust.

Frequently Asked Questions

Can a customer demand that we delete their PAN card under DPDP "Right to Erasure"?→

No. The DPDP Act provides explicit exemptions where personal data processing is necessary for compliance with any law for the time being in force (such as PMLA and Income Tax statutory mandates). Vowerole retains mandatory tax records while anonymizing non-statutory marketing fields.

Is taking a photocopy of customer Aadhaar cards permitted?→

Retailers should avoid collecting physical Aadhaar photocopies unless specifically mandated. Where Aadhaar is accepted, UIDAI guidelines require masking the first 8 digits. Vowerole supports masked identity record storage.

Back to all guides Read DPDP compliance architecture

Ready to modernise your retail operations?

Join retailers and jewellers across India who trust Vowerole for secure, DPDP-ready ERP and billing.

Book a demo Pricing Contact