Reservations and waitlists
Name, contact details, party size, booking time and requests may be collected directly or through a platform. Explain why details are needed and set a sensible review period for abandoned enquiries.
For restaurants, cafés, cloud kitchens and food-service teams
DPDP compliance for restaurants and cafés
A customer may reserve a table on your site, order through a delivery platform, join a loyalty list or appear in your CCTV footage. Each flow has a different purpose and may involve different teams and providers. A useful DPDP preparation plan makes those flows visible and puts clear handling rules around them.
- Reservations & orders
- Map the journey
- Offers & loyalty
- Separate purposes
- Phased commencement
- 13 May 2027*
*Several core provisions are scheduled to commence on this date under the notification.
Where restaurant data is collected
Build an inventory around real systems and business purposes. These examples are prompts, not a determination of the legal basis for your processing.
Orders and delivery
Online ordering, delivery partners and point-of-sale tools can create separate records. Identify which party controls each purpose, what is shared, and how support or refund cases are handled.
Loyalty and promotions
Points, birthdays, preferences and mailing lists can extend beyond a single meal. Keep optional programme enrollment and promotional communications clear, and record the relevant choices.
CCTV and premises security
Video that identifies people may be personal data. Define the security purpose, limit who can view or export footage, establish a retention approach, and document how disclosure requests are handled.
Employees and applicants
Rosters, payroll, recruitment and emergency contact records involve staff data. Keep access limited by role and coordinate privacy processes with employment and other record-keeping requirements.
Vendors and shared devices
Reservation tools, POS terminals, cloud dashboards, delivery integrations and shared staff devices can affect access and security. List providers, accounts and data flows; remove access when roles change.
A workable preparation plan for a busy service
Keep processes understandable for managers, front-of-house staff and kitchen operations.
Trace each collection point
Review booking forms, QR menus, POS, delivery channels, loyalty signup, CCTV and hiring workflows.
Separate purposes
Distinguish fulfilling an order, handling a complaint, maintaining required records and sending optional promotions. Assess the applicable basis for each.
Make notices accessible
Use concise language in digital flows and appropriate on-premises notices. Tell people what the information is used for and how they can reach you.
Control access
Review manager accounts, vendor permissions, exports and shared devices. Set a process for staff changes and lost devices.
Set retention and response owners
Define how records are reviewed and deleted while observing applicable obligations. Assign who handles requests, grievances and security incidents.
Practice incident escalation
Tell staff how to report a misdirected receipt, exposed customer list, lost device or unusual account access quickly to a named owner.
A note on the DPDP Act timeline
The Act and Rules commence in phases. The notification schedules sections 3–5, sections 6(1)–(8) and 6(10), sections 7–17 and connected provisions eighteen months after publication in the Gazette, on 13 May 2027. Other provisions have different dates, so check official notifications for the current position.
The Act is not limited to large companies by a general turnover threshold. Applicability turns on the Act's scope and the organisation's processing of digital personal data; a small-business label alone does not establish an exemption. The Act provides for consent and specified legitimate uses. Identify a basis per purpose rather than treating every reservation or transaction as consent-based.
For an overview, see the DPDP Act summary and compliance checklist. Consult the official DPDP Act text, DPDP Rules, 2025 and commencement notification.
This page is general information, not legal advice. Other laws and applicable sector requirements may also govern particular records or activities.
Questions restaurant teams ask
Start with your own booking, ordering and workforce setup.
Does the DPDP Act apply to a small restaurant?
There is no general exemption based solely on business size. Assess whether your digital personal data processing is within the Act's scope and whether a specific exemption applies.
Can we use a reservation number for promotional messages?
A reservation purpose does not automatically cover unrelated promotions. Assess the basis for marketing separately and make optional choices clear where consent is used.
Is CCTV footage personal data?
Footage that identifies or can identify a person may be personal data. Map why it is collected, who can access it, how long it is retained and how disclosures are handled, alongside any other applicable requirements.
Do delivery platforms handle all our privacy obligations?
Do not assume that an integration transfers every responsibility. Map which entity determines each purpose, what information is shared and what your agreements and the law require.
When should we prepare?
Use the phased commencement period to map systems, clarify purposes and train teams. Sections 3–5, sections 6(1)–(8) and 6(10), sections 7–17 and several connected provisions are scheduled eighteen months after the November 2025 Gazette publication, on 13 May 2027, subject to any later official change.
Build a clear data routine around every service
Use a readiness review to identify the first practical steps for your restaurant or café.