DPDP for jewellers

KYC you must keep, and data you only want to keep

Some records are required by other laws. Income-tax rules require a customer’s PAN for jewellery purchases above a set value. Dealers in precious metals and stones also have record-keeping duties under anti-money-laundering law for cash transactions above a threshold. Confirm the current thresholds and periods with your chartered accountant. Under legal review: The PAN threshold under the income-tax rules now in force, and the PMLA cash-transaction threshold and record-keeping period for dealers in precious metals and stones, should be confirmed.

Records kept under those laws should be kept for the period those laws require, protected, and used for nothing else. They are not a marketing list.

Occasion dates, family details and purchase preferences are different. They are collected for offers and service, and need the customer’s consent for that purpose (s. 6). A customer who gives a PAN for a bill has not agreed to birthday messages.

Required by other laws

PAN on bills above the threshold; records of cash transactions above the anti-money-laundering threshold.

Needs consent

Birthdays, anniversaries, family occasions, festival offers, photographs used in marketing.

The three roles, in a worked case

The Act gives three roles. The Data Principal is the person the data is about. The Data Fiduciary decides why and how it is used, and carries the duties. A Data Processor handles it on the fiduciary’s behalf, under a contract. The same business can be a fiduciary for some data and a processor for other data.

The case

Sunita buys a necklace above the PAN threshold, joins an 11-month gold savings scheme, agrees to anniversary offers, and leaves a ring for repair. The jeweller uses billing software, a scheme management app and a WhatsApp messaging service.

The tax authorities that receive reports are not your processors. They receive data because the law requires it. A jeweller without a scheme or offers list would hold only the bill and the repair slip.

What a jeweller holds, and where it goes

Where it comes in

Each is a point where consent may be asked for; where it is, a notice must come with it or before it (s. 5).

• Billing counter and invoice software
• Savings and instalment scheme enrolment (where offered)
• Loyalty and occasion registration (where offered)
• Repair, custom-order and old-gold desks
• Website, app and video-call sales (where offered)
• Karigar and staff onboarding, and CCTV

Where it goes

Where jewellers are most exposed

Severity follows the same rules as the assessment; your own result sets it from your answers. How severity is set.

Who else handles the data

You answer for what your processors do with the data (s. 8(1)), and you need a valid contract with each (s. 8(2)). Some vendors are fiduciaries in their own right; the table says where that is common.

40 controls written for jewellers, on top of 66 common ones

Alongside the common controls, the jewellery assessment asks when identity documents are collected and how long they are kept, then about custom orders, deliveries of valuables, high-value customers and karigar records. It asks early on whether you have CCTV, send offers or keep occasion dates, take repairs, run a savings scheme, buy old gold, or sell online or by video call; for anything you do not do, the questions about it are not asked and do not count.

Each control is weighted by how critical it is and tied to the section of the Act or rule behind it. How results work.

Six of the questions you will be asked

Questions ask what you actually do, not whether you have a policy. Each answer maps to one control.

1. JEW-10 High

   Do you collect PAN, Aadhaar or other ID only for transactions where tax or anti-money-laundering rules require it, rather than copying ID for every sale?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Only where the rules require it.

   Why it is asked: Consent covers only necessary data. Tax and anti-money-laundering rules decide when ID is needed; collecting it for every sale goes beyond that.

2. JEW-01 Critical

   Are PAN and KYC copies for high-value sales kept securely, with access limited, for the period tax and anti-money-laundering rules require and then deleted?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Secured and deleted on schedule.

   Why it is asked: Identity documents are what fraudsters want most; keeping them is justified only for the period the law sets.

3. JEW-02 High

   Do you send birthday, anniversary and festival offers only to customers who agreed to receive them?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Only with consent.

   Why it is asked: A number given for billing was given for that purpose. Offers need consent.

4. JEW-03 High

   When customers join a gold savings or instalment scheme, are they told how their data is used, and are scheme records kept securely?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Both are in place.

   Why it is asked: Scheme records combine identity, payments and nominees over many months.

5. JEW-07 Medium

   Are repair and custody records, which link customers to valuables in your care, protected from casual access?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Restricted to named staff.

   Why it is asked: These records show who owns what valuables and when they will be collected.

6. JEW-21 High

   Are details of high-value customers and large purchases restricted to senior staff, kept out of general registers and never discussed outside the store?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Restricted, with staff briefed.

   Why it is asked: The Act has no special category for this data, but reasonable safeguards match the harm a leak could cause; a leaked large purchase can lead to theft or extortion.

All 40 questions written for jewellers

1. JEW-08 Have you agreed in writing with labs, valuers, couriers, outside karigars and franchise or brand partners who decides how customer data is used, and that they act only for you where that is the arrangement? Organisation and role mapping
2. JEW-09 Have you identified every group whose data you hold: customers, gift recipients, scheme members and their nominees, people measured for orders, karigars and staff, and visitors on CCTV? Organisation and role mapping
3. JEW-10 Do you collect PAN, Aadhaar or other ID only for transactions where tax or anti-money-laundering rules require it, rather than copying ID for every sale? Data inventory and purpose
4. JEW-11 Do you know where old customer data sits: old billing software, order and measurement books, salespeople's diaries and phones? Data inventory and purpose
5. JEW-12 At billing or when taking an order, are customers told what details you keep and why, including loyalty, occasion reminders and offers? Notice and transparency
6. JEW-04 Is there a CCTV notice at the showroom entrance, is footage of the counters and strongroom viewable only by named people, and is it overwritten after a set period unless kept for an incident or an insurance claim? Notice and transparency
7. JEW-03 When customers join a gold savings or instalment scheme, are they told how their data is used, and are scheme records kept securely? Notice and transparency
8. JEW-37 After a scheme matures or closes, are the member's payment details, ID copies and nominee details deleted once the required period ends? Retention and deletion
9. JEW-02 Do you send birthday, anniversary and festival offers only to customers who agreed to receive them? Consent and lawful basis
10. JEW-13 Are photographs or videos of customers wearing your jewellery, including bridal shoots, used on social media or in catalogues only with their consent? Consent and lawful basis
11. JEW-14 Are customers' measurements, design preferences and photographs taken for custom orders used only for their orders, and not for marketing or catalogues? Consent and lawful basis
12. JEW-39 Does virtual try-on use the customer's face or hand images only for the try-on, without storing them or using them for anything else unless the customer agrees? Consent and lawful basis
13. JEW-40 Are video-call consultations recorded only when the customer agrees, and are recordings deleted after the order is complete? Consent and lawful basis
14. JEW-15 Can customers get their purchase history and correct or delete their profile, with identity checked so that history is never given to a spouse or relative without authority? Data Principal rights
15. JEW-16 Before valuation reports, buy-back or exchange decisions, are the customer's details and the item's records checked, with a way to correct errors? Data quality
16. JEW-17 Are customer details sent to labs, valuers, insurers and couriers checked, with corrections passed on? Data quality
17. JEW-06 Are karigars', artisans' and staff members' personal details and ID copies kept securely and only as long as needed? Retention and deletion
18. JEW-18 Do you have a rule for deleting customer profiles, preferences and contact details after a period of inactivity, keeping only invoices that tax law requires? Retention and deletion
19. JEW-19 Are billing computers, POS terminals, tablets and CCTV recorders wiped before disposal, return or repair? Retention and deletion
20. JEW-01 Are PAN and KYC copies for high-value sales kept securely, with access limited, for the period tax and anti-money-laundering rules require and then deleted? Security safeguards
21. JEW-20 Is your billing or CRM database encrypted, with customer lists exportable only by named people? Security safeguards
22. JEW-21 Are details of high-value customers and large purchases restricted to senior staff, kept out of general registers and never discussed outside the store? Security safeguards
23. JEW-22 For deliveries and pick-ups of valuables, are the customer's address and timing given only to the assigned courier or staff member, at the last practical moment? Security safeguards
24. JEW-38 Are identity and declaration records of people selling or exchanging old gold kept securely and only for the period applicable rules require? Security safeguards
25. JEW-23 If customer purchase details are leaked, such as by staff to outsiders or through a lost register, is it logged and notified to the Board and the customer? Breach response
26. JEW-05 Are your billing, hallmarking and scheme software providers bound by written data terms? Processors and vendors
27. JEW-24 Do provider contracts require immediate breach notice and the return and deletion of customer data when you change provider? Processors and vendors
28. JEW-25 Before a marketing agency, catalogue app or messaging tool gets customer data, do you check how it protects data and who will access it? Processors and vendors
29. JEW-26 Is customer data shared with brands, banks, insurers or other businesses for their own use only with consent and stated in your notice? Data sharing and disclosure
30. JEW-27 Do you record which outside parties received customer data, so you can tell a customer who received theirs? Data sharing and disclosure
31. JEW-28 Are requests for customer data from tax authorities, police and enforcement agencies checked by a named person, limited to what is required and logged? Data sharing and disclosure
32. JEW-29 Do you know where your billing, CRM, scheme and messaging tools store customer data? Transfer and storage location
33. JEW-30 Where customer data goes outside India (overseas tools, international brand partners), have the countries been checked against any government restriction? Transfer and storage location
34. JEW-31 Do you keep a record of offer and publicity consents, and of why ID was collected for each sale where it was? Records and evidence
35. JEW-07 Are repair and custody records, which link customers to valuables in your care, protected from casual access? Access control
36. JEW-32 In your billing and CRM systems, can sales staff see only their own customers and current orders, without exporting the customer list? Access control
37. JEW-33 When sales staff leave, is their system access removed and are customer contacts on store phones or messaging accounts handed back? Access control
38. JEW-34 Is two-step sign-in required for billing administration, CRM and business email? Access control
39. JEW-35 Do you review who has access to billing, CRM and CCTV at least twice a year? Incident testing
40. JEW-36 Is there a written policy covering customer contacts on personal phones, photographing customers and their purchases, and discretion about who bought what? Policy and training

Evidence that may be asked for

A “yes” is self-declared until something shows it. These are the documents and records that usually do. Your own result lists what each control needs.

• KYC storage location, access list and retention period
• Note of when ID is collected, matched to the tax and anti-money-laundering rules
• Occasion and offer consent wording, with a sample record
  Where applicable: you send offers
• Scheme enrolment form with the notice
  Where applicable: you run a scheme
• Data terms with billing, scheme and messaging providers
• CCTV signage, named viewers and the overwrite period
  Where applicable: you have CCTV
• Rule for deleting staff and karigar records after people leave

What makes evidence good enough · How the Evidence Room keeps it

First actions, in the order they usually make sense

1. Move PAN and KYC copies to locked, access-limited storage

   Now

2. Collect ID only for sales that require it, and record why

   Now

3. Ask for consent before adding occasion dates to the offers list

   Now
   Where applicable: you send offers

4. Add a notice to scheme enrolment forms

   Before 13 May 2027
   Where applicable: you run a scheme

5. Sign data terms with software and messaging providers

   Before 13 May 2027

6. Set retention periods with your accountant and delete what has expired

   Before 13 May 2027

7. Review who can view CCTV and high-value customer records

   Ongoing, twice a year

Your own result orders these by your answers and the law’s dates. How to plan remediation.

The reports a jeweller usually needs

For a jeweller, the result is mostly read by the owner or partners, and by brand or franchise partners who ask how customer data is handled.

Every report states whether the result is Self-Assessed, Evidence-Supported or Expert-Verified. None is a certificate or a statement of compliance. All six reports.