Keeping shop customer data: consent, access, and deletion

Guides · 2026-10-02 · 6 min read

A customer’s phone number for points or kasbon is personal data. What Indonesia’s PDP Law and similar laws in Southeast Asia ask for, in everyday language.

Even a phone number is personal data

A shop that registers customers for member points or kasbon stores their name and phone number. In Indonesia, such data is protected by Law Number 27 of 2022 on Personal Data Protection. Neighbouring countries have similar rules: the PDPA in Malaysia, Singapore, Thailand, and Taiwan, the Data Privacy Act in the Philippines, and Vietnam’s personal data protection law, in force since 1 January 2026.

The core is similar: ask for consent, keep only what is needed, protect access, and give customers a way to ask for their data to be deleted.

Ask for consent, and record it

In Lamxo, a customer can only be registered after their consent is recorded: when, by which cashier, and with which version of the consent text, in the outlet’s language. Without consent, customer data cannot be saved. The data kept is also limited: name, phone number, email if any, purchase history, points, and kasbon.

Not every cashier needs to see every customer. Access to the customer list is controlled by a separate permission, and every export or deletion of customer data is recorded in the audit log.

When a customer asks for their data to be deleted

You can export one customer’s data and delete it. Deleting means the name, phone number, and email are blanked, while sales records remain because tax and money records must be kept. If the customer still has unpaid kasbon, the deletion is declined with a clear reason until the kasbon is settled.

If there is a breach

Indonesia’s PDP Law asks for notice to the data owners and the authority no later than 3×24 hours after a breach is discovered; some other countries use a 72-hour limit. In this relationship, you as the shop are the data controller, and Izaaja as the app provider is the data processor. We will tell you as quickly as possible so that you have time to meet that deadline.

The limits

This article is a general summary, not legal advice. We have not confirmed the breach notification deadlines in Malaysia, Vietnam, the Philippines, and Taiwan from their official texts, so we do not state them here.