GDPR and Your Customer Phone Numbers: What UK Businesses Need to Know

A customer's phone number is personal data under UK GDPR and the EU equivalent, the same as their name or email address. Using it to send a review request is generally fine, but it still needs to be handled the same way any other personal data does.

Why phone numbers count as personal data

UK GDPR defines personal data broadly: any information that can identify a living person, directly or indirectly. A phone number tied to a named customer clearly qualifies, which means collecting, storing, and using it falls under the same rules that apply to any other customer record, not a separate, lighter set of rules just because it is “only a phone number.”

Your lawful basis for using them

For most review request use cases, the relevant lawful basis is legitimate interest: you collected the number to provide a service, and following up to ask how that service went is a reasonable, expected continuation of that relationship, not a separate marketing activity requiring fresh consent. This is different from using the same number for unrelated promotional messages later, which would need its own basis and, in the UK, separate consent under PECR rules covering direct electronic marketing.

What you actually need to tell customers

Transparency is the core requirement: customers need to know, in plain terms, what their phone number will be used for. A privacy policy covering review requests, available somewhere accessible rather than buried, satisfies this. You do not need a separate signature or tick box for every single review request, but customers should never be surprised that you have their number or what it is being used for.

How long you can keep them

UK GDPR does not set a fixed retention period, it requires that you keep personal data no longer than necessary for the purpose it was collected for. For review request purposes, that generally means contact data tied to active or recent customers, with a sensible deletion policy for records that go stale, rather than an indefinite archive of every phone number a business has ever collected. Many businesses align this with their general customer record retention period rather than treating review related data differently.

What happens if a customer asks you to delete their data

Customers have a right to request deletion of their personal data under UK GDPR, sometimes called the right to be forgotten, and a request covering their phone number specifically needs to be honoured within the statutory timeframe, generally one month. In practice this means removing their contact record from your system entirely, not just unsubscribing them from future requests while keeping the underlying data on file.

If you have customers across multiple countries

Businesses with customers in different countries do not get to pick one set of rules and apply it everywhere. A UK business with EU customers needs to consider both UK GDPR and the EU GDPR for those specific contacts, and a business sending review requests to US customers needs to separately consider US rules like the TCPA, which work differently again. The safest practical approach is applying the strictest applicable standard across the board rather than trying to maintain different rules for different customers, which gets complicated fast and is easy to get wrong.

A practical checklist for review request systems

• Only collect phone numbers in the course of an actual transaction or service, not from unrelated sources.
• Make your privacy policy easy to find and clear about what the number is used for.
• Set a retention period and actually delete contact data once it is stale, rather than keeping everything forever by default.
• Have a process ready for deletion requests, so they can be actioned quickly rather than improvised each time one arrives.
• Keep review request messages tied to the actual service provided, rather than drifting into unrelated marketing content under the same justification.

This is general guidance, not legal advice. Data protection rules vary by country and are enforced differently in different regions, so for anything beyond the basics it is worth a conversation with someone who specialises in data protection law for your specific market.