Data Protection for Restaurant Customer Data

A takeaway needs customer information to accept, prepare, deliver and support orders. Data protection is not a reason to avoid useful systems, but it does require the business to define each purpose, collect only what is needed, explain the use clearly and keep control when suppliers change.

Map purposes before fields

Identify the business and supplier roles

The restaurant will commonly decide why customer information is used and is therefore likely to be a controller for core ordering, support and marketing activities. Ordering platforms, email providers and hosting companies may act as processors for some services, but labels in a sales contract are not enough. Record who decides the purposes, who can use data for its own purposes, where information is hosted, which subprocessors are involved and what happens when the contract ends.

Provide useful privacy information

Customers should be told, in clear language, what information is collected, why it is used, the lawful basis relied on, who receives it, how long it is kept, whether it leaves the UK, and how people can exercise their rights. Put a concise notice at the relevant collection point and link to the fuller privacy notice. Do not hide a new marketing purpose inside general terms for placing an order.

Apply minimisation and controlled access

• Do not retain full card numbers, security codes or screenshots of payment details.
• Use structured delivery instructions and remove sensitive free-text notes when no longer needed.
• Give kitchen, driver, customer-support and administrator roles only the information required for their work.
• Use unique accounts, multi-factor authentication and prompt staff offboarding.
• Review exports, shared spreadsheets and personal devices, not only the main ordering system.
• Record and approve any new use of customer data before enabling it.

Set retention by record type

There is no single retention period for every customer record. Tax and accounting records, payment evidence, complaints, marketing permissions and delivery instructions have different purposes. Create a schedule that states the owner, purpose, trigger and deletion method for each category. Preserve a minimal suppression record after a marketing opt-out so the person is not accidentally re-added.

Handle rights and complaints operationally

Give staff a route for access, correction, deletion, objection and restriction requests. Verify identity proportionately and search all relevant systems, including suppliers and archived exports. Keep a register of requests, deadlines and outcomes. A customer complaint about data use should not disappear into the ordinary food-order support queue.

Prepare for incidents and supplier exit

1. Contain the incident and preserve evidence.
2. Identify systems, people, data fields and time period affected.
3. Assess risk to individuals and document the decision.
4. Use the current ICO process where notification is required.
5. Communicate accurately; do not speculate.
6. Correct access, process or supplier failures.
7. Test export, deletion and account transfer before ending a supplier contract.

Practical next step

Create a one-page data map for the order journey. For every field, record the purpose, system, access roles, retention rule, supplier and export method. Remove any field that has no current owner or defensible purpose.

Related guides

• Business Planning and Finance — the main guide for the wider topic.
• Regulatory and Compliance — the broader guide that frames this implementation.
• Food Labelling for Online Orders — a closely related operational control to review alongside this page.
• Employment Law for Delivery Drivers — a closely related operational control to review alongside this page.

Sources and date checked

Guidance checked: 24 July 2026. Recheck official guidance, local requirements and supplier documentation before changing a live operation.

• ICO: getting started with data protection
• ICO: privacy information requirements
• ICO: data protection by design and by default