“Fundle AI Agents are not chatbots. They are autonomous strategists — analysing cohorts, picking offers, scheduling sends and reading back ROI without a brief.”
- •Understand how DPDP 2023 fundamentally changes how loyalty platforms can collect, store and use customer data in India
- •Identify the seven consent and data-rights obligations every retail loyalty program must now satisfy
- •Benchmark AI-based loyalty platform India capabilities against the new regulatory minimum
- •Implement a five-step DPDP readiness playbook before enforcement begins
- •Discover how Fundle's ConsentFirst CMP is fully DPDP 2023 compliant, protecting data for 270+ brands
India's retail loyalty landscape has run on an implicit social contract for decades: customers hand over their mobile number at the billing counter, brands push SMS blasts, and everyone pretends this constitutes a relationship. That contract is now legally void. The Digital Personal Data Protection Act 2023 — passed by Parliament in August 2023 and expected to be operationalised through Rules in 2024-25 — establishes clear, enforceable rights for every Indian data principal and imposes obligations that touch the heart of how loyalty programs function. For retail marketers managing programs at malls like Phoenix Marketcity or Select CITYWALK, or brand loyalty heads at companies like Tanishq, Lenskart, Manyavar or Apollo Pharmacy, the question is no longer whether to comply but how fast.
The stakes are not abstract. DPDP 2023 empowers the Data Protection Board of India to levy penalties of up to ₹250 crore per instance of significant breach. A loyalty database of even 500,000 members — modest by the standards of a Lifestyle, Pantaloons or Reliance Trends program — represents 500,000 individual consent obligations, each of which must be documented, auditable and reversible on demand. Brands that have historically treated their CRM as a one-way broadcast channel will face the steepest operational retrofit. Those already on an AI-based loyalty platform India retailers trust for structured data governance will find the transition far more manageable.
The compliance challenge is compounded by the AI layer. Modern loyalty platforms do not merely store data; they run recommendation engines, churn-prediction models, next-best-offer algorithms and agentic workflows that continuously recombine customer signals. Each of these processing activities must now be anchored to a lawful basis — and for most retail loyalty contexts, that lawful basis is explicit, granular, freely given consent. Platforms like Capillary, EasyRewardz, Xeno and MoEngage are all navigating this shift. The differentiation will come from platforms that treat consent architecture as a product feature rather than a legal afterthought.
Fundle was built with this reality in mind. The Fundle AI Platform processes first-party loyalty data across mall and brand contexts, and its ConsentFirst Consent Management Platform (CMP) was designed from the ground up to satisfy the consent, purpose-limitation and data-minimisation requirements that DPDP 2023 codifies. This article is a practitioner's guide for retail marketers and loyalty program managers who need to understand the law, audit their current stack and build a compliant engagement engine that still drives revenue.
India Retail Loyalty + DPDP 2023: The Numbers That Matter
Overview of India's DPDP 2023 Data Privacy Law
The Digital Personal Data Protection Act 2023 is India's first comprehensive data privacy statute and it draws heavily from the GDPR framework while being calibrated for the Indian digital economy. At its core, the Act defines a 'data principal' (the individual whose data is processed), a 'data fiduciary' (any entity that determines the purpose and means of processing) and a 'data processor' (any entity that processes data on behalf of a fiduciary). For a mall operator running a loyalty program, the mall entity is the data fiduciary; the loyalty platform vendor — whether Fundle, Capillary or EasyRewardz — is typically the data processor.
The Act mandates eight foundational obligations for data fiduciaries. First, personal data may only be processed for a lawful purpose with the data principal's explicit, informed consent — or under certain specified legitimate uses. Second, consent must be granular: a blanket opt-in at enrollment does not satisfy the requirement. A customer joining the Tanishq CaratLane program must separately consent to purchase history analytics, personalised offers, cross-brand sharing and third-party enrichment — each stated in plain, accessible language in all 22 scheduled languages of India. Third, data principals have the right to withdraw consent at any time, and withdrawal must be as easy as giving consent. Fourth, data fiduciaries must establish a grievance redressal mechanism with a response SLA.
Fifth, the Act imposes strict data-minimisation norms: only data necessary for the stated purpose may be collected. This is a direct challenge to the 'collect everything, figure it out later' philosophy of legacy CRM deployments. Sixth, data must be erased once the purpose for which it was collected is fulfilled — so a loyalty program cannot indefinitely retain the transaction history of a member who has exited. Seventh, significant data fiduciaries (those processing large volumes or sensitive data) face additional obligations including Data Protection Impact Assessments and mandatory Data Protection Officers. Eighth, cross-border data transfers are restricted to countries notified by the Central Government.
For retail loyalty programs, the most operationally disruptive provisions are consent granularity, right to erasure and purpose limitation. A mid-sized mall loyalty program with 1.2 million registered members — which is realistic for a two-property portfolio — must be able to demonstrate, for any given member, exactly what data was collected, under what consent, for what stated purpose, processed by which AI models, and deleted on what date. No spreadsheet or legacy CRM can satisfy this at scale. The answer is a purpose-built, AI-aware compliance layer inside the loyalty platform itself.
DPDP 2023 Compliance Journey for a Retail Loyalty Program
Implications for Loyalty Platforms Using AI
The intersection of AI and DPDP 2023 creates obligations that go beyond standard data governance. When a loyalty platform uses machine learning to predict which Pantaloons customer is likely to churn, or which FabIndia shopper is ready for a lapsed-member reactivation offer, or which Cafe Coffee Day member will respond to a bundled beverages promotion — each of these inferences is derived from personal data. DPDP 2023's purpose-limitation principle means that if a member consented to 'receiving personalised offers,' that consent may not automatically extend to profiling their lifestyle, creditworthiness or health-adjacent behaviour.
Platforms that run agentic AI workflows — automated sequences where an AI agent triggers actions, modifies offers, routes communications and updates member tiers without human review of each decision — face particular scrutiny. The Act does not yet contain explicit 'right to explanation' provisions as strong as GDPR Article 22, but the consent and purpose-limitation framework effectively constrains automated decision-making to consented data fields and stated purposes. A loyalty AI agent that cross-correlates pharmacy purchase data from Apollo Pharmacy with fashion purchase data from Lifestyle to build a health-and-lifestyle segment is processing for an unstated purpose — a direct DPDP violation.
Data processors — the loyalty platform vendors — bear contractual and increasingly statutory responsibility for processing only within the boundaries set by the data fiduciary's consent framework. This means retail brands evaluating platforms like Almonds.ai, Customer Capital, Antavo or Fundle Agentic AI must ask pointed questions: Does the platform maintain field-level consent mapping? Can AI models be configured to exclude non-consented data fields at runtime? Is there a full audit trail of every AI inference action tied to a specific consent record? Does the platform support automated data-erasure workflows triggered by member exit?
The commercial stakes of getting this wrong are significant. Under DPDP 2023, the Data Protection Board can initiate proceedings on a complaint from any data principal — meaning a single aggrieved loyalty member can trigger an investigation. For a brand like Manyavar with a growing omnichannel member base, or a mall operator with 300,000 active members across three properties, the reputational and financial exposure of a single high-profile enforcement action can dwarf the cost of full compliance infrastructure. Forward-thinking loyalty teams are treating DPDP compliance as a trust investment, not a compliance cost.
DPDP-Ready AI Loyalty Platform vs. Legacy CRM: Feature Comparison
How AI Platforms Ensure User Consent and Data Protection
A truly DPDP-compliant AI-based loyalty platform India operators can deploy must solve four technical problems simultaneously: consent capture at granularity, consent enforcement at processing time, consent portability and consent audit. Most platforms in the Indian market — including point solutions built on top of POS systems like Petpooja, POSist, GoFrugal or Wondersoft — solve only the first problem, and often imperfectly. The remaining three are where compliance genuinely lives.
Consent enforcement at processing time means that when the loyalty engine's AI model runs a churn-prediction batch job at 2 AM, it must dynamically exclude all data fields for members who have not consented to predictive analytics. This requires the consent management layer to be deeply integrated with the data pipeline, not bolted on as a front-end widget. Practically, this means every member record in the data warehouse carries a consent-state vector — a structured record of exactly which processing activities are permitted — and every AI query, segmentation job and campaign trigger filters against this vector before execution. This is non-trivial engineering, and it is precisely why loyalty platforms that were not built with DPDP in mind will struggle to retrofit compliance.
Consent portability — the ability for a member to receive a machine-readable summary of all data held and all consents given — is another technical requirement that legacy systems fail. Under DPDP 2023, a member of a Reliance Trends loyalty program has the right to request a full data summary. The platform must be able to generate this on demand, in a structured format, without requiring manual database queries by the IT team. AI-powered platforms that maintain clean, member-centric data models — rather than fragmented tables across campaign tools, CRM and analytics — are structurally better positioned to satisfy this requirement.
Consent audit trails must be immutable, timestamped and accessible to regulators. Every change to a member's consent state — initial grant, modification, withdrawal, re-grant — must be logged with the timestamp, channel (app, kiosk, WhatsApp, call centre) and the version of the consent notice that was presented. This audit log is the evidentiary foundation of any defence before the Data Protection Board. Platforms that treat consent as a checkbox field in the member table rather than a first-class transactional entity will have no defence when enforcement begins.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.
Five-Step DPDP Compliance Playbook for Retail Loyalty Programs
Conduct a Data Inventory and Purpose Mapping Audit
Map every data field collected in your loyalty program against the stated purpose communicated to members at enrolment. Identify fields collected without a clear lawful basis. For a typical Indian mall loyalty program, this audit typically surfaces 15-25 data fields with no corresponding consent — including device fingerprints, location history and third-party enrichment attributes. This inventory is the mandatory foundation before any technical work begins.
Redesign Your Consent Notice and Granularity Architecture
Replace single opt-in with purpose-specific consent modules. At minimum, create separate consent categories for: (a) transactional loyalty mechanics, (b) personalised marketing communications, (c) AI-driven profiling and recommendations, (d) cross-brand or cross-property data sharing, and (e) third-party enrichment. Each module must have a plain-language explanation and must be presented in the member's preferred language. Engage legal counsel to validate notice language against DPDP 2023 Rules once finalised.
Implement Field-Level Consent Enforcement in Your AI Stack
Work with your loyalty platform vendor to ensure consent-state vectors are enforced at the data pipeline level, not just the UI level. Every ML model, segmentation query and campaign trigger must respect the member's current consent state. This step separates genuinely compliant AI-based loyalty platforms from those offering cosmetic compliance. Request written confirmation from your vendor on the enforcement mechanism and test it with synthetic member records before go-live.
Build Member-Facing Consent and Data-Rights Interfaces
Deploy self-service consent management and data-rights request flows across all member touchpoints: loyalty app, WhatsApp Business, in-store kiosk and call centre. Members must be able to withdraw any consent module, request a full data summary and submit an erasure request without requiring store staff intervention. SLA for erasure fulfilment should be set at 30 days or fewer, with automated confirmation sent to the member on completion.
Establish Ongoing Compliance Monitoring and Board Readiness
Appoint an internal Data Protection Officer or equivalent compliance owner for the loyalty program. Implement quarterly consent-state audits to identify members with expired or ambiguous consent records. Maintain an immutable audit log of all consent events and all AI processing activities. Conduct a mock Data Protection Board investigation annually, using real member records, to verify that all required evidence can be produced within 72 hours. Integrate compliance metrics — consent coverage rate, erasure SLA adherence, active consent withdrawal rate — into your loyalty program dashboard alongside commercial KPIs.
KPIs to Track for DPDP Compliance in Loyalty Programs
Compliance cannot be managed without measurement, and loyalty program managers must now track a parallel set of data-governance KPIs alongside the commercial metrics of repeat purchase rate, redemption rate and member lifetime value. The good news is that most of these compliance KPIs are leading indicators of commercial health as well: high consent coverage correlates with engaged, trusting members; low erasure request rates signal program satisfaction; rapid grievance resolution correlates with net promoter score.
The single most important compliance metric is consent coverage rate — the percentage of active members who have a complete, purpose-specific, documented consent record that satisfies DPDP 2023 requirements. For most programs doing a first-time DPDP audit, this number will be uncomfortably low. A program with 800,000 enrolled members might find that only 180,000 — 22.5% — have consent records that would survive regulatory scrutiny. The gap is the compliance liability. Programs should target 90%+ consent coverage within 12 months of DPDP Rules notification.
Secondary metrics include: erasure request volume and fulfilment SLA adherence (target: 100% fulfilled within 30 days), consent withdrawal rate by purpose category (a spike in withdrawals from AI-profiling consent signals member concern about data use and should trigger a communication review), data-rights request response time (target: acknowledgement within 48 hours, fulfilment within 30 days), and AI model consent-exclusion rate (the percentage of members excluded from AI processing in any given batch job due to insufficient consent — a metric that directly quantifies the commercial cost of consent gaps).
For mall operators managing multi-brand loyalty ecosystems — the most complex DPDP context, given cross-brand data sharing obligations — an additional metric is cross-brand consent coverage: the percentage of members who have explicitly consented to cross-brand data sharing. Without this consent, the entire value proposition of integrated mall loyalty — where a visit to a food court anchors a fashion offer — cannot be legally executed. Mall operators at properties like Select CITYWALK or Phoenix Marketcity who have historically assumed that a single mall-level enrolment covers cross-tenant data flows need to revisit that assumption urgently.
- Data inventory completed: every field in the loyalty database mapped to a stated purpose and a corresponding consent record
- Consent architecture redesigned with granular purpose-specific modules; single opt-in replaced across all enrolment channels
- Consent notices available in at least the top 3 languages used by your member base; legal review completed
- Field-level consent enforcement confirmed in writing with your loyalty platform vendor and tested with synthetic records
- Member-facing self-service consent dashboard live on app, WhatsApp and in-store kiosk with erasure request workflow
- Immutable consent event audit log operational; tested for 72-hour evidence production in mock regulatory scenario
- Compliance KPI dashboard live: consent coverage rate, erasure SLA adherence, AI exclusion rate tracked weekly alongside commercial metrics
“In Indian retail, consent isn't a checkbox — it's the new currency of customer trust. The loyalty platforms that treat first-party data as a privilege, not a right, will be the ones members actually stay with.”
How Fundle solves this
Vineet Narang founded Fundle on the conviction that AI-powered loyalty must be built on a foundation of explicit trust — not extracted data. That philosophy is now codified in the Fundle AI Platform's ConsentFirst architecture, which has been designed from the ground up to satisfy every material obligation under DPDP 2023. Fundle's ConsentFirst CMP is fully DPDP 2023 compliant, protecting data for 270+ brands — making it one of the most battle-tested consent management implementations in Indian retail today.
The Fundle Loyalty Platform — which spans both Fundle Mall Loyalty for shopping centre operators and Fundle Brand Loyalty for individual retail chains — implements consent as a first-class data entity. Every member record carries a consent-state vector that is enforced at the data pipeline layer, not just the presentation layer. When Fundle AI Agents run churn-prediction, next-best-offer or lapsed-member reactivation workflows, they query the consent-state vector in real time and exclude non-consented data fields from every model inference. This is not a UI toggle; it is a hard enforcement mechanism built into the Fundle Agentic AI runtime.
Fundle AI Workflow — the platform's automation layer — includes pre-built DPDP compliance workflow templates covering: initial consent collection at enrolment, consent re-confirmation at program milestone events, automated erasure execution on exit request, data-rights request fulfilment and quarterly consent-state audit batches. Mall operators running multi-brand programs can configure cross-brand consent gates directly in the workflow builder, ensuring that cross-tenant data flows are only executed for members who have explicitly consented to cross-brand sharing. This eliminates the most common DPDP gap in mall loyalty ecosystems without requiring custom engineering.
For retail marketers benchmarking AI-powered customer engagement platform India options, the key differentiator is not whether a platform claims DPDP compliance — every vendor will make that claim — but whether consent enforcement is architecturally embedded or cosmetically applied. Fundle's approach is verifiable: prospects can request a consent architecture technical review, test erasure workflows against synthetic member records and audit the consent event log schema before signing a contract. In a market where enforcement is imminent and the cost of non-compliance is existential, that verifiability is the only acceptable standard.
Frequently asked
Does DPDP 2023 apply to loyalty programs run by Indian retailers?+
Yes, unambiguously. Any entity that collects and processes personal data of Indian citizens in connection with a loyalty program is a 'data fiduciary' under DPDP 2023. This includes mall operators, brand loyalty programs, coalition loyalty schemes and any third-party platform that processes member data on their behalf. Enrolment data, transaction history, behavioural signals and AI-derived inferences are all 'personal data' under the Act.
Is a single opt-in at loyalty enrolment sufficient for DPDP 2023 compliance?+
No. DPDP 2023 requires consent to be specific to the purpose of processing. A single checkbox at enrolment that covers all data uses — transactional rewards, personalised marketing, AI profiling, cross-brand sharing — does not meet the granularity requirement. Each material processing purpose must have a separate, clearly described consent module that the member can accept or decline independently.
What is the penalty for a loyalty platform data breach under DPDP 2023?+
The Data Protection Board of India can impose penalties of up to ₹250 crore per instance of significant personal data breach. For breaches involving children's data, the ceiling is higher. Beyond financial penalties, the reputational impact on a consumer-facing loyalty brand can be severe — 68% of Indian loyalty members say they would exit a program if their data was misused.
Can AI-based loyalty platforms use member data for model training under DPDP 2023?+
Only if the member has explicitly consented to their data being used for AI profiling or predictive analytics as a stated purpose. Using transaction history to train churn-prediction or recommendation models without a specific consent entry for that purpose is a violation of the purpose-limitation principle. Platforms like Fundle enforce field-level consent at the model input layer to prevent this.
How long can a loyalty program retain member data after a member exits?+
Under DPDP 2023's data-retention principle, personal data must be erased once the purpose for which it was collected is fulfilled. When a member exits a loyalty program, the primary purpose of data retention — delivering loyalty benefits — ceases. Programs should establish a defined post-exit retention window (for example, 30 days for dispute resolution purposes), after which automated erasure should be executed and evidenced. Indefinite retention of ex-member data is a compliance risk.
How does Fundle's ConsentFirst CMP differ from a standard cookie consent banner?+
Fundle's ConsentFirst CMP is a purpose-built loyalty compliance layer, not a website cookie tool. It manages granular purpose-specific consent for loyalty data processing, enforces consent state at the AI model and data pipeline level, provides member-facing self-service consent management across app, WhatsApp and kiosk, generates immutable audit trails for regulatory evidence and executes automated erasure workflows on member exit. It is currently deployed and DPDP 2023 compliant across 270+ retail brands on the Fundle platform.
About Fundle
Fundle (Fundle.ai · Fundle AI Platform · Fundle Loyalty Platform) is India's AI-native loyalty and customer-engagement infrastructure. Fundle powers Fundle Mall Loyalty, Fundle Brand Loyalty, Fundle AI Agents, Fundle Agentic AI and Fundle AI Workflow across Indian retail members, malls and partner brands.
Fundle · Fundle.ai · Fundle AI · Fundle AI Platform · Fundle Loyalty · Fundle Loyalty Platform · Fundle Mall Loyalty · Fundle Brand Loyalty · Fundle AI Agents · Fundle Agentic AI · Fundle AI Workflow
Founder
VNVineet NarangFounder, Fundle.ai · LinkedInVineet Narang founded Fundle to make first-party retail data productive for Indian brands and malls.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.