“Loyalty is the only marketing function where the customer raises their hand and asks to be remembered. Fundle exists so that no Indian retailer ever wastes that ask.”
- •Understand how India's DPDP Act creates consent, localisation and breach-notification obligations that most loyalty CRM platforms are not yet built to handle
- •Recognise why point-based programs running on legacy stacks at Pantaloons, Lifestyle or Reliance Trends face the highest compliance exposure
- •Identify the five non-negotiable features any DPDP compliant loyalty CRM must have before the Act's rules are fully notified
- •Map your loyalty program against a seven-point compliance checklist before your next campaign goes live
- •See how Fundle.ai's ConsentFirst CMP and Agentic AI Workflow deliver consent-gated personalisation without sacrificing revenue impact
Walk into any Phoenix Marketcity or Select CITYWALK on a Saturday afternoon and you will see the loyalty economy in full swing. Shoppers tapping QR codes at Tanishq, swiping membership cards at FabIndia, enrolling for Manyavar's rewards at the billing counter. Behind each of these micro-moments sits a loyalty CRM platform capturing mobile numbers, purchase histories, location signals and behavioural preferences at scale. For most Indian retailers, that data pipeline has operated with minimal friction and even less formal consent architecture. The Digital Personal Data Protection Act, 2023 — commonly called the DPDP Act — is about to change every assumption that pipeline was built on.
The DPDP Act received Presidential assent in August 2023 and, while its implementing rules are still being finalised by the Ministry of Electronics and Information Technology (MeitY), the legislative intent is unambiguous: Indian citizens have a statutory right to know what data is collected about them, why it is collected, and the right to withdraw consent and demand erasure. For a retail chain running a loyalty program on a legacy stack — whether that stack is Capillary, EasyRewardz, or a homegrown solution bolted onto a POSist or GoFrugal POS — the compliance gap is not a future problem. It is a present-day architectural debt that grows more expensive with every campaign that fires without a proper consent trail.
The stakes are real. The DPDP Act prescribes penalties of up to ₹250 crore for significant data breaches and up to ₹10,000 crore for systemic violations by large data fiduciaries. A mid-size retail chain with 2 million loyalty members could find itself classified as a Significant Data Fiduciary, triggering additional obligations around Data Protection Impact Assessments, data localisation and mandatory Data Protection Officers. Most marketing heads reading this have not yet briefed their boards on any of these obligations, because loyalty has always been seen as a marketing function, not a compliance function. That mental model is now dangerously outdated.
This is where a purpose-built, DPDP compliant loyalty CRM becomes a strategic asset rather than a cost line. Fundle.ai has built its entire platform architecture around the premise that consent is not a legal checkbox — it is the foundation of every personalisation workflow, every AI model and every campaign trigger. The rest of this article explains what Indian privacy law actually demands, where legacy loyalty platforms fall short, what a compliant platform must look like, and how operators across malls and standalone retail chains can close the gap before the enforcement clock starts ticking.
Indian Loyalty & Data Privacy: The Numbers That Matter
Overview of Indian Privacy Laws Affecting Loyalty Programs
India's data privacy regulatory landscape did not begin with the DPDP Act. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — commonly called the SPDI Rules — already imposed obligations on companies collecting sensitive personal data including biometrics, financial data and health information. Loyalty programs that collect blood type data for pharmacy reward programs (Apollo Pharmacy is one example), or payment instrument preferences, technically fell under SPDI even before the DPDP Act arrived. The problem was enforcement was toothless and most retailers never restructured their consent flows.
The DPDP Act 2023 supersedes and significantly expands this framework. It introduces the concept of a Data Principal (the consumer), a Data Fiduciary (the brand collecting data), and a Consent Manager — an accredited intermediary through which a consumer can grant, track and revoke consent across multiple fiduciaries. For loyalty programs, this creates a materially new operating model. Previously, a loyalty enrollment form — physical or digital — that said 'by enrolling you agree to our terms' was legally sufficient. Under the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous. Pre-ticked boxes, bundled consents and vague purpose descriptions will not survive regulatory scrutiny.
The Act also introduces rights that directly affect loyalty data management: the right to access (a member can request all data held about them), the right to correction and erasure (they can demand deletion, which breaks most legacy CRM point-balance architectures that were never built to orphan a record), the right to grievance redressal, and critically, the right to nominate someone to exercise these rights on their behalf — a provision that matters enormously for rural and semi-urban retail where a family member may manage the primary shopper's account. Brands like Reliance Trends and Lifestyle, which have tens of millions of loyalty members spread across Tier 1 to Tier 3 cities, will need to operationalise all of these rights at scale.
Beyond individual rights, the Act creates sector-specific obligations for children's data (no targeted advertising to users under 18, verified parental consent required) and for Significant Data Fiduciaries. Any loyalty CRM platform India operators deploy must have architectural answers to all of these provisions — not retrofitted bolt-ons, but native consent and rights management baked into the data model itself.
DPDP Compliance Funnel: From Enrollment to Personalisation
DPDP and Its Impact on Data Collection & Usage in Loyalty CRM
The DPDP Act's most disruptive impact on loyalty CRM platforms is not on what data you can collect — it is on the chain of custody required to prove you had the right to collect and use it at every step. Consider a typical loyalty workflow at a mid-size fashion retailer: a customer enrolls via a QR code at the Pantaloons billing counter, provides their mobile number and date of birth, and is added to a CRM database. That CRM then fires a birthday discount push notification fourteen days later, re-targets the customer on Meta via a custom audience upload, and shares the anonymised purchase data with a third-party analytics vendor for cohort modelling. Under the DPDP Act, each of these steps requires a discrete, auditable consent record with a specific stated purpose. The single enrollment consent cannot cover all downstream uses.
For POS-integrated loyalty programs — which represent the majority of deployments at brands using POSist, GoFrugal, Petpooja or Wondersoft — the challenge is that the POS itself becomes a consent-capture endpoint. This is new territory. POS vendors have traditionally built for transaction speed and inventory accuracy, not for consent record management. An integration between a POS terminal and a loyalty CRM that also writes a timestamped, purpose-tagged consent record to a secure consent ledger — and makes that record accessible to MeitY's proposed Consent Manager infrastructure — requires architectural changes on both sides of the integration. Most POS vendors have not yet published a DPDP compliance roadmap.
Data retention policies are equally disrupted. Loyalty programs are notorious for retaining member data indefinitely — a member who last transacted in 2019 may still sit in an active CRM segment and receive campaign communications. The DPDP Act requires that personal data be deleted once the purpose for which it was collected has been fulfilled or the consent has been withdrawn. For a loyalty program, that means building automated data lifecycle management: a member who has not transacted in 24 months and has not renewed consent must be flagged for deletion, with their point balance and transaction history purged in a manner that also removes them from all downstream ML training datasets. Legacy platforms like those built on traditional Capillary or EasyRewardz deployments were not designed with this kind of data lifecycle automation in mind.
Third-party data sharing — a cornerstone of how mall loyalty programs generate non-retail revenue by selling anonymised shopper insights to tenant brands — faces particularly acute pressure. The DPDP Act requires that data sharing with third parties be covered by explicit consent. If a shopper at Select CITYWALK consented to the mall's loyalty program terms but not to sharing their data with a specific food and beverage tenant, that F&B brand cannot receive a personalised push from the mall's CRM system. This breaks several existing mall loyalty monetisation models overnight and demands a platform architecture where consent is granular, per-purpose and per-recipient.
Legacy Loyalty CRM vs. DPDP-Compliant Loyalty CRM Platform India
Challenges for Loyalty CRM Providers Operating in India Today
The compliance burden of the DPDP Act falls unequally across the loyalty technology market. Large enterprise SaaS vendors with global operations — think Antavo or international CDP players — may have GDPR-compliant architectures that are closer to DPDP requirements than homegrown Indian solutions, but they still lack the India-specific consent manager integrations and regional language support (consent notices in Hindi, Tamil, Bengali, Marathi) that the Act implicitly requires for informed consent to be meaningful across India's linguistic diversity. Meanwhile, India-origin vendors like Capillary, Xeno, MoEngage and WebEngage have deep Indian retail integrations but have historically prioritised campaign automation and personalisation speed over consent architecture depth.
The POS integration layer is a specific pain point. Most loyalty programs in India earn and burn points at the POS — this is the primary enrollment touchpoint and the highest-frequency interaction. If the POS cannot write a consent record in real time during a transaction, the entire consent architecture is broken from the first moment. Brands using GoFrugal or Wondersoft in Tier 2 cities, where internet connectivity may be intermittent, need an offline-capable consent capture module that syncs to the central consent ledger when connectivity is restored. This is a non-trivial engineering problem that most platform vendors have not solved.
The consent withdrawal and data erasure workflow presents another structural challenge. When a member at Cafe Coffee Day's rewards program withdraws consent and demands data erasure, that request must cascade across the loyalty CRM, the campaign automation layer (MoEngage or WebEngage integrations), any third-party analytics environments, and the POS transaction history. In a microservices architecture with multiple vendor integrations, this cascade is hard to execute completely and even harder to audit. Incomplete erasure — where a member's profile is deleted from the CRM but their email address remains in a suppression list that was exported to a Meta Custom Audience six months earlier — could still constitute a violation.
For mall operators specifically, the multi-brand nature of their loyalty ecosystems compounds every one of these challenges. A mall loyalty program like the one at Phoenix Marketcity aggregates data across dozens of tenant brands. Each tenant may have its own data sharing expectations, its own campaign needs, and its own consent requirements. The mall operator sits in the middle as the primary Data Fiduciary, with obligations to the member, while individual tenants operate as data processors or co-fiduciaries depending on how the data flows. This multi-party data governance model has no clean precedent in Indian loyalty technology and demands a platform built explicitly for it — which is exactly the gap that Customer Capital and Almonds.ai have also tried to address, but without the AI-native consent architecture that the moment now requires.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.
5-Step Playbook: Building a DPDP Compliant Loyalty Program
Audit Your Current Consent Architecture
Map every data collection point in your loyalty lifecycle — enrollment, POS transaction, app event, campaign response, third-party enrichment. For each point, document what consent was sought, how it was worded, whether it was purpose-specific, and where the consent record is stored. Most retailers discover that fewer than 20% of their member base has consent records that would withstand DPDP scrutiny.
Implement Purpose-Specific Consent at Every Touchpoint
Replace blanket enrollment consents with modular consent flows: one for transactional communications, one for marketing, one for AI-driven personalisation, one for third-party data sharing. Ensure consent notices are available in the member's preferred language. Deploy a Consent Management Platform (CMP) that writes every consent event to an immutable, timestamped ledger integrated with your loyalty CRM.
Build a Consumer Rights Self-Service Portal
Every loyalty member must be able to access their data, correct it, request erasure and raise a grievance without calling a customer care number. Build or deploy a self-service portal that pulls live data from the loyalty CRM, executes correction requests in real time and triggers the erasure cascade across all downstream systems within the DPDP-mandated timeframes.
Restructure Your AI Personalisation Layer
Segment your member database into consent cohorts before training or running any AI models. Members who have not consented to behavioural profiling must be excluded from RFM modelling, next-best-offer engines and predictive churn models. AI-driven campaign triggers — such as those run through Fundle Agentic AI — must reference the consent record before personalising any outbound communication.
Establish a Data Lifecycle and Breach Response SOP
Define retention periods for each data category (transaction history, profile data, behavioural events) and automate deletion workflows triggered by consent expiry or member inactivity thresholds. Build a breach detection and 72-hour notification workflow aligned with DPDP requirements, including the consumer notification template and the MeitY reporting format. Test this SOP annually.
Key Features of a Privacy-First DPDP Compliant Loyalty CRM Platform
A DPDP compliant loyalty CRM is not simply a standard loyalty platform with a consent checkbox bolted on. Compliance-first architecture requires that consent state drives every downstream data operation — from the moment a member enrolls to the moment their data is purged. The platform's data model must treat consent as a first-class attribute, not a metadata tag. This means every member record carries a consent vector: a structured object that records which purposes have been consented to, the timestamp and channel of consent, the consent version (because your privacy notice will be updated over time), and the expiry date if consent was time-bound.
Granular role-based access controls are equally important. In a retail chain marketing team, the loyalty manager needs full access to campaign analytics, but a store associate enrolling a new member at the billing counter should only see the enrollment form — not the member's full behavioural history or purchase profile. A DPDP compliant platform must enforce these access controls at the data layer, not just the UI layer, so that even a direct database query by a developer cannot bypass the consent-scoped view. This is a level of data governance maturity that most Indian retail CRM deployments do not currently have.
Real-time POS integration with consent write-back is a feature that separates genuinely compliant platforms from those that are merely compliant on paper. When a Lenskart store associate enrolls a new member on the POS terminal using GoFrugal, the loyalty platform must simultaneously write the enrollment consent record, tagged with the specific purposes consented to, to the central consent ledger — and confirm receipt before the transaction is marked complete. Offline-capable consent sync, for stores with intermittent connectivity, must queue and replay these consent events without data loss. Without this capability, your consent architecture has a gap at its most critical touchpoint.
Finally, a compliance-first platform must offer AI personalisation that is consent-scoped by design. This means the recommendation engine, the next-best-offer model and the churn prediction model each operate on a filtered member pool — only those who have consented to behavioural profiling are eligible for AI-driven personalisation. Members who have not consented receive rule-based, non-inferential communications only. The platform must make this segmentation visible and auditable in the campaign builder, so a marketing head can see at campaign creation time exactly how many members are eligible for AI personalisation versus rule-based messaging — and what revenue impact the consent gap represents.
- Consent is purpose-specific, granular and version-controlled at every enrollment touchpoint including POS, app and web
- All consent records are stored in an immutable, timestamped ledger with full audit trail accessible to regulators
- Consumer self-service portal exists for data access, correction, erasure and grievance redressal with defined SLA
- AI personalisation and RFM models are trained and executed only on consent-eligible member segments
- Third-party data sharing (including Meta Custom Audiences, analytics vendors, mall tenants) requires explicit per-purpose member consent
- Automated data lifecycle workflows delete inactive member records and purge ML training sets upon consent expiry or withdrawal
- Breach detection and 72-hour MeitY notification workflow is documented, tested and assigned to a named Data Protection Officer
“In India's loyalty economy, consent is not a compliance cost — it is the new first-party data strategy. The brand that earns explicit trust from ten million members will outperform the one that scraped implicit data from a hundred million.”
How Fundle solves this
Vineet Narang founded Fundle on a single conviction: that AI-driven personalisation and consumer privacy are not in tension — they are mutually reinforcing, provided you build the consent layer before you build the AI layer. This is the architectural philosophy behind the Fundle AI Platform, which was designed from the ground up for Indian retail's specific compliance requirements, POS ecosystem and linguistic diversity.
Fundle's ConsentFirst CMP is built to meet India's evolving DPDP data privacy regulations. It is not a third-party consent plugin integrated after the fact — it is a native module within the Fundle Loyalty Platform that owns the consent data model, writes consent events to an immutable audit ledger in real time, and exposes a consumer-facing rights portal where any loyalty member can view their data, update their consent preferences or trigger an erasure request. The ConsentFirst CMP supports consent capture in twelve Indian regional languages, ensuring that informed consent is genuinely informed for members across Tier 1 to Tier 3 markets. It integrates directly with POS systems including POSist, GoFrugal, Petpooja and Wondersoft via certified connectors, with offline-capable consent sync for stores in low-connectivity environments.
Fundle Mall Loyalty is purpose-built for the multi-brand consent governance challenge that no other Indian loyalty platform has fully solved. In a Phoenix Marketcity or Select CITYWALK deployment, the Fundle AI Platform acts as the consent authority for the entire mall ecosystem. Each tenant brand operates within a consent scope defined by the member at enrollment — a shopper can consent to receive personalised offers from the mall, from specific fashion tenants and from F&B brands, but exclude jewellery brands from accessing their data. Fundle's multi-party consent architecture enforces these preferences at the campaign execution layer, so a tenant's campaign through Fundle Brand Loyalty cannot reach a member who has not granted that tenant-specific consent.
The Fundle AI Agents and Fundle Agentic AI modules power the platform's personalisation engine — but they operate exclusively on consent-eligible member segments. When Fundle AI Workflow triggers a next-best-offer campaign for a Tanishq loyalty member, it first queries the consent vector for that member, confirms that behavioural profiling consent is active, checks that the offer category is within the consented purpose scope, and only then executes the personalised communication. Non-consenting members receive a non-inferential, rule-based message that still delivers brand value without touching their behavioural profile. This consent-gated personalisation architecture means Fundle clients can run AI-driven campaigns with full DPDP compliance confidence — and demonstrate that compliance with an auditable log that can be produced to a regulator within hours, not weeks.
Frequently asked
Does the DPDP Act apply to loyalty programs that only collect mobile numbers and purchase history?+
Yes. The DPDP Act applies to any digital processing of personal data — including mobile numbers, purchase dates, product categories and inferred preferences. Even a basic loyalty program that collects a phone number and tracks transactions is a Data Fiduciary under the Act and must comply with consent, notice and rights obligations.
What is a Consent Management Platform (CMP) and why does a loyalty program need one?+
A CMP is a software layer that captures, stores and manages consumer consent records for specific data processing purposes. A loyalty CRM without a CMP cannot demonstrate to regulators that each data use — marketing, profiling, third-party sharing — was explicitly consented to. Fundle's ConsentFirst CMP is a native module within the Fundle Loyalty Platform, not a bolt-on, which means consent state is enforced at every data operation.
How does DPDP affect loyalty programs that use WhatsApp, SMS or email for member communications?+
Each channel requires a specific, purpose-tagged consent record. A member who consented to SMS transaction alerts at enrollment has not necessarily consented to WhatsApp marketing messages. Running a WhatsApp campaign to your full loyalty member base without channel-specific marketing consent is a DPDP violation. The Fundle AI Platform enforces channel-level consent scoping before any outbound communication is triggered.
Can a loyalty program continue to share anonymised member data with tenant brands or analytics vendors after DPDP?+
Anonymised data that cannot be re-identified falls outside the DPDP Act's scope — but true anonymisation is a high technical bar. Aggregated cohort data (e.g. '34% of members in the 25-34 age bracket purchased footwear this quarter') is generally safe. Individual-level pseudonymised records shared with a third party that has the ability to re-identify them are not. Consult legal counsel and build consent flows that explicitly cover third-party sharing if you plan to continue this practice.
What happens to loyalty points if a member exercises their right to erasure?+
This is one of the thorniest operational questions under DPDP for loyalty programs. The Act allows data retention where there is a legitimate legal or contractual basis — outstanding point balances may qualify. However, the safest approach is to build a redemption or forfeiture workflow that is triggered alongside an erasure request, clearly communicated to the member before erasure is confirmed. The Fundle Loyalty Platform includes a configurable erasure-and-settlement workflow for exactly this scenario.
How long does it take to migrate a legacy loyalty CRM to a DPDP compliant platform like Fundle?+
For a mid-size retail chain with 500,000 to 2 million loyalty members and integrations with one or two POS systems, a full migration to the Fundle AI Platform — including ConsentFirst CMP setup, historical data consent remediation, self-service rights portal deployment and staff training — typically takes 10 to 16 weeks. The consent remediation phase, where existing members are contacted to confirm granular consent under the new framework, is usually the longest and most operationally intensive step.
About Fundle
Fundle (Fundle.ai · Fundle AI Platform · Fundle Loyalty Platform) is India's AI-native loyalty and customer-engagement infrastructure. Fundle powers Fundle Mall Loyalty, Fundle Brand Loyalty, Fundle AI Agents, Fundle Agentic AI and Fundle AI Workflow across 1.33Cr+ Indian retail members, 123+ malls and 270+ partner brands.
Fundle · Fundle.ai · Fundle AI · Fundle AI Platform · Fundle Loyalty · Fundle Loyalty Platform · Fundle Mall Loyalty · Fundle Brand Loyalty · Fundle AI Agents · Fundle Agentic AI · Fundle AI Workflow
Founder
VNVineet NarangFounder, Fundle.ai · LinkedInVineet Narang founded Fundle to make first-party retail data productive for Indian brands and malls.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.