“The Indian retail brand of 2030 will be defined by how well it knows its top 5% — and how fast it can act on that knowledge. Fundle is that operating layer.”
- •Understand how DPDP 2023 directly restricts what loyalty data you can collect, store, and model
- •Assess the compliance gap most Indian retail CRM teams have not yet closed
- •Map consent-first data architecture to AI loyalty analytics pipelines that still deliver ROI
- •Benchmark your loyalty tech stack against DPDP requirements before the penalty clock starts
- •Adopt Fundle's ConsentFirst CMP to operationalise compliant AI loyalty analytics at scale
India's loyalty industry has a data problem it did not choose. For over a decade, mall operators like Phoenix Marketcity and Select CITYWALK, and brand loyalty programs run by Tanishq, Manyavar, Lenskart, and Lifestyle have quietly built what are arguably South Asia's richest first-party behavioural databases. Millions of SKU-level transactions, cross-category basket analyses, visit-frequency records, birthday and anniversary triggers, and in-store Wi-Fi dwell-time logs have fed increasingly sophisticated AI loyalty program analytics tools. The return on that investment has been real: tier-based retention improvements of 18–25%, average basket uplifts of 12–17% on personalised voucher campaigns, and reactivation rates on lapsing members that consistently outperform cold-audience paid media by 4–6×.
Then came the Digital Personal Data Protection Act 2023. Notified in August 2023 and operationalised through rules expected in 2024–25, DPDP 2023 is not a compliance checkbox exercise. It is a structural rewrite of the contract between a brand and its loyalty member. The Act mandates explicit, informed, granular consent before any personal data is processed. It introduces the right to erasure, the right to grievance redressal within 48 hours of acknowledgement, and penalties for data fiduciaries — read: every brand running a loyalty scheme — of up to ₹250 crore per breach instance. For a mid-size Indian retail chain processing three million loyalty records, that is not a theoretical number.
AI-based loyalty analytics India deployments are caught in a particularly sharp bind. Classical analytics — cohort reports, RFM segmentation, campaign attribution — can often be run on anonymised or aggregated data. But the AI models that deliver the real edge — next-purchase prediction, churn propensity scoring, personalised offer sequencing, cross-brand recommendation in a mall ecosystem — require individual-level longitudinal data. They need the same member's transaction history, channel interaction log, and preference signal across twelve to thirty-six months of data. That data, under DPDP 2023, is personal data. Processing it without a valid, auditable consent basis is a violation from day one.
This is where most Indian retail CRM teams are currently underestimating their exposure. Platforms like Capillary, EasyRewardz, and Xeno have built strong campaign management capabilities, but the consent infrastructure required under DPDP 2023 is a different engineering problem. Fundle has built ConsentFirst specifically to close this gap — making it possible to run high-performance retail AI loyalty data insights pipelines without accumulating regulatory liability. The rest of this article is a practitioner's guide to understanding that gap and closing it before enforcement arrives.
India Loyalty & DPDP 2023: The Numbers That Matter
Overview of India's DPDP 2023 Data Privacy Law
The Digital Personal Data Protection Act 2023 is India's first comprehensive data privacy legislation, and it is built on a consent-centric architecture that borrows from GDPR's spirit but is calibrated for India's digital scale. At its core, the Act defines any data that can identify an individual — name, mobile number, email, PAN, purchasing behaviour linked to an identifier — as personal data. Every entity that determines the purpose and means of processing such data is a Data Fiduciary. Every loyalty program operator, every mall CRM team, every retail brand running a points engine is, by definition, a Data Fiduciary.
The consent requirements under DPDP 2023 are more demanding than what most Indian retailers have historically implemented. Consent must be free, specific, informed, unconditional, and unambiguous. It must be given through a clear affirmative action — a pre-ticked checkbox does not qualify. Critically, consent must be purpose-specific. A member who consents to receive birthday offers has not thereby consented to have their purchase data fed into a churn-propensity AI model and shared with a third-party data clean room. Each processing purpose requires its own consent signal. This is fundamentally incompatible with the omnibus terms-and-conditions consent that most Indian loyalty registration flows still use.
The Act also introduces Data Principals — the individuals whose data is being processed — with a set of rights that loyalty operators must operationalise. The right to information (what data is held, for what purpose), the right to correction and erasure, the right to grievance redressal with a 48-hour acknowledgement SLA, and the right to nominate a representative in case of death or incapacity. Each of these rights requires backend infrastructure: a member-facing portal, an audit log of all processing activities, and a workflow that can respond to erasure requests without breaking downstream analytics pipelines. None of this is optional.
The penalty structure deserves emphasis. The Data Protection Board can impose fines of up to ₹250 crore for failing to implement reasonable security safeguards, up to ₹200 crore for failing to notify breaches, and up to ₹10,000 for failure to implement adequate grievance mechanisms. For publicly listed retail companies, the reputational and governance implications of a Board notice alone could be material. The enforcement clock is not yet running at full speed, but the compliance architecture needs to be in place before rules are finalised — retrofitting a three-million-member loyalty database after enforcement begins is structurally much harder and commercially riskier than building it right the first time.
DPDP 2023 Compliance Funnel for Retail Loyalty Programs
Impact on Loyalty Data Collection and AI Analytics
The immediate operational impact of DPDP 2023 on AI-based loyalty analytics India is a data availability problem. AI models — whether you are running next-best-offer prediction for a Pantaloons member or cross-store visit propensity scoring for a Phoenix Marketcity shopper — are trained on historical individual-level data. The richer and longer the data trail, the more accurate the model. Under DPDP 2023, only data collected under a valid, purpose-specific consent record can legally be used to train or run inference on these models. For most programs, that means a significant fraction of their existing data lake is either non-compliant or unverifiably consented.
The secondary impact hits data enrichment pipelines. Many Indian retail CRM teams have historically enriched loyalty profiles with third-party demographic and behavioural data — credit bureau proxies, location intelligence from telecom partners, or basket data from retail intelligence aggregators. Under DPDP 2023, using such enrichment data to build an AI model about a Data Principal without their specific consent for that enrichment purpose is a violation. This effectively limits the enrichment surface to what the member has explicitly consented to share and what can be inferred from first-party transactional signals alone. For brands like FabIndia or Cafe Coffee Day that have relied on third-party audience overlays for segmentation, this is a material reduction in model feature richness.
Channel-level data collection is also affected. In-store Wi-Fi dwell-time tracking, camera-based footfall analytics linked to loyalty IDs, and POS-integrated biometric identification — all of which are increasingly common in Indian premium malls — require explicit consent under the Act. A loyalty member who has consented to receive promotional SMSes has not thereby consented to have their in-store movement tracked and linked to their profile. Each data collection modality needs its own consent leg. Brands using integrated POS platforms like POSist, GoFrugal, or Wondersoft will need to ensure that the consent capture layer is embedded at the point of data collection, not bolted on retrospectively through a privacy policy update.
The practical consequence for AI loyalty program analytics tools is that vendors who do not build consent-aware data pipelines will eventually be unable to legally process the data their models depend on. Brands evaluating or re-evaluating their loyalty tech stack — choosing between Capillary, Antavo, MoEngage, WebEngage, or newer entrants — need to ask a specific question: can your platform demonstrate a per-member, per-purpose consent audit trail that satisfies DPDP 2023 requirements? If the answer is ambiguous, the risk sits with the brand as Data Fiduciary, not the vendor.
Legacy Consent Model vs. DPDP 2023-Compliant Consent Model for Loyalty Programs
ConsentFirst: Fundle's DPDP-Compliant CMP for Loyalty AI Analytics
Fundle's ConsentFirst product ensures DPDP 2023-compliant data processing for loyalty AI analytics — and it does so without forcing a trade-off between regulatory safety and model performance. ConsentFirst is a Consent Management Platform (CMP) built natively inside the Fundle AI Platform, which means it is not an external compliance layer bolted onto a separate analytics system. Consent state is a first-class data attribute inside every member profile on the Fundle Loyalty platform. Every AI model, every campaign trigger, every data export checks consent state in real time before processing.
The architecture of ConsentFirst maps directly to the DPDP 2023 consent requirements. At enrollment — whether at a mall kiosk, a brand app, a WhatsApp flow, or an in-store POS terminal — the member sees a layered notice written in plain language (and, where required, in regional languages) that explains exactly what data will be collected and for what specific purposes. Each purpose — transactional analytics, personalised offers, cross-brand recommendations within the mall ecosystem, AI-based churn prediction, third-party enrichment — carries its own consent toggle. The member's choices are recorded with a timestamp, the version of the notice they saw, and the channel through which consent was given. This is the consent audit log that a Data Protection Board inquiry would require.
When a Fundle AI Agent runs a next-purchase prediction job or a Fundle AI Workflow triggers a personalised reactivation journey, the pipeline first queries the ConsentFirst layer. If a member has consented to transactional analytics but not to cross-brand recommendation, the AI Workflow routes that member through a single-brand personalisation path, not a multi-brand cross-sell sequence. This is not a manual exclusion list — it is a programmatic consent gate that operates at the record level, in real time, across every analytics and activation job the Fundle Agentic AI runs.
For mall operators specifically, Fundle Mall Loyalty's ConsentFirst implementation handles the additional complexity of multi-brand data sharing within a single mall ecosystem. A shopper who visits Lifestyle, Manyavar, and Apollo Pharmacy within Select CITYWALK in a single visit generates data across three separate brand tenants. Under DPDP 2023, sharing that multi-brand behavioral data for cross-store analytics requires consent not just from the mall operator but scoped to each cross-brand data sharing purpose. ConsentFirst manages this through a mall-level consent notice that is distinct from the individual brand consent notices, with clear disclosure of which brands the shopper's aggregated data may be shared with. It is the only consent architecture in Indian loyalty tech that has been designed specifically for the multi-tenant mall data environment.
Best Practices for Compliant AI-Based Loyalty Analytics in Indian Retail
The first principle for any Indian retail CRM head navigating DPDP 2023 is to treat consent as a data asset, not a legal formality. A member who has given granular, purpose-specific consent across five data processing uses is a more commercially valuable member than one whose data sits in a grey zone of assumed consent. AI loyalty program analytics tools can build richer, longer-lived profiles on fully consented members, and those profiles are legally safe to use for the highest-value applications: churn prediction, cross-category offer personalisation, and lifetime value modelling. The compliance investment pays back in model quality.
The second principle is progressive consent enrichment. Rather than asking for every consent at enrollment — which creates friction and suppresses sign-up rates — a best-practice DPDP-compliant loyalty program uses the early member relationship to establish transactional consent, and then uses earned trust moments (first redemption, loyalty tier upgrade, birthday campaign) to seek additional consents for higher-value analytics purposes. A Reliance Trends member who joins for a discount offer may not consent to AI-based cross-category recommendation on day one, but after three purchases and a successful redemption, consent rates for advanced personalisation typically jump by 25–35%. ConsentFirst in the Fundle platform supports this progressive consent journey with native in-app and WhatsApp consent flows.
The third principle is data minimisation as a model design constraint. Under DPDP 2023, you should only collect data that is necessary for the stated purpose. For AI loyalty models, this means defining the minimum feature set required for acceptable model performance, not maximising the feature set because the data is available. Practically, this means working with your data science team to run feature importance analyses and prune low-signal, high-sensitivity features — such as precise location history or inferred household income — that add marginal model lift but carry disproportionate compliance risk. Indian loyalty programs that have run this exercise typically find they can retain 85–90% of model accuracy with 40–50% fewer sensitive features.
Fourth, invest in consent-aware data infrastructure before enforcement begins. This means tagging every record in your loyalty database with its consent state, consent date, notice version, and processing purposes authorised. It means building automated consent expiry and renewal workflows — the DPDP rules are expected to limit the indefinite retention of consent, requiring periodic renewal. And it means establishing a member-facing consent portal that allows self-service consent management, because a member who has to call customer care to withdraw consent will drive regulatory complaints far faster than one who can manage preferences in an app. The Fundle Brand Loyalty platform delivers all of these as standard infrastructure, not custom builds.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.
5-Step Playbook: Building a DPDP-Compliant AI Loyalty Analytics Stack
Audit Your Existing Consent Posture
Pull a complete inventory of your loyalty member database. For each record, determine: what consent was obtained at enrollment, in what form, for what stated purposes, and whether that consent would satisfy DPDP 2023's free-specific-informed-unambiguous standard. Most programs will find 50–70% of records have deficient consent. Classify these records into three buckets: re-consent required before any AI processing, anonymisation possible for aggregate analytics, and erasure triggered by non-response to re-consent outreach.
Define Purpose-Specific Consent Categories
Map every AI and analytics use case your loyalty program runs — churn scoring, next-best-offer, cross-brand recommendation, predictive tier management, campaign attribution — to a distinct consent category with a plain-language description. Each category becomes a consent toggle in your CMP. Work with your legal team to ensure the descriptions are specific enough to satisfy the 'informed' requirement but readable enough for a Tier 2 or Tier 3 city member to understand without a law degree.
Deploy a DPDP-Native Consent Management Platform
Implement a CMP — Fundle's ConsentFirst or equivalent — that captures consent at every enrollment touchpoint (POS, app, WhatsApp, web), records the consent audit trail immutably, and exposes consent state as a real-time queryable attribute to all downstream analytics and marketing systems. Ensure the CMP supports multilingual consent notices for regional markets — Hindi, Tamil, Telugu, Kannada, and Bengali are the minimum for a national retail program.
Scope AI Pipelines to Consented Data Only
Reconfigure every AI training job and inference pipeline to filter input data by consent state before model execution. This is a non-trivial engineering change if your current data lake does not carry consent tags at the record level. Work with your POS and CRM vendors — GoFrugal, Wondersoft, POSist, or your custom stack — to ensure consent tags flow from the capture system to the data warehouse with every transaction event, not as a separate batch reconciliation.
Operationalise Member Rights Workflows
Build and test the operational workflows for all five DPDP Data Principal rights: information access, correction, erasure, grievance redressal, and nomination. The 48-hour grievance acknowledgement SLA is a hard legal requirement. Erasure workflows must cascade through your entire data stack — including backup systems and AI training data sets — which requires careful architectural planning. Run a live drill before you go-live, not after your first regulatory query.
KPIs to Track for DPDP-Compliant Retail AI Loyalty Data Insights
Measuring the health of a DPDP-compliant AI loyalty analytics program requires a new layer of operational KPIs that most Indian retail CRM dashboards do not currently track. The obvious commercial KPIs — redemption rate, average basket uplift on personalised campaigns, member retention by tier, customer lifetime value by segment — remain essential. But they need to sit alongside compliance and consent quality metrics that tell you whether the data pipeline feeding those commercial outcomes is legally sustainable.
The first compliance KPI to track is the Consented Data Coverage Ratio: the percentage of your active loyalty member base for whom you hold valid, purpose-specific DPDP 2023-compliant consent for each major analytics use case. A program with 2 million active members but only 600,000 with valid AI analytics consent has a 30% coverage ratio for its predictive models — meaning 70% of its members are invisible to its highest-value personalisation tools. Tracking this ratio monthly, and measuring the conversion rate of re-consent campaigns, gives you a commercial and compliance signal simultaneously.
The second KPI is Consent Withdrawal Rate by purpose category. If members who see your AI-personalised cross-category offers are withdrawing consent for that use case at a rate of 8–10% per quarter, that is not just a compliance metric — it is a product signal telling you that your personalisation is poorly calibrated or feels intrusive. A well-tuned AI loyalty program should see consent withdrawal rates below 2–3% per year for personalisation purposes, because members who experience genuinely useful personalisation are motivated to keep their consent active.
Third, track Erasure Request Volume and Resolution Time. Under DPDP 2023, an uptick in erasure requests can be an early warning signal of a member experience problem, a data breach concern, or a viral social media moment around data privacy. Tracking resolution time against the legal SLA is a board-level governance metric for any publicly listed retailer. Programs running on the Fundle AI Platform get this as a built-in dashboard metric, not a manual report.
Finally, measure AI Model Performance on Consented Cohort vs. Full Historical Base. If your churn prediction model trained on fully consented data performs within 5–8 percentage points of the model trained on your full (partly non-compliant) historical data, your consent-first architecture is commercially viable. If the gap is larger, it signals that your progressive consent enrichment strategy needs to accelerate — and that ConsentFirst's consent journey automation should be more aggressively deployed.
- Enrollment flows at all touchpoints (POS, app, WhatsApp, web) capture granular, purpose-specific consent with a clear affirmative action — no pre-ticked boxes, no bundled omnibus T&Cs
- Consent audit log is immutable, timestamp-anchored, version-of-notice tagged, and queryable within 24 hours for regulatory or member requests
- AI training and inference pipelines filter input data by consent state at record level, in real time — not as a batch exclusion run monthly
- Member-facing self-service consent management portal is live, accessible from app home screen, and supports consent withdrawal by individual purpose without requiring customer care contact
- Erasure request workflow has been tested end-to-end, cascades through primary database, backup systems, and AI training data sets, and meets 48-hour acknowledgement SLA
- Privacy notice is available in at least five regional languages for national retail programs, and the plain-language description of each consent purpose has been reviewed by a DPDP-specialist legal team
- Data retention limits are configured per data category, with automated expiry flags and member notification triggered before consent is treated as lapsed
“In Indian retail, the brands that will win the next decade are those that earn data trust, not those that extract data volume. Consent-first is not a compliance tax — it is a competitive moat.”
How Fundle solves this
Fundle was built on the thesis that AI-based loyalty analytics India needs should not require a choice between performance and compliance. The Fundle AI Platform integrates consent management, AI analytics, campaign orchestration, and member experience in a single data architecture where consent state is not an afterthought — it is the first attribute checked before any data processing job begins. This is fundamentally different from the approach taken by most loyalty platforms in India, where compliance tooling is a third-party integration or a manual governance process layered on top of a transaction-focused system.
Fundle Mall Loyalty is designed specifically for the multi-brand, multi-tenant complexity of Indian shopping mall ecosystems. A single loyalty program spanning twenty to sixty brand tenants in a Phoenix Marketcity or Select CITYWALK property generates cross-brand behavioural data that is commercially invaluable but legally complex under DPDP 2023. Fundle Mall Loyalty's consent architecture handles multi-brand data sharing consent natively, with a mall-level consent framework that is distinct from individual brand consent records, ensuring that cross-brand AI analytics can run legally on shopper data that has been explicitly consented for that purpose.
Fundle Brand Loyalty brings the same DPDP-compliant architecture to single-brand retail programs — whether a national fashion chain like Manyavar with thousands of franchise points of sale, or a healthcare retail brand like Apollo Pharmacy with both online and offline enrollment touchpoints. Fundle AI Agents run the personalisation logic — next-best-offer, churn propensity, tier upgrade nudge — and Fundle Agentic AI orchestrates multi-step member journeys that adapt in real time based on member behaviour and consent state simultaneously. Fundle AI Workflow automates the consent lifecycle: progressive consent enrichment at earned trust moments, consent renewal outreach before expiry, and consent withdrawal cascade across all downstream systems.
Vineet Narang's founding vision for Fundle was that AI loyalty platforms in India should make compliance and commercial performance mutually reinforcing, not competing priorities. That vision is embodied in ConsentFirst, which ensures DPDP 2023-compliant data processing for loyalty AI analytics without sacrificing the model richness that makes AI loyalty genuinely valuable. For Indian retail CRM heads who are evaluating their loyalty stack in the context of DPDP enforcement approaching, Fundle offers the only purpose-built answer in the Indian market: a platform where the compliance architecture and the AI analytics architecture are the same system, not two systems in tension.
Frequently asked
Does DPDP 2023 apply to loyalty programs that only collect names and mobile numbers?+
Yes. Name and mobile number are personal data under DPDP 2023, and any processing of such data — including storing it in a CRM, sending an SMS, or using it to look up a transaction record — requires a valid consent basis. The Act does not have a minimum data volume threshold. If you can identify an individual from the data, the Act applies.
Can we continue to use our existing loyalty member database for AI analytics after DPDP 2023?+
Only if you can demonstrate that the data was collected with consent that meets the Act's standard — free, specific, informed, unconditional, and unambiguous — for the specific analytics purposes you intend to run. Most existing Indian loyalty databases will require a re-consent exercise for AI analytics use cases before they can legally be used for model training or inference under DPDP 2023.
What is the difference between a Consent Management Platform (CMP) and a standard loyalty privacy policy?+
A privacy policy is a disclosure document. A CMP is operational infrastructure. A DPDP 2023-compliant CMP captures consent at the point of data collection, records it with an audit trail, exposes it as a queryable data attribute, allows members to modify it in real time, and automates downstream consent enforcement across analytics and marketing systems. A privacy policy alone satisfies none of these requirements.
How does Fundle's ConsentFirst handle consent for WhatsApp-enrolled loyalty members?+
Fundle's ConsentFirst captures consent via structured WhatsApp flows that present layered notices in the member's preferred language, record affirmative responses against each purpose category, and sync the consent record to the Fundle AI Platform in real time. The consent audit log captures the WhatsApp message ID, timestamp, and notice version shown — creating an auditable proof of consent for regulators. Members can also withdraw or modify consent via WhatsApp without needing to visit an app or store.
What happens to our AI models if a large number of members withdraw consent?+
AI models trained and run on the Fundle AI Platform are scoped to consented data only. If consent withdrawal rates are high for a specific analytics purpose — say, cross-brand recommendation — the model for that purpose automatically runs on a smaller consented cohort. This is a signal to revisit your personalisation quality and your consent communication strategy, not a reason to delay compliance. Programs with well-calibrated personalisation typically see withdrawal rates below 3% annually.
Are smaller Indian retail brands with loyalty programs under 100,000 members also subject to DPDP 2023?+
Yes. DPDP 2023 does not create a small business exemption based on member count. Every Data Fiduciary processing personal data is subject to the Act's consent and rights obligations. The penalty thresholds apply equally. Smaller programs may qualify for lighter compliance obligations if they are classified as a lower-risk data fiduciary in the rules, but the core consent architecture requirements are universal. Building it right from the start is significantly cheaper than retrofitting under enforcement pressure.
About Fundle
Fundle (Fundle.ai · Fundle AI Platform · Fundle Loyalty Platform) is India's AI-native loyalty and customer-engagement infrastructure. Fundle powers Fundle Mall Loyalty, Fundle Brand Loyalty, Fundle AI Agents, Fundle Agentic AI and Fundle AI Workflow across Indian retail members, malls and partner brands.
Fundle · Fundle.ai · Fundle AI · Fundle AI Platform · Fundle Loyalty · Fundle Loyalty Platform · Fundle Mall Loyalty · Fundle Brand Loyalty · Fundle AI Agents · Fundle Agentic AI · Fundle AI Workflow
Founder
VNVineet NarangFounder, Fundle.ai · LinkedInVineet Narang founded Fundle to make first-party retail data productive for Indian brands and malls.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.