DPDP Compliant Loyalty CRM: What Indian Retailers Must Do Now

Key DPDP Provisions Affecting Loyalty Programs

The DPDP Act, 2023 introduces eight rights for Data Principals (your customers) and a parallel set of obligations for Data Fiduciaries (your brand). For a loyalty programme manager, four provisions carry direct operational weight.

First, the consent obligation under Section 6 requires that personal data be processed only with free, specific, informed, unconditional, and unambiguous consent. The critical word is 'specific' — a blanket opt-in at membership signup that says 'I agree to receive communications' does not satisfy the standard if your programme then uses that data for profiling, cross-brand sharing within a mall ecosystem, or third-party data enrichment. Each purpose needs its own consent capture. If your POS integration with POSist, Petpooja, or Wondersoft is currently firing a single opt-in at the billing screen, it almost certainly needs re-engineering.

Second, the right to withdraw consent (Section 6(4)) must be as easy as the act of giving consent. If a Pantaloons loyalty member signed up in-store and now wants to withdraw consent for birthday marketing specifically but not transactional updates, your CRM must support granular consent withdrawal — not just a binary unsubscribe. This is where most legacy platforms built on Capillary's stack or EasyRewardz's earlier architecture struggle: consent is stored as a flat boolean, not as a structured, purpose-indexed record.

Third, data minimisation and purpose limitation under Sections 7 and 8 mean that you cannot retain transactional data 'just in case' it becomes useful for an AI model later. Retention must be tied to a declared purpose with a defined retention period. Loyalty platforms that store seven years of SKU-level transaction history without a documented retention policy are now a liability. GoFrugal and POSist integrations typically push raw transaction data into CRM tables with no TTL (time-to-live) logic — that needs to change.

Fourth, the right to erasure (Section 12) gives customers the right to have their data deleted when consent is withdrawn or the purpose has been fulfilled. For a mall loyalty programme managing 5 lakh members across Phoenix Marketcity properties, this requires an automated erasure pipeline that propagates deletion requests across the CRM, the POS integration layer, the campaign engine, and any third-party analytics or CDP tools in the stack. This is not a 'delete from the main table' operation — it is a system-wide data governance capability that most mid-market loyalty stacks in India simply do not have today.

Data Storage, Usage, and Consent Management in Practice

Understanding the law is the first step. Operationalising it across a multi-store, multi-brand retail environment is where the real work begins. Consider a practical scenario: a mid-size apparel chain — think Reliance Trends with 3,000+ stores — running a loyalty programme on a centralised CRM. Data flows in from POS terminals (GoFrugal or Wondersoft integrations), from a branded app, from WhatsApp opt-in campaigns run via a BSP partner, and from periodic in-store data capture drives. Each of these flows generates personal data. Under DPDP, each flow needs a documented lawful basis, and the consent record must be stored in a way that is queryable, auditable, and erasure-ready.

The consent management layer — often called a Consent Management Platform or CMP — is the infrastructure piece that most Indian retail loyalty stacks are missing. A CMP does four things: it captures consent at the point of interaction with the required purpose granularity; it stores the consent record with a timestamp, channel identifier, and version of the consent language shown; it propagates consent status to downstream systems (campaign engine, CDP, analytics) in near real-time; and it processes withdrawal requests end-to-end within the 72-hour window that DPDP's implementing rules are expected to specify.

Data localisation is a related pressure point. While the DPDP Act's cross-border transfer provisions are still being finalised through delegated legislation, the direction of travel is clear: sensitive personal data — which can include financial transaction history and health-adjacent data (relevant for Apollo Pharmacy's loyalty stack) — faces restrictions. Retail brands using AWS Mumbai or Azure India regions for their CRM are largely positioned correctly, but those on global SaaS platforms with US-primary data residency (a common configuration for brands using Salesforce Marketing Cloud or Adobe Campaign) face remediation work.

Usage limitation is the subtler compliance challenge. Brands like FabIndia and Cafe Coffee Day have historically used loyalty transaction data to train recommendation models, build lookalike audiences on Meta, and enrich profiles through third-party data partners. Under DPDP, each of these secondary uses requires either explicit consent for that specific purpose or a separate lawful basis. The practical implication: your AI personalisation engine cannot be trained on data for which only transactional consent exists. This forces a re-architecture of how loyalty data feeds into AI models — a challenge that platforms like MoEngage and WebEngage are still working through, and one that purpose-built AI-native loyalty platforms have a structural advantage in solving.

Risks of Non-Compliance for Retailers

The DPDP Act's penalty regime is not structured like earlier Indian data protection frameworks, which were largely unenforceable in practice. The new regime empowers a Data Protection Board of India with adjudicatory powers and a penalty schedule that escalates by violation category. For a retail brand running a loyalty programme, the relevant exposure tiers are: up to ₹50 crore for failure to notify the Board of a personal data breach; up to ₹200 crore for failure to implement adequate security safeguards; and up to ₹250 crore for processing children's data without parental consent or for processing data in violation of consent conditions. The last category is the one that most loyalty teams underestimate — if you are sending birthday offers to members who consented only to transactional updates, that is a consent violation at scale.

Beyond financial penalties, the reputational risk for consumer-facing retail brands is arguably more damaging. Indian consumers are becoming meaningfully more aware of their data rights — TRAI's regulations on commercial communications, the widespread use of DND registrations, and high-profile data breach disclosures have collectively raised the baseline of consumer suspicion. A loyalty programme that becomes associated with a DPDP violation will see member churn, negative press, and a trust deficit that takes years to rebuild. For mall operators like Phoenix Marketcity or Select CITYWALK, a compliance failure by one anchor tenant can contaminate consumer trust in the entire mall loyalty ecosystem.

Operational risk is the third dimension. When enforcement begins and the Board starts issuing compliance notices, brands that cannot produce a consent audit trail will face the highest scrutiny. The burden of proof under DPDP sits with the Data Fiduciary — you must demonstrate that consent was valid, not merely assert it. Brands running loyalty on platforms like Capillary or Antavo, where consent management is a configuration option rather than a core architecture, will struggle to produce the granular evidence that the Board is likely to demand.

For loyalty programme managers reading this, the practical risk is also internal: a compliance gap discovered during a Board investigation typically triggers an emergency data cleansing exercise that can wipe out 40-60% of a programme's active member base — members for whom no valid consent can be demonstrated. Losing half your loyalty database overnight is a business continuity event, not just a compliance inconvenience. Brands like Xeno and Customer Capital are beginning to build consent audit features, but the architecture is still maturing. The programmes that will survive the enforcement era are those that start re-consenting their member base now, before it becomes mandatory.

KPIs to Track DPDP Compliance and Loyalty Programme Health

Compliance is not a binary state — it is a continuous operational discipline that needs to be measured with the same rigour as campaign performance metrics. For a retail loyalty programme manager, this means adding a new layer of privacy-health KPIs alongside the standard engagement metrics.

The primary compliance KPI is consent coverage rate: the percentage of your active loyalty member base for which you hold at least one valid, purpose-specific, DPDP-compliant consent record. At programme launch post-remediation, target 70%+. Anything below 50% means your marketing operations are running on legally exposed ground. Track this weekly and by acquisition channel — app-acquired members typically have higher consent quality than POS-enrolled members, whose consent capture has historically been weakest.

The second KPI is consent withdrawal rate, segmented by purpose. A high withdrawal rate for 'personalisation and profiling' but a low rate for 'transactional updates' is signal, not noise: it tells you that your members value utility communications but distrust AI-driven targeting. That is actionable intelligence for your programme design team. If you are running on a platform like Almonds.ai or a custom stack on MoEngage, check whether these withdrawal rates are reportable out of the box — most are not without custom configuration.

Third, track erasure request volume and resolution time. The DPDP Act will specify a response timeline in its rules — current drafts suggest 30 days for general requests and 72 hours for breach-adjacent situations. Your average resolution time should be benchmarked against this. A spike in erasure requests often signals a trust event — a data breach notification, negative press, or an aggressive third-party data-sharing practice that members have noticed.

Fourth, track your lawfully engageable base as a proportion of total members. This is your true reachable audience under DPDP — the number that determines your actual marketing capacity. If your Pantaloons loyalty programme has 20 lakh enrolled members but only 9 lakh with valid DPDP-compliant consent across marketing purposes, your effective marketing reach is 9 lakh. Plan campaign economics accordingly: cost-per-engagement and ROAS calculations must use the lawfully engageable base as the denominator, not total enrolment.

How Fundle solves this

Vineet Narang's vision when founding Fundle was explicit: build the loyalty and engagement infrastructure that Indian retail actually needs — not a Western platform retrofitted for the subcontinent, but a system designed from the ground up for India's regulatory environment, POS ecosystem, and consumer behaviour. That vision is now most visibly expressed in the Fundle AI Platform's approach to data privacy, which treats consent not as a compliance module bolted onto a campaign engine, but as the foundational data layer that every AI-driven engagement decision must reference before executing.

At the centre of this architecture is Fundle's ConsentFirst CMP — a purpose-built consent management layer embedded within the Fundle Loyalty Platform. Fundle's ConsentFirst CMP ensures that loyalty marketing complies with India's stringent DPDP regulations by capturing granular, purpose-indexed consent at every member touchpoint, storing each record with full provenance in an immutable audit log, and propagating consent status to every downstream system — campaign engine, AI personalisation layer, analytics, and POS integration — in real time. When a Select CITYWALK loyalty member withdraws consent for personalisation, every Fundle AI Agent that might have triggered a recommendation-based offer is suppressed automatically within minutes, not after a manual reconciliation cycle that runs overnight.

The Fundle Mall Loyalty and Fundle Brand Loyalty products are both built on this consent-first substrate, which means multi-brand mall operators and standalone retail chains inherit DPDP compliance architecture as a platform capability rather than a bespoke implementation project. For mall operators running Phoenix Marketcity-style multi-tenant loyalty programmes, where data sharing between the mall entity and individual brand tenants is a core programme mechanic, the Fundle AI Platform provides a consent-gated data-sharing layer: brand-tenant data access is granted only for member segments where cross-brand sharing consent has been explicitly captured. This is architecturally distinct from what platforms like Capillary or Antavo offer today, where cross-brand data access is typically a configuration-level permission toggle rather than a member-driven consent gate.

Fundle AI Agents and Fundle Agentic AI take this further into the execution layer. Every AI-driven trigger — a churn-risk win-back, a tier upgrade nudge, a birthday offer, an abandoned cart recovery — is evaluated against the member's current consent record before the Fundle AI Workflow dispatches it. If the required consent is absent or has been withdrawn, the workflow routes to a re-consent touchpoint rather than suppressing silently. This transforms DPDP compliance from a passive suppression exercise into an active consent-building loop — a design philosophy that converts regulatory compliance into programme growth. For the retail marketing head evaluating CRM platforms in 2025, this is the question to ask any vendor: is your consent architecture a suppression list, or is it a growth engine?