Mall Loyalty Program Management: Data Security Best Practices

Risks Associated with Customer Data in Loyalty Programs

The risk surface of a mall loyalty program is wider than most operators appreciate. Start with the data taxonomy alone: a typical program collects name, mobile number, email, date of birth, home PIN code, purchase history by tenant and category, visit frequency, redeemed offers, and increasingly, app-level location data and browsing behaviour. When you add tenant brand integrations — say, Tanishq sharing jewellery purchase values, Lenskart sharing prescription data, or Apollo Pharmacy sharing health product purchases — the sensitivity of the aggregate profile escalates sharply. Health-adjacent and financial purchase data attract higher scrutiny under DPDP 2023 as potentially sensitive inferences, even if not classified as Sensitive Personal Data in isolation.

The threat vectors fall into four buckets. First, external breaches: SQL injection, credential stuffing, and API abuse targeting loyalty portals that often run on shared hosting or underpowered cloud infrastructure. India saw a 52% year-on-year rise in retail sector cyberattacks in 2023 (CERT-In data). Loyalty portals are attractive targets because they aggregate high-quality PII across hundreds of thousands of records with a single authentication layer. Second, insider threats: mall IT staff, tenant brand CRM teams, and third-party campaign agencies all typically have broader data access than they need. Role-based access control is still the exception rather than the rule in Indian mall tech stacks. Third, vendor chain exposure: SMS gateway providers, WhatsApp Business API partners, push notification platforms, and analytics tools each represent a node where data can leak. Fourth, consent gaps: collecting data without documented, granular consent is itself a legal risk, not just an ethical one — and it is the most common gap Fundle's implementation audits uncover.

The commercial consequences are not abstract. When Domino's India suffered a breach in 2021 exposing 180 million order records, the reputational damage persisted for quarters. A mall loyalty breach would expose not one brand but every tenant whose member data flowed through the central program — creating multi-party liability that no standard indemnity clause fully covers. For malls like Select CITYWALK or Phoenix Marketcity that have built genuine loyalty equity with lakhs of Delhi and Mumbai shoppers, that reputational asset is far more valuable than the marketing budget that created it.

Legal Requirements under DPDP 2023 for Mall Loyalty Programs

The Digital Personal Data Protection Act 2023 became law in August 2023 and its implementing rules are actively being finalised by the Ministry of Electronics and Information Technology. While some compliance timelines remain subject to rule notification, the core obligations are already clear and mall operators should be treating them as live requirements today, not future commitments.

Section 6 of the DPDP Act requires that consent be free, specific, informed, unconditional, and unambiguous — meaning the pre-ticked checkbox on your loyalty registration form is dead. Every purpose for which you collect data must be stated separately and consented to separately. Earning points on purchases is one purpose. Sending promotional communications is another. Sharing purchase data with tenant brands for personalised offers is a third. Each requires its own consent signal, and the member must be able to withdraw any of them independently without losing their core loyalty benefits. This 'purpose limitation + granular consent' requirement is the single biggest structural change most Indian mall loyalty programs will need to make.

Section 8 creates accountability obligations for Data Fiduciaries, including the obligation to implement 'reasonable security safeguards'. The Act does not enumerate technical standards — that will come via rules — but CERT-In's existing guidelines on information security and the IS/ISO 27001 framework are strong proxies for what 'reasonable' means in a regulatory enforcement context. Notably, Section 9 restricts processing personal data of children (under 18), which is relevant for any mall loyalty program that offers memberships to teens or runs family accounts. Verifiable parental consent is required. Many family-focused malls — including those running holiday campaigns targeting school-age children — have zero mechanism today to verify or record parental consent.

Section 17 penalties scale by severity: up to ₹250 crore for a breach caused by failure to implement adequate security measures, and up to ₹200 crore for failure to notify affected members and the Data Protection Board within prescribed timelines. For a mall with 20–50 lakh loyalty members, a single notifiable breach could trigger penalties that dwarf an entire year's loyalty program operating budget. The answer is not to collect less data — it is to collect data correctly, with documented consent, in a system architected for security from the ground up.

Implementing Consent Management with ConsentFirst CMP

Consent management is not a one-time configuration task — it is an ongoing operational discipline. The ConsentFirst CMP within the Fundle Loyalty Platform was designed specifically for the complexity of a multi-tenant mall environment: multiple brands, multiple data sharing relationships, multiple communication channels, and a member base that spans age groups, digital literacy levels, and language preferences across Hindi, Tamil, Telugu, Marathi, and English-speaking shoppers.

The architecture works in four layers. The first is consent capture: at every registration point — mall app, web portal, WhatsApp onboarding, in-mall kiosk — ConsentFirst presents purpose-specific consent in the member's preferred language, with clear plain-language descriptions of what each consent enables. There are no pre-selected options. Each consent is stored as a timestamped, immutable record linked to the member's unique loyalty ID. This is the consent receipt that protects the mall operator in any regulatory inquiry or member dispute. Fundle's ConsentFirst ensures secure and compliant data consent for over 1.33Cr+ members — at scale, with zero degradation in the registration experience.

The second layer is consent lifecycle management: members can view, modify, or withdraw any consent at any time through a self-service privacy dashboard inside the loyalty app. Withdrawal triggers automated suppression across all downstream systems — the CRM, the SMS gateway, the push notification engine, the tenant data share — within a defined SLA, typically under 24 hours. The third layer is consent propagation: when a member's consent state changes, the ConsentFirst API pushes that change to every connected system in real time, eliminating the 'consent drift' problem where a member opts out on one channel but continues to receive communications on another — a violation that can trigger DPDP complaints. The fourth layer is consent analytics: program managers get real-time dashboards showing consent rates by purpose, channel, and member segment, enabling data-driven decisions about consent UX optimisation without ever compromising member choice.

For malls running joint campaigns with tenant brands like Lifestyle, Pantaloons, or FabIndia, ConsentFirst also manages the consent trail for data shared with those brands — so both the mall and the tenant brand have documented, auditable proof of member permission. This matters enormously when a tenant brand's own DPDP audit traces data provenance back to the mall loyalty program.

Technical Security Measures Every Mall Loyalty Team Must Adopt

The DPDP Act's 'reasonable security safeguards' standard will eventually be clarified by rules, but mall loyalty operators cannot wait for regulatory certainty. The technical baseline should be set now, and it should reflect the actual threat environment — not a theoretical one.

Encryption is table stakes. All member PII — mobile numbers, email addresses, date of birth, home address — must be encrypted at rest using AES-256 or equivalent, and in transit using TLS 1.3. Many Indian loyalty programs running on platforms like GoFrugal, Wondersoft, or POSist have adequate POS-level security but weaker API-layer encryption on the loyalty middleware that connects POS to CRM. That API layer is precisely where attackers probe. Conduct a TLS and certificate audit across every integration endpoint before the next peak season.

Data minimisation is the technical principle most Indian operators struggle with culturally. The instinct is to collect everything — 'it might be useful later.' Under DPDP 2023, collecting data beyond what is necessary for the stated purpose is itself a violation. Audit your registration form: does a loyalty program genuinely need a member's date of birth, or is it only used to send a birthday offer? If so, state that purpose, obtain specific consent for it, and delete the data once the offer window has passed. Apply the same logic to purchase-level data: how many months of transactional history does your recommendation engine actually need to produce a meaningful personalised offer?

Role-based access control (RBAC) deserves a dedicated implementation sprint. In most mall loyalty operations, the campaign manager, the analyst, the IT admin, and the customer service agent all have access to the same raw member database. That is four times the insider risk surface. Implement RBAC so that campaign managers see only the segments they need for a specific campaign — never raw PII. Analysts work on anonymised or pseudonymised data extracts. Only a designated Data Protection Officer role has access to full PII, with every access event logged and auditable. This single control reduces insider risk dramatically and is straightforward to implement on any modern loyalty platform.

Finally, implement real-time anomaly detection. Set up alerts for unusual data export volumes (any export of more than 10,000 member records outside a scheduled report cycle should trigger a review), failed authentication spikes on your loyalty portal (a credential-stuffing signal), and API calls from unexpected IP ranges. Your cloud infrastructure — whether AWS, Azure, or GCP — has native tooling for this. Use it.

Fostering Shopper Trust through Transparent Policies

Technical controls and legal compliance create the floor — but trust is what creates a loyalty program worth having. Indian shoppers are increasingly sophisticated about data. The penetration of smartphones, the experience of pandemic-era digital services, and growing media coverage of data breaches have produced a consumer base that notices when something feels 'off' about how their data is being used. An unsolicited WhatsApp from a brand they have never explicitly engaged with, a birthday offer that references a purchase they made at a different mall, a call from a jewellery brand with purchase-level detail they never shared — these moments destroy trust faster than any points multiplier can rebuild it.

Transparency operationalised means three things at the program level. First, proactive communication: tell members what data you hold about them, what you do with it, and who you share it with — not just in a privacy policy PDF that 0.3% of them will ever read, but in plain-language, in-app summaries updated whenever your data practices change. Brands like Cafe Coffee Day have run 'Your Data, Your Choice' campaigns that drove significant consent opt-in rates precisely because they made the communication feel like a benefit, not a legal notice. Second, genuine control: the self-service consent dashboard is not just a compliance feature — it is a trust signal. When a member can see, in real time, that they opted out of third-party brand data sharing and that it actually took effect, your credibility as a data custodian goes up. Third, accountability signalling: publish your Data Protection Officer's contact details prominently in your app. Display your DPDP compliance status. If you have achieved ISO 27001 certification, surface it. These signals cost almost nothing to communicate and carry disproportionate trust weight with high-value members.

For mall loyalty programs specifically, the multi-brand environment creates a unique trust architecture challenge: members need to trust not just the mall operator, but every tenant brand that receives their data. The Fundle Mall Loyalty platform addresses this through transparent, member-visible data sharing logs — members can see exactly which tenant brands have accessed their profile data, for what stated purpose, and on what date. This level of transparency is unprecedented in Indian mall loyalty and is a direct competitive advantage in member acquisition and retention. Programs that implement this level of transparency consistently see higher opt-in rates for data sharing with tenant brands, not lower — because members who understand and control the exchange are far more willing to participate in it than members who feel surveilled.

Vineet Narang's foundational vision for Fundle was that loyalty and privacy are not trade-offs — they are the same proposition. A member who trusts you with their data will share more of it, engage more deeply, and advocate more actively than a member whose data you extracted without genuine permission. The Fundle AI Platform, through Fundle AI Agents and the ConsentFirst CMP, turns that vision into a measurable operational reality — with consent rates, trust NPS scores, and data-sharing opt-in metrics that mall operators can take to their board alongside redemption and revenue numbers.