“Fundle exists because Indian retail deserves consumer engagement infrastructure built for India — WhatsApp-native, POS-aware, DPDP-ready from day one.”
- •Understand exactly what DPDP 2023 demands from mall loyalty program operators in India
- •Quantify the financial and reputational risk of non-compliance for Phoenix, Select CITYWALK-type operators
- •Map how ConsentFirst CMP integrates consent capture into every loyalty touchpoint
- •Adopt a five-step playbook to retrofit existing loyalty databases for DPDP readiness
- •Track six KPIs that prove your consent architecture is working before a regulator asks
India's Digital Personal Data Protection Act 2023 — passed in August 2023 and moving steadily toward full enforcement through its rules currently in final gazette notification — is not a compliance checkbox exercise. For operators running loyalty programs for shopping malls India-wide, it is a structural reset of how you collect, store, process and communicate with your members. The fines alone — up to ₹250 crore per data breach, ₹200 crore for failing to notify the Data Protection Board — dwarf the annual technology budgets of most mall operators.
Consider the scale of exposure. A Tier-1 mall like Phoenix Marketcity Mumbai or Select CITYWALK Delhi might carry 8–12 lakh active loyalty members in its CRM. A pan-India operator with five or more properties can hold 40–60 lakh member records, each containing mobile numbers, email IDs, purchase histories, visit frequencies and demographic clusters built from third-party appends. Under the old regime — a boilerplate terms-and-conditions checkbox at sign-up — that data was legally defensible. Under DPDP 2023, it almost certainly is not.
The Act introduces four foundational obligations that cut directly across standard mall loyalty architectures: (1) free, specific, informed and unambiguous consent for every distinct processing purpose; (2) the right of the data principal to withdraw consent as easily as it was given; (3) mandatory data-minimisation — you cannot collect what you cannot justify; and (4) a verifiable audit trail of consent events that must be producible on demand by the Data Protection Board. Legacy CRM platforms, whether homegrown or from vendors like Capillary, EasyRewardz or MoEngage, were not architected around these obligations. Bolting on compliance after the fact is possible, but it requires an integration layer purpose-built for Indian regulatory requirements.
This is the gap that Fundle — India's AI-first loyalty and customer engagement platform — was designed to close. Fundle's ConsentFirst architecture treats consent not as a legal footnote but as a first-class data object that travels with every member profile, governs every campaign trigger and is reportable in real time. For mall marketing heads who need to protect their programs and their properties, the path forward starts with understanding what DPDP 2023 actually requires — and then building loyalty infrastructure that makes compliance automatic rather than effortful.
DPDP 2023 and Mall Loyalty: The Numbers That Matter
Introduction to DPDP 2023 Compliance for Mall Operators
The Digital Personal Data Protection Act 2023 arrives at an uncomfortable moment for Indian mall loyalty program management. The post-pandemic recovery drove a surge in loyalty enrolments — Phoenix Mills reported crossing 1 crore loyalty registrations across its portfolio by mid-2023, and Prestige Group's mall arm accelerated its own CRM push. Simultaneously, the Act demands that all of this newly acquired data be held to a standard that most current systems cannot meet without significant re-engineering.
The Act's key definitions matter here. A 'data fiduciary' — the mall operator — is liable for every processing decision. A 'data processor' — your SMS gateway, your email ESP, your analytics vendor — must be governed by a contract that flows DPDP obligations downstream. This means that when a mall's loyalty platform fires a WhatsApp campaign via a third-party vendor, the mall itself is accountable for whether that member consented to WhatsApp as a communication channel, and for marketing specifically, not just operational notifications. The distinction between 'transactional' and 'promotional' communication is explicitly load-bearing under the Act.
For mall loyalty programs specifically, the consent surface area is enormous. A member might interact at the welcome kiosk, the mall app, the brand partner's POS (say, a Tanishq or Lifestyle store inside the mall), the parking management system, the food court aggregator or a Cafe Coffee Day digital order screen. Each touchpoint can generate personal data. Each processing purpose — points accrual, partner data sharing, behavioural analytics, re-targeting — requires its own consent declaration. Collecting one consent at sign-up and recycling it across all purposes is precisely the pattern DPDP 2023 prohibits.
Compliance also has a second-order effect on brand partner relationships. When a mall shares member data with Manyavar, FabIndia or Reliance Trends for co-branded campaign activation — a standard revenue stream for loyalty programs — both parties become co-fiduciaries of that data. Without a consent framework that records which members consented to which brand-partner data shares, both the mall and the brand are exposed. Mall marketing heads who have not yet addressed this contractual and technical dimension are carrying undisclosed liability on their balance sheets today.
DPDP Consent Funnel: From Enrolment to Campaign-Ready Member
Why Data Privacy Matters in Mall Loyalty Programs
Retail loyalty in India has historically operated on an implicit social contract: members hand over their data in exchange for points and discounts, largely unaware of how that data flows downstream. That contract is now being rewritten by regulation, and simultaneously by a generational shift in consumer expectations. The Edelman Trust Barometer India 2023 found that 61% of urban Indian consumers aged 25–40 actively research a brand's data practices before sharing personal information. For mall operators targeting the same demographic that drives discretionary spend in apparel, electronics and fine dining, this is not an abstract concern.
The commercial stakes are concrete. A mall loyalty database of 10 lakh members, where 35% have not given verifiable, purpose-specific consent under DPDP standards, represents approximately 3.5 lakh members who must be suppressed from marketing campaigns immediately upon enforcement. At an average revenue-per-engaged-member of ₹200 per month — a realistic benchmark for a mid-to-large Indian mall — that is ₹7 crore per month in potentially unreachable revenue, not from losing members, but simply from the inability to communicate with them legally.
The risk is compounded by the Act's 'ease of withdrawal' provision. Under DPDP 2023, a member must be able to withdraw any consent with the same ease with which it was given. If your loyalty app requires three screen-taps to earn points but seven to withdraw marketing consent, the asymmetry itself is a violation. This design requirement forces a fundamental rethink of loyalty UX — one that most platforms built before 2022 were never designed to accommodate. Vendors like EasyRewardz and Capillary offer consent modules, but they were retrofitted rather than native, and the audit-trail depth they provide has not been independently validated against the Act's evidentiary requirements.
Mall operators also face a structural complexity that pure-play e-commerce brands do not: the multi-brand, multi-touchpoint environment. When a member earns points at an Apollo Pharmacy outlet inside the mall, does the pharmacy's own CRM system also receive that transaction data? If yes, which entity captured consent for that specific data share? The absence of a shared consent ledger between the mall and its brand tenants is a gap that DPDP 2023 closes — not gently, but with significant penalty authority behind it. Addressing this now, before enforcement begins, is the only cost-effective path.
Legacy Consent Approach vs. ConsentFirst CMP for Mall Loyalty
How ConsentFirst Ensures DPDP Compliance for Malls
Fundle's ConsentFirst is India's first DPDP-compliant Consent Management Platform fully integrated with loyalty. That integration is the operative phrase. Most CMPs in the Indian market — including global tools adapted for DPDP — sit as a separate layer, communicating with the loyalty engine via periodic batch syncs. This creates a window of non-compliance: a member withdraws consent at 10 AM, but the batch sync runs at midnight, meaning the member receives a campaign communication at 2 PM that day. Under DPDP 2023, that is a violation regardless of the technical explanation.
ConsentFirst solves this with a real-time consent event bus. Every consent action — grant, withdrawal, purpose modification, channel preference change — fires an event that propagates synchronously to the Fundle Loyalty Platform's campaign engine, the member profile store and every connected brand partner API. The campaign eligibility check runs against live consent state, not a cached snapshot. This is not a product marketing claim; it is an architectural requirement for true DPDP compliance, and it is the standard the Fundle AI Platform was built to meet from the ground up.
The ConsentFirst module also handles the 'notice' requirement under DPDP 2023 — the obligation to provide clear, plain-language notice of data processing before or at the point of consent collection. Fundle Mall Loyalty's enrolment flows are templated with DPDP-compliant notice language that can be customised per property and per language (Hindi, Tamil, Telugu, Kannada, Marathi and six other scheduled languages), addressing the Act's requirement that notice be provided in a language the data principal understands. For a mall in Chennai or Pune, this is not optional.
For brand-tenant data sharing — the highest-risk surface for most mall operators — ConsentFirst implements a shared consent ledger architecture. When a member shops at a Lifestyle store inside the mall and the mall's loyalty program attributes points for that visit, ConsentFirst records exactly what data was shared with Lifestyle's systems, under which consent grant, at what timestamp. The mall operator can produce this audit log to any regulator or auditor within minutes. This capability alone reduces the legal exposure of co-branded loyalty partnerships from open-ended liability to a managed, documented risk.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.
Five-Step Playbook: Retrofitting Your Mall Loyalty Program for DPDP 2023
Consent Audit and Data Mapping
Before changing anything, map every data collection point — app enrolment, POS kiosk, parking system, Wi-Fi login, brand partner POS — and document what personal data is collected, for which processing purpose, under what current consent mechanism. Quantify your non-compliant member population. Most Tier-1 Indian malls will find 25–45% of existing records require fresh consent under DPDP standards.
Purpose and Channel Consent Architecture
Define your processing purpose taxonomy: points accrual, personalised offers, partner data sharing, third-party re-targeting, analytics profiling. Map each channel (SMS, WhatsApp, Email, Push, in-mall digital screens) to its own consent flag. This architecture becomes the schema for ConsentFirst's consent object, which travels with every member record.
Re-Consent Campaign for Existing Members
Deploy a staged re-consent communication sequence to your existing base. Lead with value: explain what members gain by consenting to each purpose. Segment by engagement tier — your top 20% of members (the cohort driving 60–70% of revenue in a typical Indian mall loyalty program) should receive a white-glove re-consent journey via the app, not a bulk SMS blast. Expect 55–70% re-consent rates among active members within 90 days if the value proposition is clearly articulated.
Partner Contract and Consent Flow Alignment
Renegotiate data-sharing clauses with every brand tenant receiving member data — Tanishq, Pantaloons, Manyavar, Apollo Pharmacy, FabIndia and any F&B aggregator integrated with your program. Contracts must specify: what data fields are shared, under which member consent, and the tenant's obligations as a downstream data processor. Fundle's shared consent ledger provides the technical infrastructure; legal alignment must happen in parallel.
Ongoing Consent Monitoring and KPI Reporting
DPDP compliance is not a one-time project. Establish a monthly consent health dashboard tracking: consent coverage rate, consent withdrawal rate, campaign suppression rate, notice delivery confirmation rate and audit log completeness. Integrate these KPIs into your marketing head's monthly review alongside standard loyalty metrics. Use Fundle AI Agents to flag anomalies — sudden spikes in withdrawal rates, for example, often signal a UX problem or a communication that felt intrusive.
Implications for Marketing Heads and Loyalty Managers
For the marketing head at a mid-to-large Indian mall, DPDP 2023 creates a new accountability structure that does not exist anywhere else in your current job description. You are now, effectively, a co-steward of data governance alongside your CTO and legal counsel. The Act assigns liability to the data fiduciary — the mall entity — not to the technology vendor, not to the loyalty program manager as an individual, but to the organisation. That said, the marketing head who built the program and specified the data architecture bears internal accountability if non-compliance is discovered.
The practical implication is that every campaign brief must now include a consent eligibility check as a mandatory pre-flight step. Before the Diwali mega-offer campaign goes out to 8 lakh members, the campaign manager must be able to confirm: how many of those members have valid, unrevoked consent for promotional SMS? How many for WhatsApp? How many for partner offer activation involving, say, Reliance Trends? This is not onerous if the loyalty platform is built correctly — it is a filter, not a manual review. But it requires that the consent architecture be in place and current.
Loyalty program managers face a more tactical challenge: protecting engagement metrics during the re-consent transition. Historical open rates and redemption rates will dip when you suppress non-consented members. The instinct is to delay compliance to protect short-term numbers. This is the wrong trade. A mall loyalty program that runs a clean, consented database of 6 lakh members will outperform on revenue per member against a nominally larger but consent-questionable database of 10 lakh, because every communication reaches someone who has explicitly said they want to hear from you. Relevance, not reach, is the correct metric for the DPDP era.
There is also a competitive differentiation angle that forward-thinking mall marketing heads are beginning to recognise. In a market where most loyalty programs are still operating under legacy consent norms, being the first to proactively communicate your DPDP compliance posture to members is a trust-building move. Malls that run transparent, consent-first programs — where members can see and control their own data in the app — report meaningfully higher NPS scores among their top-tier member segments. This is an earned advantage, and it is available right now to operators who move first.
- Completed a full data-mapping exercise covering every personal-data collection point in the mall ecosystem, including third-party brand tenant POS integrations
- Defined a written processing-purpose taxonomy and mapped each purpose to a specific, separately-captured consent flag in the loyalty CRM
- Deployed DPDP-compliant notice language — available in all relevant regional languages — at every enrolment touchpoint (app, kiosk, Wi-Fi, partner store)
- Implemented a real-time consent withdrawal mechanism in the member app or portal with confirmed propagation to all downstream campaign queues within minutes, not hours
- Renegotiated brand-tenant data-sharing contracts to explicitly name processing purposes, data fields shared, and the tenant's downstream obligations as a data processor
- Established an immutable, timestamped consent audit log that can be exported on demand and presented to the Data Protection Board in the format specified under DPDP rules
- Integrated consent health KPIs — coverage rate, withdrawal rate, suppression rate — into the standard monthly marketing and loyalty program management review cadence
“In India, consent is not a legal footnote — it is the new currency of loyalty. The programs that earn explicit trust will outgrow the ones that assumed it.”
How Fundle solves this
Fundle was built on a foundational premise that most loyalty vendors arrived at too late: that data privacy and personalisation are not in tension — they are the same problem, solved together or not at all. The Fundle AI Platform's architecture places the consent object at the centre of the member profile, not at the periphery. Every Fundle Loyalty deployment — whether Fundle Mall Loyalty for a Phoenix or DLF-type operator, or Fundle Brand Loyalty for a standalone retail chain — ships with ConsentFirst as a native, non-optional component. Compliance is not a module you purchase separately; it is the foundation everything else runs on.
Fundle AI Agents add an active compliance intelligence layer on top of this architecture. These agents continuously monitor consent health across the member base — flagging members approaching consent expiry windows, detecting unusual withdrawal spikes that may indicate a problematic campaign, and automatically triggering re-consent journeys for dormant members whose original consent predates DPDP enforcement. The Fundle Agentic AI layer means that mall marketing teams are not manually policing a consent database; the system surfaces exceptions and recommends actions, and the human manager approves or overrides. This is the correct division of labour for a compliance function that must operate at the speed of a live loyalty program.
Fundle AI Workflow handles the multi-party complexity that is unique to mall loyalty environments. When a campaign involves the mall's own communication channels plus three brand-tenant co-sponsors, the Fundle AI Workflow engine checks consent eligibility across all four parties' requirements before a single message is dispatched. If a member has consented to mall promotions but not to Manyavar's data-sharing clause, the workflow automatically serves a version of the campaign that excludes the Manyavar co-brand element for that member — rather than suppressing the member entirely or violating their consent. This nuanced, purpose-matched campaign delivery is what separates a purpose-built compliance architecture from a retrofitted one.
Vineet Narang's vision for Fundle has always been that Indian mall operators deserve a loyalty platform built for Indian regulatory, linguistic and consumer realities — not a Western platform adapted at the edges. DPDP 2023 is the clearest validation of that thesis yet. The malls that invest in consent-first infrastructure today — with Fundle Mall Loyalty and ConsentFirst at the core — will enter the enforcement era with clean data, trusted member relationships and a competitive moat that cannot be easily replicated by operators who wait.
Frequently asked
What does DPDP 2023 specifically require from a mall loyalty program's consent mechanism?+
The Act requires that consent be free, specific, informed and unambiguous for each distinct processing purpose. A single blanket consent at enrolment is insufficient. Malls must capture separate consent for points accrual, promotional communications, partner data sharing and analytics profiling. Each consent must be revocable by the member as easily as it was granted, and the mall must maintain a verifiable audit trail of every consent event.
What is ConsentFirst CMP and how does it differ from a standard CRM consent module?+
Fundle's ConsentFirst is India's first DPDP-compliant Consent Management Platform fully integrated with loyalty. Unlike bolt-on consent modules in legacy CRMs, ConsentFirst uses a real-time event bus so that consent changes propagate synchronously to all campaign queues and partner APIs within minutes. It also provides a DPB-ready audit log, multi-language notice delivery and a self-serve member consent portal — capabilities that retrofitted modules do not reliably offer.
How should a mall handle existing loyalty members whose consent does not meet DPDP standards?+
Existing members whose consent records do not meet DPDP standards must be suppressed from marketing communications until fresh, compliant consent is obtained. The recommended approach is a staged re-consent campaign led by value communication — explaining what members gain by updating their preferences. Active members in the top engagement tier typically re-consent at 55–70% rates within 90 days when approached through the loyalty app with a clear value narrative.
Are brand tenants inside the mall also liable under DPDP when member data is shared with them?+
Yes. When a mall shares member data with a brand tenant — such as Tanishq, Pantaloons or Apollo Pharmacy — the tenant becomes a data processor, and potentially a co-fiduciary, depending on how they use the data. Both parties need contractual clarity on processing purposes, data fields shared and downstream obligations. Fundle's shared consent ledger provides the technical record of which members consented to which brand-sharing events, supporting both parties' compliance posture.
Will DPDP compliance reduce campaign reach and hurt loyalty program revenue?+
Short-term suppression of non-consented members will reduce reachable audience size. However, programs operating on a clean, consented database consistently outperform on revenue-per-active-member because communications reach genuinely opted-in members with higher engagement propensity. The correct benchmark is not gross reach but revenue from the consented pool. Most operators who have run this transition find that top-tier member revenue is largely preserved, while mid and low-tier re-consent campaigns recover engagement within one to two quarters.
How long does it take to implement ConsentFirst on an existing mall loyalty program?+
For a Tier-1 mall with an existing loyalty database, a full ConsentFirst implementation — including data mapping, consent schema design, enrolment flow updates, partner API connections and audit log activation — typically takes eight to twelve weeks. Fundle's implementation team has pre-built connectors for common Indian POS and CRM environments including POSist, GoFrugal, Petpooja and Wondersoft, which significantly reduces integration time for multi-tenant mall deployments.
About Fundle
Fundle (Fundle.ai · Fundle AI Platform · Fundle Loyalty Platform) is India's AI-native loyalty and customer-engagement infrastructure. Fundle powers Fundle Mall Loyalty, Fundle Brand Loyalty, Fundle AI Agents, Fundle Agentic AI and Fundle AI Workflow across Indian retail members, malls and partner brands.
Fundle · Fundle.ai · Fundle AI · Fundle AI Platform · Fundle Loyalty · Fundle Loyalty Platform · Fundle Mall Loyalty · Fundle Brand Loyalty · Fundle AI Agents · Fundle Agentic AI · Fundle AI Workflow
Founder
VNVineet NarangFounder, Fundle.ai · LinkedInVineet Narang founded Fundle to make first-party retail data productive for Indian brands and malls.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.