“The Indian loyalty market doesn't need another rules engine. It needs an outcomes engine. That's where Fundle differs from every alternative on the market.”
- •Understand how DPDP 2023 fundamentally changes consent obligations for every automated loyalty workflow in Indian retail
- •Audit your current loyalty stack — POS integrations, SMS triggers, WhatsApp journeys — for consent gaps before the penalty clock starts
- •Implement a ConsentFirst architecture that captures, stores, and propagates consent signals across every channel and touchpoint
- •Quantify the real cost of non-compliance: penalties up to ₹250 crore per breach under DPDP 2023
- •Adopt Fundle AI Platform's native DPDP controls to automate compliance without slowing down campaign velocity
Indian retail is sitting on a ticking compliance clock. The Digital Personal Data Protection Act 2023 — DPDP 2023 — received Presidential assent in August 2023 and its rules are expected to be fully notified in 2025. For loyalty heads at malls like Phoenix Marketcity and Select CITYWALK, and for CRM directors at brands like Tanishq, Manyavar, Lifestyle, and Pantaloons, this is not an abstract legal event. It is an operational earthquake that runs straight through the heart of every automated loyalty campaign, every WhatsApp drip sequence, every birthday SMS, and every win-back trigger you have running today.
The core problem is this: most workflow automation for retail loyalty in India was built in a consent-light era. Loyalty enrolment forms at POS terminals — whether powered by POSist, Petpooja, GoFrugal, or Wondersoft — collected mobile numbers and emails with a checkbox that nobody read. SMS blasts went out to entire databases. WhatsApp Business API messages were fired at opted-in and non-opted-in members alike because the distinction was never operationalised at the data layer. That era is ending. DPDP 2023 requires explicit, informed, granular, and revocable consent for every category of personal data processing — and loyalty programs, by their very nature, are among the most data-intensive operations in retail.
The stakes are not hypothetical. The DPDP Act prescribes financial penalties of up to ₹250 crore for significant data breaches and up to ₹50 crore for failure to implement adequate data protection safeguards. For a mid-sized mall operator or a national retail chain running automated loyalty campaigns India-wide across 200+ stores, a single non-compliant batch campaign sent to a 5 lakh member database could trigger regulatory scrutiny. The reputational damage — in an era where Indian consumers are becoming increasingly privacy-aware — can be orders of magnitude worse than the fine itself.
The good news is that compliance and performance are not in conflict. Fundle, India's AI-first loyalty and customer engagement platform, has architected its entire workflow automation stack around a ConsentFirst principle — meaning consent capture, storage, propagation, and revocation are baked into every loyalty trigger and journey, not bolted on as an afterthought. This article is a practical guide for retail operators who want to get ahead of the regulatory curve without sacrificing the campaign velocity and personalisation that loyalty programs depend on.
DPDP 2023 and Indian Retail Loyalty: The Numbers That Matter
Overview of DPDP 2023 and Its Impact on Workflow Automation for Retail Loyalty
The Digital Personal Data Protection Act 2023 is India's most consequential data governance legislation since the IT Act of 2000. Unlike GDPR — which Indian retail operators often cite as a distant European concern — DPDP 2023 is specifically calibrated for India's digital economy. It applies to any entity processing the digital personal data of Indian citizens, regardless of where the processing happens. For a loyalty program operator, that means every data point you collect at enrolment, every behavioural signal you track across transactions, and every personalisation decision your automation engine makes is now subject to the Act's consent and data minimisation requirements.
The foundational concept under DPDP 2023 is 'consent as a lawful basis.' Unlike older frameworks that permitted processing under vague 'legitimate interests' carve-outs, DPDP requires that consent be: freely given, specific to the purpose, informed in plain language (including in the user's preferred Indian language), and unambiguously expressed. This has direct and immediate implications for loyalty marketing automation platforms in India. A single master opt-in at enrolment — 'I agree to receive marketing communications' — is no longer sufficient if your automation workflows process data for multiple distinct purposes: transaction-triggered rewards, cross-brand offers at a mall, third-party partner promotions, and behavioural retargeting.
For mall CMOs at properties like Phoenix Marketcity or DLF Promenade, the complexity multiplies because a mall loyalty program typically processes data on behalf of 100–300 individual brand tenants. Each brand's data processing activities may require separate consent notices if their use cases differ materially. A tenant running a Tanishq jewellery promotion has different data processing purposes than a food court operator running a Cafe Coffee Day cashback trigger. Your automation platform must be capable of managing consent at this level of granularity — something that generic CRM platforms like MoEngage or WebEngage, built for D2C brands, were not originally designed to handle at the mall-tenant architecture level.
The Act also introduces significant Data Principal (consumer) rights: the right to access their data, the right to correct inaccuracies, the right to erasure, and critically, the right to withdraw consent at any time. For a loyalty workflow automation system, consent withdrawal must propagate in near-real-time across every active journey, suppression list, and scheduled campaign. If a member withdraws consent at 10 AM and your batch WhatsApp campaign fires at 10:30 AM, you have a compliance failure. This is an engineering problem as much as a legal one, and it demands that compliance be embedded in the workflow engine itself, not managed as a downstream suppression exercise.
DPDP 2023 Consent Lifecycle in a Retail Loyalty Workflow
Ensuring Consent Management in Loyalty Workflows: What Good Looks Like
Most Indian loyalty operators today manage consent as a binary flag in their CRM: opted-in or opted-out. This architecture was adequate when the only channel was SMS. In 2025, a mature loyalty workflow automation stack runs across at least six channels — SMS, WhatsApp, push notifications, email, in-app messages, and in-store digital screens — each with different regulatory treatment under DPDP 2023 and the existing TRAI Telecom Commercial Communication regulations. Good consent management in this environment is not a checkbox. It is a data architecture decision.
What best-in-class looks like, operationally: consent records must be stored as immutable, timestamped events. When a member enrols at a Lifestyle store in Bengaluru's Orion Mall and consents to 'loyalty rewards communications' but does not consent to 'third-party partner offers,' that distinction must exist as a structured data attribute — not a free-text note — that your automation engine can query in real time before every workflow execution. Platforms like Capillary and EasyRewardz have begun building consent layers, but their implementations are often retroactive and require manual configuration per campaign. That is not operationally viable at scale.
The consent notice itself must meet DPDP 2023's plain-language standard. The Act specifically requires that consent requests be presented in a clear and plain manner, including the option to present them in scheduled Indian languages. For a national retail chain like Reliance Trends operating across Tamil Nadu, Maharashtra, Uttar Pradesh, and West Bengal, this means your loyalty enrolment flow must support consent notice delivery in at minimum Hindi, Tamil, Telugu, Marathi, and Bengali. This is not optional. It is a statutory requirement for reaching the 800 million-plus non-English-speaking internet users who are the primary growth segment for loyalty programs in Tier 2 and Tier 3 India.
Beyond capture, the harder problem is consent propagation. When a member updates their preferences — say, opting out of WhatsApp communications but remaining opted in for SMS — that change must flow instantaneously to every active workflow. If you are running a 7-day win-back journey on WhatsApp for lapsed Pantaloons members and a member opts out on Day 3, your system must halt the Day 4, 5, 6, and 7 messages immediately. This requires consent state to be a first-class data object in your journey orchestration engine, not a suppression list that gets refreshed nightly. The difference between these two architectures is the difference between compliance and exposure.
Consent-First vs. Legacy Opt-In: The Architecture Gap
Risks of Non-Compliance in Indian Retail Loyalty Programs
It is tempting to treat DPDP 2023 compliance as a future-state problem — something to address when the rules are fully notified and enforcement begins. This is the wrong calculus. The Act is law. Enforcement timelines in India have a history of accelerating once political will aligns, and the Data Protection Board — the Act's adjudicatory body — is being constituted with the explicit mandate to be an active regulator, not a passive one. Waiting for the first high-profile enforcement action to trigger internal urgency is a strategy that works until it catastrophically doesn't.
The financial exposure is real and material. For a mall operator running a loyalty program with 10 lakh members, a single non-compliant campaign — say, a Diwali offer blast sent to members who had not explicitly consented to promotional communications from third-party tenants — could constitute a breach affecting all 10 lakh Data Principals. Under DPDP 2023's penalty framework, breaches that affect large numbers of individuals attract penalties at the higher end of the ₹250 crore ceiling. For context, ₹250 crore is between 5–15% of annual revenue for a mid-sized mall operator. That is not a compliance budget line item. That is an existential business risk.
Beyond penalties, there is the operational disruption of a Data Protection Board investigation. The Act empowers the Board to require data fiduciaries (that's you, the loyalty program operator) to produce consent records, processing logs, and impact assessments within defined timelines. If your consent records are a patchwork of CRM flags, POS system exports, and manually maintained opt-out spreadsheets — as is the case in the overwhelming majority of Indian retail loyalty operations today — producing those records in a Board-mandated timeframe is practically impossible. The investigation itself becomes a business disruption event, pulling engineering, legal, and operations resources away from revenue-generating activities.
There is also the first-party data compounding effect. India's organised retail sector is in the middle of a critical transition: the phaseout of third-party cookies, the tightening of mobile advertising identifiers, and the rise of WhatsApp as a primary loyalty channel — all of which make first-party loyalty data more valuable than ever. But first-party data is only a sustainable asset if it is collected with proper consent. A loyalty database built on shaky consent foundations is a liability, not an asset. Platforms like Xeno and Almonds.ai offer campaign automation but do not natively solve the consent infrastructure problem, leaving their retail clients exposed.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.
5-Step DPDP Compliance Playbook for Retail Loyalty Workflow Automation
Consent Inventory Audit
Map every data collection touchpoint in your loyalty ecosystem — POS enrolment, app sign-up, WhatsApp opt-in, in-store kiosks, partner brand integrations — and document what consent was captured, when, in what language, and for what stated purpose. This audit is the baseline. Most operators discover that 40–60% of their member database has no verifiable consent record meeting DPDP 2023 standards.
Purpose Mapping and Consent Schema Design
Define every distinct data processing purpose in your loyalty program: transaction-based rewards, personalised offers, cross-brand promotions, partner data sharing, behavioural analytics. For each purpose, design a consent schema — what you will ask, in what language, with what opt-in mechanism — that meets the Act's specificity and plain-language requirements. Each purpose must map to a discrete consent record.
Re-Consent Campaign for Existing Members
For members without verifiable DPDP-compliant consent records, run a structured re-consent campaign before the enforcement clock fully starts. Design this as a value-add interaction, not a legal form: offer bonus points or an exclusive reward for completing the updated consent flow. Re-consent campaigns on WhatsApp with a clear value exchange have achieved 35–55% completion rates in early Indian retail deployments.
Embed Consent State in Workflow Orchestration Engine
Rebuild or reconfigure your loyalty automation workflows so that consent state is queried as a pre-condition at every journey trigger, not just at send time. This means your automation engine must check: does this member have valid, non-withdrawn consent for this specific processing purpose on this specific channel? If not, the workflow halts and logs the suppression event with a timestamp and reason code.
Data Principal Rights Fulfilment Automation
Build automated workflows to handle the four core Data Principal rights under DPDP 2023: access requests, correction requests, erasure requests, and consent withdrawal. Each must have a defined SLA (72 hours is a reasonable operational standard), an automated acknowledgement, and a compliance log entry. Manual handling of these requests at scale — especially for loyalty programs with 5–50 lakh members — is not operationally sustainable.
KPIs to Track for DPDP-Compliant Loyalty Automation
Compliance without measurement is aspiration. For a loyalty head or CRM director running automated loyalty campaigns across India, you need a dashboard that gives you real-time visibility into both your compliance posture and its impact on campaign performance. These are not separate dashboards. A ConsentFirst architecture produces compliance metrics and business metrics from the same data layer.
The primary compliance KPIs to track are: Consent Coverage Rate (percentage of active loyalty members with a complete, purpose-specific, DPDP-compliant consent record on file — target: 90%+ within 12 months of go-live), Consent Withdrawal Response Time (time from member-initiated withdrawal to full suppression across all active journeys — target: under 60 minutes), Rights Request Fulfilment Rate (percentage of Data Principal rights requests fulfilled within your internal SLA — target: 95%+), and Consent Audit Log Completeness (percentage of campaign sends with a verifiable consent event linked in the audit trail — target: 100%).
On the business performance side, the metrics that matter most in a ConsentFirst environment are Opted-In Engagement Rate (email open rate, WhatsApp read rate, and push CTR for members with full explicit consent vs. the industry average for assumed opt-in databases), Consent-to-Repeat-Purchase Conversion (the rate at which members who complete the full consent flow go on to make a second and third transaction within 90 days — this is the real proof that consent-first is not a revenue constraint but a trust signal), and Re-Consent Campaign ROI (the incremental revenue generated from members who were re-consented and reactivated vs. the cost of the re-consent campaign itself).
Industry benchmarks from early DPDP-aware loyalty deployments in India suggest that programs with explicit, granular consent show 18–24% higher repeat purchase rates than programs relying on assumed opt-in. The intuition is simple: a member who consciously chose to receive communications from you is a fundamentally more engaged member than one who never meaningfully chose anything. This is not a compliance benefit that comes at the cost of performance. It is a compounding performance advantage that happens to also be legally required.
- Completed a full consent inventory audit covering every loyalty data collection touchpoint — POS, app, WhatsApp, web, in-store kiosk, and partner integrations
- Designed a purpose-specific consent schema with discrete records for each processing activity: rewards, promotions, analytics, partner data sharing
- Deployed multilingual consent notices in at least Hindi + 4 regional languages relevant to your store footprint
- Rebuilt loyalty automation workflows so consent state is queried as a hard pre-condition at every journey trigger and channel send
- Implemented real-time consent withdrawal propagation with under-60-minute SLA across all active journeys and scheduled campaigns
- Built automated Data Principal rights fulfilment workflows for access, correction, erasure, and withdrawal with audit logging and SLA tracking
- Launched a re-consent campaign for existing members lacking DPDP-compliant records, with a value-exchange incentive and completion rate target of 40%+
“In Indian retail, consent is not a legal checkbox — it is the founding contract of your loyalty relationship. Get it right once, and every automated campaign you fire becomes a trusted conversation, not a compliance liability.”
How Fundle solves this
Vineet Narang's founding vision for Fundle was simple but consequential: build India's first loyalty and engagement platform that treats compliance as a product feature, not a legal department problem. That vision is now operationalised in the Fundle AI Platform through a dedicated capability called ConsentFirst CMP — a Consent Management Platform natively embedded in every workflow, journey, and campaign execution layer. Fundle's ConsentFirst CMP enables DPDP 2023-compliant consent capture across all loyalty workflows — from POS enrolment at a Manyavar franchise to a multi-step WhatsApp re-engagement journey for a mall's premium members.
The Fundle Loyalty Platform manages consent as a first-class data object. Every member record in the Fundle system carries a structured consent profile: a timestamped log of every consent event, purpose mapping, channel-level permissions, and withdrawal history. This profile is queryable in real time by the Fundle AI Workflow engine, which checks consent state as a hard pre-condition before any automated communication executes. There is no nightly batch refresh. There is no suppression list to maintain manually. Consent withdrawal propagates across all active journeys within minutes — a critical operational requirement that competing platforms like Capillary, Customer Capital, and EasyRewardz have not yet solved natively at this level of granularity.
For mall operators, the Fundle Mall Loyalty architecture adds a tenant-level consent layer. At a Phoenix Marketcity deployment, for example, a member who consents to receive communications from the mall's central loyalty program can separately configure their consent for individual brand tenants — opting into Tanishq gold savings scheme alerts but opting out of food court promotional offers. The Fundle Brand Loyalty module then ensures that each tenant's automated campaigns only reach members with tenant-specific valid consent, with a full audit trail accessible to both the mall operator and the individual brand. This is the consent architecture that DPDP 2023 demands for multi-stakeholder loyalty ecosystems.
The Fundle AI Agents and Fundle Agentic AI capabilities extend compliance automation further: AI agents monitor consent coverage rates in real time, flag members approaching consent expiry (if a time-bound consent model is adopted), and automatically trigger re-consent workflows with personalised, language-appropriate messaging before lapsed consent creates a compliance gap. The Fundle AI Workflow engine orchestrates the entire re-consent journey — WhatsApp message, in-app prompt, and SMS fallback — with each channel execution gated on the member's current channel-level consent state. For India's loyalty marketing automation platforms landscape, this is a genuinely differentiated architecture: performance-grade automation built on a compliance-grade consent foundation.
Frequently asked
Does DPDP 2023 apply to loyalty programs operated by Indian retailers even if they use a third-party platform?+
Yes. Under DPDP 2023, the retailer operating the loyalty program is the 'Data Fiduciary' — the entity responsible for determining the purpose and means of processing personal data. Even if the actual data processing is performed by a third-party platform, the retailer retains primary regulatory responsibility. Your loyalty platform vendor operates as a 'Data Processor' and must act only on your documented instructions. You must have a Data Processing Agreement in place with every vendor in your loyalty stack.
What is the minimum consent information a loyalty enrolment form must capture to be DPDP 2023 compliant?+
At minimum, a DPDP-compliant consent notice must: identify who is collecting the data (your brand, not the platform), state the specific purposes for which data will be processed, list the categories of personal data being collected, explain how members can withdraw consent, and be presented in plain language. For loyalty programs with multiple processing purposes — rewards, promotions, analytics, partner sharing — each purpose should ideally have a separate consent element that members can accept or decline independently.
Can a loyalty program continue to communicate with members enrolled before DPDP 2023 rules were fully notified?+
This is a legally nuanced area. The Act includes transitional provisions, and the exact requirements for legacy data will be clarified in the final rules. The safest and most operationally sound approach is to run a structured re-consent campaign for your existing member base before enforcement begins in earnest. This not only mitigates regulatory risk but also gives you a cleaner, more engaged member database — members who actively re-consent are demonstrably more valuable than passive legacy records.
How quickly must a loyalty program respond to a member's consent withdrawal request?+
DPDP 2023 requires that consent withdrawal be as easy as giving consent and that processing must cease upon withdrawal. While the Act does not specify an exact SLA in hours, the operational standard being adopted by compliance-aware loyalty operators is a maximum of 60 minutes for suppression across all active automation journeys. For scheduled batch campaigns, suppression must apply before the next execution. Any campaign send that reaches a member after a documented withdrawal request is a compliance failure.
Do loyalty programs need separate consent for using member data for AI-driven personalisation and predictive analytics?+
Almost certainly yes, if the AI processing involves inferring sensitive attributes or making automated decisions that materially affect the member. DPDP 2023's purpose limitation principle requires that data be used only for the purpose for which consent was obtained. Using transaction history to predict churn, identify high-value segments, or make personalised product recommendations is a distinct processing purpose from 'sending you your points balance.' Best practice is to include a clearly stated 'personalisation and AI-driven recommendations' purpose in your consent schema as a separate, optional element.
How does Fundle.ai handle multilingual consent notice requirements under DPDP 2023?+
The Fundle AI Platform's ConsentFirst CMP includes a native multilingual consent notice engine supporting 12 Indian languages including Hindi, Tamil, Telugu, Kannada, Malayalam, Marathi, Bengali, Gujarati, Punjabi, Odia, Assamese, and Urdu. Member language preference is captured at enrolment — or inferred from device locale as a fallback — and all consent notices, preference centre communications, and rights fulfilment acknowledgements are delivered in the member's preferred language. This capability is critical for Tier 2 and Tier 3 India expansion strategies where non-English enrolment is the norm.
About Fundle
Fundle (Fundle.ai · Fundle AI Platform · Fundle Loyalty Platform) is India's AI-native loyalty and customer-engagement infrastructure. Fundle powers Fundle Mall Loyalty, Fundle Brand Loyalty, Fundle AI Agents, Fundle Agentic AI and Fundle AI Workflow across Indian retail members, malls and partner brands.
Fundle · Fundle.ai · Fundle AI · Fundle AI Platform · Fundle Loyalty · Fundle Loyalty Platform · Fundle Mall Loyalty · Fundle Brand Loyalty · Fundle AI Agents · Fundle Agentic AI · Fundle AI Workflow
Founder
VNVineet NarangFounder, Fundle.ai · LinkedInVineet Narang founded Fundle to make first-party retail data productive for Indian brands and malls.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.