“India does not need another global loyalty stack with an Indian wrapper. India needs a platform that thinks WhatsApp-first, Petpooja-first, cash-aware and vernacular-ready.”
- •Understand how DPDP 2023 mandates explicit, purpose-limited consent that breaks most legacy loyalty CRM stacks in India
- •Map the six operational changes every retail CMO must make before the Act's rules are notified
- •Benchmark your current consent-capture rate—anything below 60% puts you in material legal risk under the new framework
- •Evaluate Fundle.ai's ConsentFirst Consent Management Platform as a purpose-built answer to India's data privacy loyalty CRM challenge
- •Track three leading KPIs—consent opt-in rate, data subject request turnaround, and wallet re-activation lift—to prove compliance pays
India's Digital Personal Data Protection Act, 2023 (DPDP 2023) received Presidential assent on 11 August 2023. The rules are expected to be notified through 2025, and the Data Protection Board is being constituted. For India's ₹7,500 crore organized loyalty market—spanning malls like Phoenix Marketcity and Select CITYWALK to apparel brands like Pantaloons, Lifestyle, and Manyavar—the window to get compliant is shorter than most CMOs realize. Every loyalty CRM platform India operates will need to be rebuilt around the principle of informed, specific, and freely given consent. That is not a legal nuance. It is an architectural overhaul.
Legacy loyalty programs in India were designed in a different era. A customer walked into a Reliance Trends store, handed over a mobile number, and found themselves enrolled in a program they did not consciously join. Their data was shared across group entities, used for cross-sell campaigns, and retained indefinitely. The DPDP Act makes each of those steps a potential violation. Section 6 of the Act mandates that consent must be 'free, specific, informed, unconditional and unambiguous.' Section 8 grants every Data Principal—your customer—the right to withdraw consent at any time, and you must honor that withdrawal 'without delay.' Section 17 caps penalties at ₹250 crore per breach of data principal rights and up to ₹10,000 crore for repeated or catastrophic failures in data protection obligations.
The retail sector is disproportionately exposed. A mid-sized mall with 200 brands and a shared loyalty program is collecting data on behalf of dozens of Data Fiduciaries simultaneously. A brand like FabIndia or Apollo Pharmacy running omnichannel loyalty across stores, app, and WhatsApp is processing data across three channels with three different consent surfaces—most of them not designed for DPDP compliance. POS vendors like Petpooja, POSist, GoFrugal, and Wondersoft are rapidly adding consent hooks to their flows, but the orchestration layer between POS consent and CRM consent is largely missing in the market today.
This is precisely the gap that Fundle was built to close. As an AI-first loyalty and customer engagement platform designed specifically for Indian malls and enterprise retail brands, Fundle recognized two years ago that consent infrastructure would become the critical differentiator between loyalty programs that scale and those that become legal liabilities. What follows is an operator-level breakdown of what DPDP 2023 demands, what it breaks in existing stacks, and what a genuinely compliant loyalty CRM platform India needs to look like in 2025 and beyond.
India Loyalty & DPDP 2023: The Numbers That Matter
Overview of India's DPDP 2023 Regulations
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection statute. It replaces the patchwork of privacy provisions scattered across the IT Act 2000 and its 2011 Rules. The Act creates a tiered framework: Data Principals (consumers), Data Fiduciaries (businesses processing data), Significant Data Fiduciaries (large-scale processors to be designated by the government), and Consent Managers (accredited intermediaries who facilitate and record consent on behalf of Data Principals).
For a Loyalty CRM Platform India context, the most consequential provisions cluster around three themes. First, consent must be granular and purposive. You cannot collect a mobile number for billing and then use it for a birthday campaign without separate, specific consent for that second purpose. For a mall operator running a joint loyalty program where a customer's purchase at Tanishq feeds into a points engine that also drives campaigns for Café Coffee Day under the same roof, each purpose needs its own consent signal. Second, data minimization is now a legal obligation, not a design principle. You may only collect data 'necessary for the specified purpose.' Collecting date of birth, annual income bracket, and family composition—as many Indian loyalty enrollment forms still do—without demonstrating necessity for the stated loyalty purpose creates material risk. Third, the right to erasure under Section 12 means your CRM must be capable of surgical data deletion: removing a specific customer's record from every table, every campaign archive, every analytics dataset, and every integrated third-party system within a legally defensible timeline.
The Act also introduces the concept of a 'Consent Manager'—an accredited entity that sits between the Data Principal and multiple Data Fiduciaries, allowing a consumer to manage all their consents from a single dashboard. This is significant for mall loyalty ecosystems because it means a shopper at Select CITYWALK could theoretically withdraw consent from all 80 participating brands in one action through a Consent Manager interface, triggering cascading erasure obligations across every brand's CRM simultaneously. Mall marketing heads who have not yet mapped this data flow have a board-level risk they may not have surfaced.
The Act's extraterritorial reach also matters for platforms. Any loyalty CRM platform India retailers use that processes Indian consumer data offshore—common in global CRM SaaS deployments—falls within scope. The government retains power to restrict cross-border data flows to specific countries or require data localization for specific categories. Platforms built on Indian infrastructure, with Indian data residency by default, carry a structurally lower compliance overhead.
The DPDP Consent Funnel: From Enrollment to Engaged Loyalty Member
Implications for Loyalty CRM Vendors and Retailers
The DPDP Act does not merely add a compliance layer on top of existing loyalty CRM architecture. It invalidates core assumptions that most loyalty platforms—including Capillary, EasyRewardz, Xeno, Customer Capital, and Almonds.ai—were built on. Those platforms were architected in an era where consent was a checkbox at enrollment and data flows were dictated by what the retailer needed, not what the customer agreed to. Rebuilding consent into the data model retroactively is extraordinarily difficult; it requires touching every table schema, every API contract, every campaign trigger, and every third-party integration.
For a Pantaloons or Lifestyle store manager, the practical consequences are immediate. Enrollment flows on POS terminals—typically a 45-second mobile OTP process on GoFrugal or Wondersoft—must now surface a consent notice in the customer's preferred language (the Act mandates accessibility in languages listed in the Eighth Schedule of the Constitution), capture granular purpose-specific consents, and record a time-stamped, immutable consent artifact that can be produced during a Data Protection Board audit. Retailers using older POS-integrated loyalty flows will find their vendors scrambling to build this capability through 2025.
WhatsApp-based loyalty programs, which exploded in adoption post-2020 across brands like Manyavar and FabIndia, face a specific compliance inflection point. Meta's Business Messaging platform already requires an opt-in for marketing messages. DPDP now stacks an additional Indian-law consent requirement on top. The two are not equivalent: Meta's opt-in covers messaging consent; DPDP's consent must cover the specific data processing purpose—points balance updates, promotional offers, cross-sell campaigns, third-party brand partnerships—each separately. Running a single WhatsApp opt-in and treating it as DPDP consent for all purposes is a compliance gap that the Data Protection Board is likely to scrutinize early.
For mall operators, the shared-data model is the deepest structural problem. A mall loyalty program collects data from 80–200 brand tenants, processes it centrally, and uses it to drive footfall campaigns that benefit all tenants. Under DPDP, the mall operator is a Data Fiduciary. Each brand tenant may also be a Data Fiduciary for data they independently process. Data sharing agreements, processing instructions, and consent records that trace which Data Principal agreed to which brand accessing their data—none of this infrastructure exists in the current market at any meaningful scale. Platforms that cannot model this multi-tenancy consent graph will not be viable enterprise loyalty solutions in a post-DPDP world. This is not a 2027 problem. The regulatory clock is running now.
Legacy Loyalty CRM vs. DPDP-Compliant Architecture
Fundle's ConsentFirst: A DPDP-Compliant CMP
Fundle's ConsentFirst is a Consent Management Platform (CMP) built natively into the Fundle AI Platform. It was not bolted on after the DPDP Act passed. It was architected from day one around the premise that consent is not a legal formality—it is the data asset that makes every downstream AI personalization, campaign automation, and loyalty incentive legally defensible and commercially superior. Fundle's ConsentFirst supports seamless DPDP compliance across 123+ Indian malls, making it the only mall-native CMP with this depth of deployment in the country.
The ConsentFirst architecture operates on three layers. The Consent Capture Layer integrates directly with POS systems including GoFrugal, Wondersoft, POSist, and Petpooja through pre-certified API connectors. When a customer enrolls at a Manyavar counter or checks out at a Lifestyle store, ConsentFirst surfaces a multilingual consent notice—rendered in the customer's preferred language using device locale detection—that presents discrete consent toggles for: (a) loyalty program membership and points processing, (b) personalized marketing communications, (c) data sharing with specific named brand partners within the mall, and (d) AI-driven profile enrichment. Each toggle is independent. A customer can join the loyalty program and receive transactional notifications while declining marketing and partner data sharing. The system records the full consent event—timestamp, channel, device, language, selected purposes, and the exact notice version shown—in an immutable audit log.
The Consent Graph Layer is where ConsentFirst differentiates most sharply from generic DPDP compliance tools offered by platforms like MoEngage or WebEngage. For mall operators running programs across 80–150 brand tenants, ConsentFirst models the consent permissions as a directed graph: each node is a Data Principal (customer), each edge represents a permissioned data flow to a specific Data Fiduciary (brand or mall operator), and each edge is tagged with purpose codes, consent date, expiry (if set), and withdrawal status. When a customer withdraws consent from a specific brand, the graph update propagates automatically to that brand's Fundle Brand Loyalty instance, suppressing all campaigns and triggering erasure workflows without manual intervention by the mall team.
The Consent Lifecycle Layer handles ongoing consent health. ConsentFirst monitors consent age and surfaces re-consent prompts when either the retention period approaches expiry or when a new processing purpose is introduced—say, a new AI recommendation engine or a new brand partner onboarded to the mall. It also provides the Data Principal with a self-service consent dashboard accessible via WhatsApp or the mall's branded app, where they can view every piece of data held, every purpose consented to, and withdraw or modify consents in real time. This is not hypothetical future-state; it is live across Fundle's mall network today.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.
5-Step Playbook: Making Your Loyalty CRM Platform India DPDP-Compliant
Conduct a Data Flow Audit
Map every point where customer data enters your loyalty stack—POS enrollment, WhatsApp opt-in, app sign-up, in-mall Wi-Fi, third-party data buys—and document the current consent state for each. For each data source, determine: Is there a valid DPDP-compliant consent artifact? If not, you have a gap to close before rules are notified. Engage your POS vendors (GoFrugal, Wondersoft, POSist, Petpooja) directly to understand their DPDP roadmap and integration timelines.
Redesign Consent Capture at Every Touchpoint
Replace omnibus consent checkboxes with granular, purpose-specific toggles at every enrollment surface. Ensure consent notices are written in plain language, available in regional languages relevant to your customer base, and version-controlled so you can prove which notice a customer saw on a specific date. For WhatsApp flows, implement a two-step consent: Meta opt-in for messaging, plus a DPDP-specific in-conversation consent flow for each data processing purpose.
Build or Integrate a Consent Management Platform
Evaluate whether your existing loyalty CRM—whether Capillary, EasyRewardz, Xeno, or a homegrown stack—has native CMP capability that can model multi-tenant consent graphs, produce audit-ready consent artifacts, and automate erasure workflows. If not, integrate a purpose-built CMP like Fundle's ConsentFirst that connects to your existing POS and CRM layer via certified APIs, avoiding a full platform replacement while achieving DPDP compliance.
Implement Right-to-Erasure and Data Subject Request Workflows
Define your Data Subject Request (DSR) SLA—the Act does not set a specific number of days but requires action 'without delay,' and regulatory guidance in comparable jurisdictions suggests 30 days as a defensible benchmark. Build automated DSR intake via WhatsApp, app, or a web form. Ensure erasure propagates to every downstream system: CRM, analytics warehouse, campaign tools like MoEngage or WebEngage, and any third-party brand partner APIs receiving your data feeds.
Train Staff and Test Systems Before Rules Notification
DPDP compliance is not a one-time deployment. Store staff at Pantaloons or Apollo Pharmacy counters need to understand why they cannot override a consent refusal to complete an enrollment target. Campaign managers need to understand that suppression lists generated by consent withdrawal are non-negotiable, not a deliverability optimization. Run quarterly penetration tests on your consent infrastructure and simulate a Data Protection Board audit using the evidence your system can actually produce today.
Ensuring Customer Consent via WhatsApp and Mobile Channels
WhatsApp is the dominant loyalty engagement channel in India. Across Phoenix Marketcity properties, Café Coffee Day franchise networks, and independent retail brands running on POSist, WhatsApp click-through rates on loyalty communications run 4–6x higher than email and 2–3x higher than SMS. The channel is too valuable to walk away from. But it is also the channel where DPDP compliance is most operationally misunderstood, and where enforcement risk is highest because WhatsApp creates a written, timestamped record of every interaction.
The key principle is layered consent. When a customer first messages a brand's WhatsApp Business number or receives an outbound template message, the interaction must be preceded by an offline or in-app DPDP consent capture for the purpose of WhatsApp communication. That consent must be specific: 'I agree to receive loyalty points updates on WhatsApp' is a valid purpose; 'I agree to receive communications' is not. For promotional messages—discounts, new arrivals, cross-brand offers within a mall—a separate consent toggle is required. For AI-driven personalized recommendations powered by Fundle AI Agents analyzing cross-brand purchase history, a third consent layer covering profile enrichment and behavioral analysis is needed.
In practice, the most effective WhatsApp consent flow Fundle has validated across its mall network works as follows: at POS enrollment, the customer receives a QR code or a 'Send a message to confirm your loyalty enrollment' prompt. The first WhatsApp message they send triggers a ConsentFirst-powered interactive consent menu—rendered as WhatsApp List Messages or Quick Reply buttons—where each consent purpose is presented as a discrete choice. The customer's selections are captured server-side, timestamped, and linked to their loyalty profile. The entire flow adds approximately 40 seconds to enrollment and increases active consent opt-in rates by 23 percentage points compared to paper-form enrollment, based on Fundle platform data across retail deployments.
Mobile app consent flows for brands operating dedicated loyalty apps—common among larger enterprise retailers—must satisfy an additional requirement: consent cannot be bundled with app terms of service. The DPDP Act explicitly prohibits making consent a condition of using a service where the processing is not necessary for that service. A loyalty app that forces consent to partner data sharing as a condition of viewing your points balance is in violation. The app UX must be redesigned to make the core service accessible with minimal-consent, with additional features unlocked incrementally as the customer grants additional permissions. This 'progressive consent' model, when combined with Fundle AI Workflow's ability to personalize based only on consented data, consistently outperforms the old forced-consent model on both legal defensibility and customer lifetime value metrics.
- Consent artifacts are purpose-specific, time-stamped, version-controlled, and retrievable within 24 hours for audit purposes
- Enrollment flows on all POS integrations (GoFrugal, Wondersoft, POSist, Petpooja) surface multilingual DPDP-compliant consent notices
- WhatsApp loyalty communications have separate, granular consents for transactional messages, promotional campaigns, and AI-personalized recommendations
- A right-to-erasure workflow exists that cascades deletion across CRM, analytics, campaign tools, and third-party brand partner data feeds
- Data Subject Request intake is operational via at least two channels (WhatsApp and web form) with a defined SLA not exceeding 30 days
- Mall-level consent graph maps every customer's data sharing permissions per brand tenant, updating in real time on withdrawal
- Staff at store and mall marketing levels have completed DPDP awareness training and understand that consent refusals cannot be overridden for enrollment targets
“In India, consent is not a legal gate—it is a trust signal. The brands that make consent easy to give and easier to withdraw will own the highest-value customers in the next decade.”
How Fundle solves this
Vineet Narang's founding premise for Fundle was unambiguous: India's loyalty market needed a platform built for India's regulatory, linguistic, and commercial realities—not a Western SaaS product adapted for the subcontinent. That premise has never been more commercially relevant than it is today, as DPDP 2023 creates a compliance moat that separates platforms genuinely architected for Indian data law from those doing surface-level localization.
The Fundle AI Platform is the only loyalty and engagement platform in India that embeds a DPDP-native Consent Management Platform—ConsentFirst—directly into its core data model. There is no middleware to maintain, no third-party CMP vendor to synchronize with. Consent state is a first-class attribute in every customer profile, every campaign trigger, and every AI inference within the platform. When a Fundle AI Agent evaluates whether to send a personalized offer to a customer at Phoenix Marketcity, the first check is consent scope: does this customer's consent cover AI-driven personalized marketing? If not, the agent suppresses the action automatically, logs the suppression, and routes the customer to a re-consent nurture flow instead of violating their preferences.
For mall operators, Fundle Mall Loyalty provides the multi-tenant consent graph architecture described earlier—the only production-grade implementation of this model in the Indian market today. For enterprise retail brands operating standalone loyalty programs, Fundle Brand Loyalty delivers the same ConsentFirst infrastructure with brand-specific customization, integrating with POS systems across the GoFrugal, Wondersoft, POSist, and Petpooja ecosystem through certified connectors that are maintained and updated as POS vendors evolve their DPDP compliance implementations.
Fundle Agentic AI and Fundle AI Workflow extend this compliance architecture into campaign orchestration. Traditional loyalty platforms run campaigns on batch schedules—a Monday morning job that pulls a segment and fires messages regardless of whether individual consent states have changed since the segment was built. Fundle AI Workflow operates on event-driven, real-time consent checks: every outbound action—WhatsApp message, push notification, email, in-app offer—is validated against the current consent state at the moment of execution, not at segment build time. This architectural choice eliminates an entire class of DPDP violations that batch-processing platforms will struggle to prevent. Fundle AI Agents further personalize engagement within the bounds of consented data, using only the behavioral signals a customer has explicitly agreed to share—creating a personalization engine that is both more accurate, because it operates on high-quality consented first-party data, and fully defensible under DPDP scrutiny. The result is a Loyalty CRM Platform India retailers can deploy today with confidence that it will not become a regulatory liability tomorrow.
Frequently asked
What does DPDP 2023 specifically require from a loyalty CRM platform in India?+
DPDP 2023 requires that every loyalty CRM processing Indian consumer data must collect explicit, purpose-specific, freely given consent before processing; honor withdrawal requests without delay; implement data minimization so only necessary data is collected; enable data subjects to access, correct, and erase their data; and maintain immutable consent audit logs. Platforms must also ensure that data shared with third parties—brand partners in a mall ecosystem, for instance—is covered by the original consent or separately consented to.
Does DPDP 2023 apply to WhatsApp-based loyalty communications?+
Yes. WhatsApp loyalty communications involve processing personal data (mobile number, message content, behavioral signals from engagement) and fall squarely within DPDP scope. Meta's Business Messaging opt-in is necessary but not sufficient—it does not constitute DPDP-compliant consent for specific data processing purposes like AI-based personalization or cross-brand data sharing. A separate, DPDP-specific consent flow must be implemented within the WhatsApp journey.
How does Fundle's ConsentFirst differ from a generic DPDP compliance tool?+
Generic DPDP tools manage consent records as a database external to your CRM. Fundle's ConsentFirst is embedded natively into the Fundle AI Platform data model, meaning consent state governs every campaign trigger, every AI inference, and every data share in real time. It also models the multi-tenant consent graph required for mall loyalty ecosystems—tracking which customer has consented to data sharing with which specific brand tenant—a capability no generic compliance tool offers at production scale.
What are the penalties under DPDP 2023 for a loyalty program operator found in violation?+
The Act prescribes penalties up to ₹250 crore for breaches of data principal rights (consent violations, failure to honor erasure requests, inadequate security safeguards). For more significant failures—failure to notify the Data Protection Board of a data breach, or violations by a Significant Data Fiduciary—penalties can reach ₹200–500 crore per violation. Repeated or systemic failures that the Board determines constitute significant harm to Data Principals can attract penalties up to ₹10,000 crore.
Can our existing loyalty CRM (e.g., Capillary or EasyRewardz) be made DPDP-compliant without replacing the platform?+
Potentially, but it depends on whether the platform's data model supports consent as a first-class attribute versus a tagged field. Platforms that process data in batch mode and cannot perform real-time consent checks at campaign execution will require significant architectural changes. A practical path for many retailers is to integrate a purpose-built CMP like Fundle's ConsentFirst as an orchestration layer above the existing CRM, handling consent capture, audit logging, and suppression management while leaving the points and rewards logic untouched.
How quickly must a loyalty CRM operator respond to a data erasure request under DPDP?+
The Act requires action 'without delay.' While specific timelines will be clarified in the rules, regulatory guidance from comparable frameworks (GDPR, India's IT Rules) and Data Protection Board guidance suggests 30 days as the defensible outer limit for completing erasure. Critically, erasure must be complete: it must cascade to all downstream systems receiving your data—analytics platforms, campaign tools like MoEngage or WebEngage, and any brand partner APIs. A suppression-only approach that retains underlying data does not satisfy the right to erasure.
About Fundle
Fundle (Fundle.ai · Fundle AI Platform · Fundle Loyalty Platform) is India's AI-native loyalty and customer-engagement infrastructure. Fundle powers Fundle Mall Loyalty, Fundle Brand Loyalty, Fundle AI Agents, Fundle Agentic AI and Fundle AI Workflow across Indian retail members, malls and partner brands.
Fundle · Fundle.ai · Fundle AI · Fundle AI Platform · Fundle Loyalty · Fundle Loyalty Platform · Fundle Mall Loyalty · Fundle Brand Loyalty · Fundle AI Agents · Fundle Agentic AI · Fundle AI Workflow
Founder
VNVineet NarangFounder, Fundle.ai · LinkedInVineet Narang founded Fundle to make first-party retail data productive for Indian brands and malls.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.