Fundle.ai: DPDP Compliance Checklist for Customer Engagement Platform with Data Privacy

Why the DPDP Act Is a Structural Shift, Not a Checkbox Exercise

Most compliance conversations in Indian retail marketing begin and end with IT. The legal team sends a memo, the tech team adds a cookie banner, and everyone moves on. The DPDP Act 2023 breaks that pattern entirely because it assigns accountability to the Data Fiduciary — which, in retail terms, is the brand or mall operator, not the software vendor. If Apollo Pharmacy runs a loyalty programme and its engagement platform sends unsolicited promotional messages to members who never consented to marketing communications, Apollo Pharmacy is the liable party, even if a third-party SaaS vendor sent the messages.

This structural shift has three immediate implications for retail CMOs. First, consent is now a legal artefact, not a UX checkbox. The Act requires that consent be freely given, specific, informed, unconditional, and unambiguous — and that a clear record of when and how that consent was obtained is maintained. This rules out the industry-standard practice of burying consent in terms-and-conditions during app sign-up. Brands like Manyavar or Cafe Coffee Day, which run large franchise-based loyalty programmes, must now ensure that every franchise touchpoint captures consent in a manner that satisfies this standard.

Second, data minimisation is a legal requirement, not a best practice. Platforms that collect date of birth, income bracket, and purchase history 'just in case' are now in direct conflict with the Act's purpose-limitation principle. Every data field must map to a specific, declared processing purpose. This forces a fundamental re-architecture of how customer profiles are built inside customer engagement software for retail. Legacy platforms that store everything and decide later are immediately non-compliant.

Third, the right to erasure and correction creates an operational challenge that most Indian retail tech stacks are simply not designed to handle at scale. A shopper who joined the Select CITYWALK loyalty programme five years ago and now requests deletion of their data must have that request processed across every system — the POS, the CRM, the WhatsApp Business API integration, the email tool, the analytics database — within the statutory timeframe. Platforms that were not built with a unified customer ID and a consent-linked data graph will struggle to execute this reliably. The DPDP Act has effectively made bad data architecture a legal liability.

Key Compliance Requirements: A Customer Engagement Platform with Data Privacy Compliance Must Do All Seven

The DPDP Act specifies obligations that translate directly into platform capabilities. Here is the practitioner-level breakdown that every Loyalty Programme Manager and Mall CMO needs to internalise before evaluating any customer engagement platform India shortlist.

Obligation 1 — Consent Management Architecture: Every consent event must be timestamped, user-attributed, purpose-tagged, and retrievable on demand. This is not a database column — it is a consent ledger. Platforms like Capillary or EasyRewardz were not originally built with this as a core data model; retrofitting it is expensive and often incomplete. A compliant platform must store not just whether a user consented, but which version of the privacy notice they saw, on which channel, at what time, and for which specific processing purposes.

Obligation 2 — Privacy Notice Delivery: The Act requires that a privacy notice be provided to the data principal before or at the time of consent. The notice must be in plain language, available in the user's preferred language among the 22 scheduled languages, and must describe the categories of data collected, the purpose, the retention period, and the rights of the data principal. For a mall loyalty programme enrolling shoppers via a WhatsApp chatbot in Tamil Nadu, this means the privacy notice must be deliverable in Tamil, legible on a 5-inch screen, and acknowledged before the enrolment flow proceeds.

Obligation 3 — Data Processor Agreements: If your engagement platform shares data with a third party — say, a campaign analytics tool, a WhatsApp Business Solution Provider, or a POS system like Petpooja — that third party is a data processor and must sign a contract that specifies the permitted processing activities, data security standards, and breach-notification timelines. Retailers who have not audited their vendor contracts in the last 12 months almost certainly have gaps here.

Obligation 4 — Breach Notification: The Act requires prompt notification to the Data Protection Board of India and to affected data principals in the event of a personal data breach. 'Prompt' will likely be defined as 72 hours in the final rules, mirroring GDPR. Customer engagement software for retail must therefore include real-time anomaly detection and an automated incident-response workflow, not a manual process dependent on an IT ticket being raised.

Obligation 5 — Grievance Redressal: Every Data Fiduciary must appoint a contact point for data principals to raise grievances. For retail brands, this typically means a dedicated email or in-app channel, with responses mandated within the timeframe specified in the rules. The platform must log, track, and close these requests within SLA — and the audit trail must be tamper-proof.

Obligation 6 — Children's Data Protections: For brands with significant youth audiences — Reliance Trends, FabIndia's kidswear, or gaming-linked loyalty programmes — additional obligations apply. Verifiable parental consent is required before processing data of anyone under 18, and behavioural tracking of children is prohibited outright.

Obligation 7 — Data Localisation (Significant Data Fiduciaries): Once the Government notifies Significant Data Fiduciaries — a category likely to include large mall operators and FMCG loyalty programmes — additional obligations including data localisation, algorithmic audits, and DPIA (Data Protection Impact Assessments) will apply. Planning your tech stack for this now, rather than scrambling post-notification, is the only defensible position.

Privacy Notices and User Consent Mechanisms That Actually Hold Up in Court

Privacy notices are perhaps the most misunderstood obligation in the DPDP Act. Most Indian retail brands treat them as a legal formality — a paragraph drafted by the legal team, uploaded to the website, and forgotten. Under the DPDP Act, this approach is not just inadequate; it is a direct path to regulatory action because the Act requires that consent be informed, meaning the user must have genuinely received and acknowledged the notice before consenting.

For a mall loyalty programme operating across physical kiosks, a mobile app, a WhatsApp chatbot, and a brand website, this creates a multi-channel consent challenge. Each channel has different UX constraints. A kiosk enrolment flow has 30 seconds of attention. A WhatsApp onboarding flow is conversational. A mobile app sign-up is visual. The privacy notice mechanism must be adapted to each channel while maintaining legal equivalence. This is a product design problem as much as a legal one, and it requires a platform built to handle it natively rather than as an afterthought.

Granular consent is the other critical design requirement. The Act's specificity requirement means you cannot obtain a single 'I agree to all marketing' consent and use it to justify SMS campaigns, WhatsApp messages, email newsletters, and push notifications simultaneously. Each channel and each processing purpose — loyalty points calculation, personalised offers, third-party partner promotions, analytics — should ideally have its own consent flag. This granularity also creates a commercial advantage: users who explicitly consent to personalised offers are significantly more likely to convert than users who were mass-enrolled under a blanket opt-in.

Consent withdrawal must be as easy as consent grant. If a Tanishq loyalty member decides she no longer wants WhatsApp promotions, the withdrawal mechanism must be immediately accessible, must take effect within a defined SLA, and must cascade across every downstream system that was acting on that consent. Platforms that process consent withdrawal in batch overnight — a common implementation pattern — are non-compliant. Real-time consent propagation is not a nice-to-have; it is a statutory requirement. MoEngage and WebEngage, which are widely used for campaign delivery in Indian retail, must receive consent-revocation signals from the engagement platform in real time or they become instruments of a DPDP violation.

Vendor Due Diligence: Auditing Your Engagement Stack Before Regulators Do

The DPDP Act makes data processors — your vendors — a critical link in your compliance chain. A mall operator running a loyalty programme across 60 brands cannot afford to have even one data-processor vendor that fails to meet the Act's standards, because a breach originating from that vendor is still the mall operator's legal problem. Vendor due diligence is therefore not an annual formality; it is an ongoing programme.

Start with a data-flow map. Every customer engagement platform India operator should be able to answer, in under five minutes, the question: 'Where does a specific customer's mobile number travel after it is captured at our POS?' If the answer requires a cross-functional meeting, you have a data-governance problem. The mobile number may travel from the POS (POSist or GoFrugal) to the CRM, from the CRM to a campaign platform (Xeno or WebEngage), from the campaign platform to a WhatsApp BSP, and from the BSP to Meta's infrastructure. Each hop is a data-processor relationship that requires a contract.

For competitive context: platforms like Capillary, Antavo, and Customer Capital have varying levels of DPDP-readiness. None of them were purpose-built for the Indian legislative context in the way that a newer, AI-native platform can be. Almonds.ai and EasyRewardz are primarily campaign and points platforms respectively, and their data governance architectures were not designed with DPDP compliance as a foundational requirement. This does not mean they cannot be made compliant — but it does mean that compliance will require significant customisation, testing, and ongoing maintenance on your side, not theirs.

The due-diligence checklist for any customer engagement platform vendor should cover at minimum: ISO 27001 or SOC 2 Type II certification, a documented incident-response plan with breach-notification SLA of 72 hours or less, a sub-processor register that is current and accessible, contractual commitments on data deletion within 30 days of contract termination, and clear data localisation commitments for Indian customer data. Vendors who cannot provide these without a lengthy escalation are a regulatory risk, not just a procurement inconvenience.

How Fundle Solves This

Fundle's AI Platform was architected from day one around the principle that customer engagement and data privacy are not opposing forces — they are the same design problem. Vineet Narang's founding thesis for Fundle was that the Indian retail market would eventually be forced to choose between platforms built for compliance and platforms built for engagement, and that the right answer was to refuse that choice entirely.

Fundle's ConsentFirst platform handles comprehensive DPDP compliance checks for all client engagements. This is not a bolt-on compliance module — it is the data layer on which every other Fundle capability is built. When a shopper enrols in a Fundle Mall Loyalty programme at a Phoenix Marketcity property, the enrolment flow captures granular, purpose-specific consent in real time, records it to an immutable consent ledger, and makes that ledger queryable by the mall operator's compliance team within seconds. If the same shopper withdraws consent for WhatsApp marketing at 11 PM on a Tuesday, Fundle AI Agents propagate that revocation to every downstream system — the campaign platform, the WhatsApp BSP, the analytics database — before any further message is dispatched. The SLA is minutes, not hours.

Fundle Brand Loyalty and Fundle Mall Loyalty deployments include automated data-processor agreement templates that have been reviewed against the DPDP Act's processor obligations. Every new vendor integration added to a client's stack is screened against a risk scorecard before activation. Fundle AI Workflow automates the grievance-redressal process: when a data principal submits an erasure or access request via the loyalty app, Fundle Agentic AI classifies the request, initiates the cross-system resolution workflow, and generates a compliance-ready audit log — all without manual intervention from the client's IT team.

For retailers and mall operators who are simultaneously navigating DPDP compliance and trying to drive customer engagement KPIs, the Fundle AI Platform resolves a tension that legacy platforms cannot: the consent data itself becomes an engagement signal. A shopper who opts in to personalised recommendations is, by definition, a high-intent audience. Fundle's recommendation engine is consent-aware — it only personalises within the boundaries of what the user has explicitly permitted, which means every personalised communication is both legally sound and commercially targeted. In a market where 68% of loyalty members say they would exit a programme over data misuse, this is not just a compliance advantage — it is a retention advantage.