DPDP Compliance in Tier Based Loyalty Programs India

Overview of the Digital Personal Data Protection Act 2023

The DPDP Act 2023 replaces decades of patchwork data governance under the IT Act 2000 and its 2011 rules. Its architecture is deceptively simple: a Data Principal (the customer) gives explicit, informed, free consent to a Data Fiduciary (the brand or mall operator) to process their personal data for a specified purpose. Withdraw consent, and processing must stop — and in most cases, the data must be erased within a defined period unless a legitimate legal basis exists for retention.

For loyalty programmes, the critical provisions sit in three chapters. First, Chapter II governs grounds for processing — consent is the primary ground for most loyalty-related data activities, though 'legitimate use' carve-outs exist for certain transactional purposes. Second, Chapter III defines the rights of Data Principals: the right to access information, the right to correction and erasure, and the right to grievance redressal with a 30-day response window. Third, Chapter VII establishes the Data Protection Board and enforcement — including the tiered penalty regime that goes up to ₹250 crore for significant data breaches.

What makes DPDP structurally different from GDPR — and this matters enormously for Indian retail operators — is its emphasis on local context. The Act explicitly envisions a consent manager ecosystem, creating licensed intermediaries through whom Data Principals can grant and revoke consent across multiple fiduciaries from a single interface. For mall operators running multi-brand loyalty programmes — think Select CITYWALK's cross-brand rewards or a Nexus mall property — this has immediate structural implications. A customer who shops at three brands in one visit may be generating data across three separate fiduciaries, each requiring its own consent notice.

The rules also require consent notices to be available in scheduled Indian languages — a mandate that most current loyalty CRM implementations, built for English-first or Hindi-only outputs, are not equipped to handle. Platforms like Capillary, EasyRewardz, and Xeno have announced DPDP roadmaps, but the specificity of loyalty-context consent flows — tier upgrade communications, partner data sharing for co-branded offers, AI-driven profiling for next-best-action — remains largely unaddressed in generic CRM compliance updates.

Implications for Loyalty Data Collection and Processing

The typical tier-based loyalty program in India collects far more data than it formally acknowledges. At enrolment, a brand like Reliance Trends or Apollo Pharmacy captures name, mobile number, and date of birth. But within the first three months of membership, the CRM system has also accumulated purchase category patterns, average basket size, visit frequency, preferred store location, and in many cases, household demographics inferred from SKU-level data. None of this secondary profiling was individually consented to at enrolment — it was covered by a broad, vaguely worded 'terms and conditions' that most members never read.

Under DPDP, this approach has a hard expiry date. The Act's requirement for 'free, specific, informed, unconditional, and unambiguous' consent means that using purchase-pattern data to infer household income and trigger premium-tier offers — a common practice in AI-driven loyalty platforms — requires its own consent notice, separate from the one obtained at sign-up. The specificity requirement is the operative word here. 'We may use your data to improve your shopping experience' does not meet the bar. 'We will analyse your purchase history to determine your eligibility for Gold tier benefits and personalised offers from our partner brands' is closer to compliant.

For CRM managers at multi-brand retailers or mall operators, the partner data-sharing question is particularly acute. When a Silver member at a Phoenix Marketcity property redeems points at a co-located Tanishq outlet, who is the Data Fiduciary? Both entities have a claim on the transaction data. DPDP requires that the data-sharing arrangement be disclosed in the consent notice and that the member has explicitly agreed to that cross-entity transfer. Current API-level integrations between POS systems — whether running on POSist, Petpooja, or GoFrugal — were not designed with this disclosure layer in mind.

The right to erasure provision creates an operational challenge that most loyalty teams have not yet war-gamed. If a Gold-tier member of a programme with 500,000 active members exercises their right to erasure, the brand must delete or anonymise all personal data associated with that member — including historical transaction records used for tier calculation — within the prescribed window. This requires a data architecture that separates personally identifiable information from aggregate analytics, something that bolt-on loyalty modules added to legacy ERP systems typically cannot do without significant re-engineering.

Ensuring Customer Consent in Tier Programs

Getting consent right in a tiered loyalty programme is not simply a matter of adding more checkboxes to the sign-up flow. Done poorly, it becomes a friction point that tanks enrolment conversion. Done well, it actually becomes a trust signal — and in a category where 68% of Indian consumers say they would exit a programme that misuses their data, trust is a retention variable, not just a legal one.

The architecture that works in practice has four components. First, a layered consent notice: a short-form notice at the point of enrolment (six to eight lines, in the member's language, on the channel where they are enrolling — whether that is a Wondersoft POS terminal, a Fundle-powered app, or a WhatsApp bot) with a link to the full notice. The short form must specify the primary purpose — 'to award you points and tier benefits on purchases at [Brand Name]' — and flag any secondary purposes like partner data sharing or AI-driven personalisation as separate, individually toggleable consents.

Second, a consent event log: every consent grant, modification, or withdrawal must be timestamped and stored in an auditable record that is separate from the loyalty profile itself. This is what the DPDP Data Protection Board will look for in an investigation. A spreadsheet in the CRM manager's inbox does not qualify. It needs to be a structured, queryable log tied to the member's unique identifier but capable of surviving even if the member's personal profile is erased.

Third, a tier-transition consent refresh: when a member moves from Silver to Gold, or from Gold to Platinum, the nature of data processing typically expands — more detailed profiling, access to partner benefits, predictive offer targeting. Each expansion is a new processing purpose and requires a fresh consent event. A well-designed loyalty app surfaces this as a positive moment — 'You've unlocked Gold! Here's what we'd like to do with your data to make your Gold experience better' — rather than a legal interruption.

Fourth, and most critically for mall operators managing dozens of retail partners under one loyalty umbrella: a consent manager infrastructure. Rather than asking members to manage consent with each brand individually, a centralised consent layer — the model DPDP's consent manager provisions envision — allows a member to see, in one place, exactly which brands within the mall ecosystem have access to which categories of their data, and to toggle those permissions without exiting the programme entirely.

KPIs to Track in a DPDP-Compliant Tier Loyalty Programme

Compliance and commercial performance are not in opposition — but they do require a different measurement framework. Loyalty heads who have traditionally tracked enrolment volume, points issued, and redemption rate need to add a consent health layer to their programme dashboard.

The first KPI is consent coverage rate: the percentage of your active loyalty member base that has a valid, DPDP-compliant consent record on file for each processing purpose. For most programmes that have been running for three or more years, this number will be well below 50% on day one of the audit. A realistic 12-month target is 85%+ coverage for primary processing purposes and 60%+ for secondary purposes like AI personalisation and partner data sharing. Getting there requires a retroactive consent collection campaign — typically run via WhatsApp and in-app notifications — combined with a clear value exchange: 'Update your consent preferences and unlock 200 bonus points.'

The second KPI is consent withdrawal rate, tracked monthly by tier and by channel. A spike in withdrawals from Gold-tier members after a specific campaign is a signal that the communication felt intrusive or that the consent notice was not clear enough about what data would be used. Treat withdrawal rates as a CX diagnostic, not just a compliance metric.

Third: grievance resolution time. DPDP mandates a 30-day response window for member data requests. Track average resolution time by request type — access requests are typically fastest, erasure requests most complex. Anything above 21 days average is a systemic risk; it means you are operating too close to the legal deadline to absorb any operational disruption.

Fourth: data minimisation score. After the data inventory exercise, establish a quarterly review of whether every data field being collected is still necessary for its stated purpose. Programmes that were designed three years ago are almost always over-collecting — capturing fields that fed into campaigns or integrations that no longer exist. Eliminating those fields reduces both compliance risk and storage cost, typically by 15-25% of total CRM data volume in the first review cycle.

Finally, track tier retention rate pre- and post-consent refresh. The hypothesis that DPDP compliance will destroy loyalty programme economics is not borne out by the evidence from GDPR-compliant European retail programmes. Brands that ran transparent, well-designed consent refresh campaigns — Marks & Spencer UK, Douglas Germany — saw less than 5% net member loss while dramatically reducing their regulatory exposure. Indian retail operators should expect similar outcomes if the consent UX is built around member value, not legal cover.

How Fundle solves this

Fundle was built from the ground up for the complexity of Indian retail loyalty — multi-brand, multi-channel, multi-tier, and now, multi-regulatory. The Fundle AI Platform's ConsentFirst CMP (Consent Management Platform) is the most direct answer to the DPDP compliance challenge for tier-based loyalty programmes in India. Fundle's ConsentFirst CMP ensures DPDP-compliant consent management protecting millions of loyalty program members' data — not as a post-hoc compliance layer bolted onto existing infrastructure, but as a foundational data architecture that consent-gates every processing activity from day one of member enrolment.

The ConsentFirst CMP is integrated directly into Fundle Mall Loyalty and Fundle Brand Loyalty — the two deployment configurations that cover the majority of Indian retail loyalty use cases. For mall operators running complex multi-brand programmes at properties like Phoenix Marketcity or Select CITYWALK, Fundle Mall Loyalty's ConsentFirst layer manages consent at both the mall level and the individual brand level, giving members a unified consent dashboard where they can see and control exactly which retailers within the property ecosystem have access to which categories of their data. For standalone retail brands — Manyavar, Cafe Coffee Day, FabIndia — Fundle Brand Loyalty's consent flows are pre-built for single-fiduciary DPDP compliance with multilingual notice support across 12 Indian languages out of the box.

Fundle AI Agents and Fundle Agentic AI — the platform's AI-driven personalisation and next-best-action engines — are consent-aware by design. Before any AI-driven communication or offer is triggered, the Fundle AI Workflow checks the member's active consent record for the relevant processing purpose. If consent for AI-driven personalisation has not been granted or has been withdrawn, the AI Agent defaults to non-personalised, purpose-neutral communication. This is not a manual override process — it is automated, logged, and auditable at the individual member level, giving CRM heads the confidence to run large-scale AI engagement campaigns without a compliance team reviewing every workflow.

Vineet Narang's founding vision for Fundle was that loyalty in India should be earned, not extracted — and DPDP, counterintuitively, is the regulatory instrument that aligns commercial incentives with that vision. Brands that build DPDP-compliant programmes using Fundle Loyalty Platform's ConsentFirst architecture are not just avoiding ₹250 crore penalties; they are building first-party data assets that are consented, clean, and commercially durable. In a market where MoEngage, WebEngage, and Xeno are adding DPDP modules to their existing stacks, and where Capillary and Almonds.ai are navigating the same retrofit challenge, Fundle's consent-first architecture represents a structural advantage — one that compounds over time as the regulatory environment tightens and as member trust becomes the scarcest resource in Indian retail engagement.