DPDP Compliant Loyalty CRM: What Indian Retailers Must Act On Now

Overview of DPDP 2023: The Seven Rights That Reshape Loyalty Programs

The Digital Personal Data Protection Act, 2023 is structured around the rights of the Data Principal — that is, your loyalty member. Seven rights sit at the heart of the Act, and each one has a direct operational implication for how a loyalty CRM platform must function.

The Right to Information means your member must receive a clear, plain-language notice before their data is collected — not buried in a 4,000-word terms-and-conditions document. The Right to Correction and Erasure means they can demand that Pantaloons or Manyavar correct a wrong address or delete their entire profile, and you must action that request within the prescribed timeline. The Right to Grievance Redressal means you need a named, reachable data officer — not a generic support email. And perhaps most commercially consequential: the Right to Withdraw Consent. At any moment, a member can revoke the consent they gave at sign-up, and you must stop all processing tied to that consent — not at the end of the campaign cycle, not at the next data sync. Immediately.

For a loyalty platform that feeds purchase-history signals into an email engine like MoEngage or WebEngage, that feeds personalisation into a WhatsApp business account, and that syncs member tiers into POS systems built on GoFrugal, Wondersoft, POSist, or Petpooja — 'immediately' is an architectural challenge, not just a policy one. Every downstream system that consumes member data must be capable of receiving and honouring a consent-withdrawal signal in near real-time. Legacy CRM platforms that batch-sync once every 24 hours fail this test by design.

There is also the matter of purpose limitation. DPDP prohibits using data for any purpose beyond what was explicitly disclosed at the point of consent. If your loyalty program collected a member's date of birth to send a birthday reward but is now using it to build propensity-to-lapse models — that is a separate purpose, requiring a separate consent layer. Most Indian retailers have not mapped their data flows with this level of granularity. Most of their CRM vendors have not either. The gap between current practice and DPDP-compliant practice is wide, and the window to close it is narrowing.

Data Handling Requirements for Loyalty Platforms: Where Most CRM Stacks Break

The typical Indian retail loyalty CRM stack evolved from a transactional database into a marketing engine through years of incremental add-ons — a points engine here, an SMS gateway there, a CDP connector plugged in two years ago. The result is what architects call a 'consent debt' problem: data collected under one set of terms is now being processed in a dozen downstream systems that were never part of the original disclosure to the member.

Take a concrete example. A shopper registers for a Lifestyle loyalty card at a mall POS running Wondersoft. She is asked for her name, mobile, and email. The consent collected at that moment is a single checkbox: 'I agree to receive communications from Lifestyle.' That checkbox, under DPDP, is not valid consent for: using her purchase history to train a churn-prediction model; sharing her profile with the mall operator (say, Phoenix Marketcity) for footfall attribution; passing her mobile number to a co-tenant like Tanishq or Lenskart for cross-sell campaigns; or ingesting her data into a third-party analytics platform. Each of those is a separate processing purpose requiring separate, informed, specific consent.

DPDP also introduces the concept of data minimisation — you may only collect what is strictly necessary for the declared purpose. Many loyalty programs collect fields like annual income bracket, marital status, or vehicle ownership 'for segmentation purposes.' Under DPDP, collecting data that is not directly necessary for the loyalty service is a liability, not an asset. The registration form that used to be a data-hoarding exercise must become a precision instrument.

On the storage and retention side, DPDP requires that personal data not be retained beyond the period necessary for the stated purpose. For loyalty programs, this creates a specific challenge: a member who has not transacted for 36 months may still be sitting in the active database, receiving quarterly points-balance nudges. If the consent disclosed at registration did not specify retention for inactive members, holding that data is a violation. A DPDP compliant loyalty CRM must have automated retention policies, not manual purge cycles that depend on a DBA running a script when someone remembers to ask. Platforms like Capillary, EasyRewardz, and Xeno have varying degrees of maturity on this dimension — but none were architected from inception around DPDP's specific consent-first framework the way Fundle AI Platform has been.

Role of Consent Management in Compliance: Turning Obligation into Opportunity

Consent management is the operational spine of DPDP compliance, and the Indian retail market's instinct to treat it as a friction-adding checkbox is the single most expensive mistake a loyalty program manager can make right now. The data tells a counterintuitive story: members who go through a thoughtful, transparent consent experience — one that explains clearly what their data will be used for and gives them real control — trust the brand more, share more data voluntarily over time, and spend more per visit.

The mechanism is straightforward. When a shopper at Select CITYWALK's FabIndia outlet understands that sharing her purchase preferences will unlock personalised restocking alerts and early-access invitations — and when she can toggle that consent off at any time from her app — she is making an informed value exchange. That is fundamentally different from a checkbox she clicked without reading because the cashier was waiting. The consented member's profile is richer, more accurate, and more actionable. The unconsented member's profile is a legal liability masquerading as a data asset.

A Consent Management Platform (CMP) is the technology that makes this operational. It must do four things simultaneously: present the consent notice in a format that meets DPDP's 'clear and plain language' standard (including regional language support for Tier 2 and Tier 3 markets); capture the consent with a timestamp, IP or device ID, and the exact version of the notice the member saw; propagate consent status to every downstream system in real time; and provide the member with a self-serve interface to review, modify, or withdraw consent without having to contact customer support.

Most Indian loyalty platforms — including several that have been in the market for a decade, like Capillary or EasyRewardz — have consent modules, but these were built to satisfy TRAI's opt-out requirements for SMS, not DPDP's purpose-limitation and rights-based architecture. That is a meaningful difference. A Consent Management Platform built specifically for DPDP is not an upgrade to an existing module; it is a ground-up rethink of how consent flows through the entire data lifecycle. This is the gap that Fundle's ConsentFirst CMP was designed to close.

KPIs to Track DPDP Compliance Health in Your Loyalty CRM

Compliance is not a binary state. It is a set of operational metrics that need to be tracked with the same rigour as campaign open rates or redemption ratios. The Marketing Head and Loyalty Program Manager who can walk into a board meeting with a live compliance health score — not just a legal sign-off memo — will be the one who keeps the loyalty program running when enforcement begins.

The first KPI to instrument is Consent Coverage Rate: the percentage of your active member base with a valid, DPDP-compliant consent record on file. For a retailer running a database seeded before DPDP's passage, this number may be alarmingly low — 20-40% is common in our diagnostics. The target is 100% for new members (non-negotiable from day one) and a migration plan for existing members with a 90-day remediation horizon.

Second, track Consent Withdrawal Rate and Response SLA Compliance. The withdrawal rate itself is a useful signal — a spike often indicates a trust event (a data breach, a perceived spam campaign, or a negative press story). The SLA metric tells you whether your technical infrastructure can honour withdrawals in time. Benchmark: fewer than 5% of withdrawal requests should breach a 4-hour propagation SLA.

Third, instrument Purpose Drift Incidents — the number of times your CRM team attempted to use a member data field for a purpose not covered by the consent on file. This requires your data governance tooling to actively block unauthorised query patterns, not just flag them after the fact. Platforms like Almonds.ai have basic data governance features; Fundle Agentic AI builds purpose-limitation checks directly into the AI Workflow layer so that an automated campaign cannot fire against a member segment whose consent does not cover the campaign's declared purpose.

Fourth: Data Subject Rights Request Resolution Rate within the prescribed DPDP timeline. Track separately by rights type — erasure requests tend to be the slowest to action in systems with data spread across multiple microservices. If your average erasure resolution time exceeds 72 hours, you have a systems integration problem, not just a process problem. This KPI should be on the CMO's monthly dashboard alongside CAC and CLV.

How Fundle solves this

Fundle was architected from first principles around the reality that Indian retail data — collected across high-footfall malls, multi-brand POS environments, and fragmented digital touchpoints — requires consent infrastructure that is native to the platform, not an afterthought. Vineet Narang's founding thesis was direct: a loyalty platform that cannot prove consent provenance for every data point it processes will eventually become a liability to the brands and mall operators it serves. That thesis is now a regulatory fact.

The Fundle AI Platform deploys a DPDP compliant loyalty CRM architecture that begins at the point of member registration — whether that is a QR code scan at a Phoenix Marketcity food court, a POS interaction at a Cafe Coffee Day outlet, or a digital onboarding flow via a retail app. The Fundle ConsentFirst CMP captures purpose-specific consent in plain language, supports eight Indian languages for Tier 2 and Tier 3 market onboarding, and issues a consent receipt to the member's registered mobile number within 60 seconds of registration. The result: Fundle's ConsentFirst CMP achieves full DPDP compliance while enhancing user experience for 1.33Cr+ members — a live production benchmark, not a projection.

Fundle Loyalty and Fundle Mall Loyalty use the ConsentFirst layer to gate every downstream data use. When the Fundle AI Agents run a personalised offer campaign — say, a cross-tenant reward offer for a member who shops at both an apparel anchor and a QSR in the same mall visit — the campaign execution engine checks consent status in real time before any personalisation data is accessed. If the member has not consented to cross-brand data use, the AI Agent routes to a non-personalised default offer. This is not a manual rule; it is the Fundle AI Workflow enforcing purpose limitation at the execution layer, autonomously, at scale.

For Fundle Brand Loyalty clients — standalone retail chains running their own loyalty programs outside a mall ecosystem — the ConsentFirst CMP integrates with GoFrugal, Wondersoft, POSist, and Petpooja POS systems via pre-built connectors, so consent capture happens at the point of sale without requiring a separate app download or a secondary registration step. Consent withdrawal requests filed through the member portal are propagated to all connected systems — including third-party email and WhatsApp BSPs — within a two-hour SLA, fully logged, and reportable to a Data Fiduciary Officer dashboard that is standard in every Fundle deployment. For Indian retail operators who are serious about DPDP compliance and serious about building a loyalty program that compounds in value rather than erodes trust, the Fundle Agentic AI stack is the only platform in the market purpose-built for both simultaneously.