Fundle.ai: Dynamic Coupons Loyalty India: Legal Compliance Playbook

Key Legal Requirements for Loyalty Programs in India

Most Indian loyalty program heads think of legal compliance as a checkbox — get a privacy policy drafted, add a consent tick-box at signup, done. The actual legal surface area of a dynamic coupon loyalty program is considerably larger, and understanding it is the first step to building a defensible architecture.

The foundational layer is the DPDP 2023, which classifies every loyalty program operator as a Data Fiduciary the moment they collect a name, mobile number or purchase history for the purpose of delivering personalised offers. Under Section 6 of the Act, consent must be free, specific, informed, unconditional and unambiguous — and critically, it must be sought separately for each distinct purpose. This means a single consent at program enrollment does not cover personalised coupon targeting, third-party brand offer sharing (common in mall loyalty programs at Select CITYWALK or Nexus Malls), or AI-driven behavioral profiling. Each of these is a distinct processing purpose requiring its own consent signal.

The second legal layer is TRAI's DLT (Distributed Ledger Technology) framework for commercial communications. Every brand sending coupon-bearing SMS messages must be registered on the Telecom Commercial Communications Customer Preference Register (TCCCPR), with their message templates and sender IDs pre-approved. Dynamic coupons create a specific compliance problem here: if the coupon code, discount value or expiry date changes per recipient — which is the entire point of a dynamic offer — the message is technically a variable-content template. TRAI's current DLT framework requires that variable fields be clearly delimited and that the core message template remain unchanged. Brands like Manyavar and FabIndia that run occasion-triggered dynamic offers must ensure their tech partner has pre-registered template structures that accommodate variable coupon fields without triggering TRAI's spam filters or UCC penalties.

The third layer is the Consumer Protection Act 2019 and its E-Commerce Rules, which require that discount claims be truthful, that expiry conditions be prominently disclosed, and that a coupon presented at point-of-sale cannot be refused without documented technical cause. For mall operators running multi-brand loyalty programs — think a Fundle Mall Loyalty deployment across 80+ tenant brands — the obligation to honor a coupon issued by the platform on behalf of a tenant is a contractual and regulatory matter simultaneously. Loyalty program heads must ensure their coupon issuance engine generates an immutable audit trail: who was issued what offer, under which consent, on what date, and whether it was honored or declined at the POS.

Specific Regulations Around Coupon Usage

Beyond the broad data protection and telecom layers, there are coupon-specific regulations that Indian loyalty program operators routinely underestimate. The Bureau of Indian Standards (BIS) has been working on a formal standard for loyalty program operations — while not yet fully notified, the draft IS 18519 framework signals the direction: mandatory disclosure of points and coupon expiry terms, prohibition on unilateral devaluation of earned rewards without notice, and a minimum grievance redressal timeline.

The GST treatment of coupons is a separate compliance minefield. Under GST rules, a discount coupon that reduces the taxable value of a supply at point-of-sale must be reflected in a credit note, and the discount must be established under an agreement entered into at or before the time of supply. Dynamic coupons issued in real time — say, a push notification sent 30 minutes before a customer's estimated mall visit based on geofencing — create a documentation gap if the brand's billing system does not record the coupon issuance as a pre-supply agreement. Apollo Pharmacy, which runs one of India's largest pharmacy loyalty programs, has had to build specific GST reconciliation workflows for coupon-driven discounts precisely because of this timing issue.

For alcohol and tobacco retail (relevant in certain mall contexts), additional restrictions under state Excise Acts prohibit coupon-based promotions entirely. Loyalty program heads managing mixed retail portfolios in malls must build category-level exclusion logic into their coupon engines — a capability that platforms like Petpooja (restaurant POS) or POSist have had to add specifically for compliance with FSSAI and state licensing conditions.

Finally, the Competition Commission of India (CCI) has shown increasing interest in loyalty program structures that could constitute exclusive dealing or market foreclosure. A mall operator that requires tenant brands to participate exclusively in the mall's loyalty coupon program — and penalizes them for running parallel coupon programs on D2C channels — risks a CCI Section 4 scrutiny on abuse of dominant position. This is not hypothetical: CCI has already examined loyalty program exclusivity in the aviation and telecom sectors. Retail mall loyalty operators need legal opinions specifically on exclusivity clauses in their tenant engagement agreements.

DPDP 2023 Impact and Compliance Requirements

The Digital Personal Data Protection Act 2023 is the single most consequential regulation for dynamic coupons loyalty India programs since the launch of the telecom DLT framework in 2018. The Act received Presidential assent in August 2023, and while the Data Protection Board and the accompanying rules are still being finalized by MeitY, the obligations of Data Fiduciaries under the Act are already legally operative. Waiting for the rules before building compliance architecture is not a viable strategy — the rules will sharpen enforcement, not create new obligations.

For a loyalty program head, the three most operationally impactful DPDP 2023 provisions are: first, the right of data principals (your customers) to withdraw consent at any time, with the withdrawal taking effect within a reasonable time — interpreted in draft guidance as 48–72 hours. This means your coupon trigger engine must be capable of halting all in-flight personalized offers for a specific customer within that window. Second, the obligation to retain personal data only as long as the specified purpose requires — which creates a hard conflict with legacy loyalty platforms that accumulate transaction histories indefinitely. Third, the prohibition on processing children's data without parental consent, which is relevant for any loyalty program with a family membership structure (common in mall loyalty programs at Phoenix Marketcity or DLF Mall of India).

The penalty structure under DPDP 2023 is steep. A Data Fiduciary that fails to implement appropriate security safeguards faces a fine of up to ₹250 crore. A breach of the consent obligations — including sending personalized coupon communications without a valid consent record — can attract fines of up to ₹200 crore. For a mid-size retail brand running a loyalty program with ₹40–60 lakh annual tech spend, this is an existential risk. For a mall operator managing 150+ brands on a unified loyalty platform, the liability exposure is even more acute because the platform operator likely qualifies as a Data Processor under the Act, with joint liability implications.

Compliance is not just about avoiding fines. The DPDP framework, when implemented well, is a competitive differentiator. Indian consumers in Tier 1 cities are increasingly aware of data privacy — a YouGov-MMA survey in 2024 found that 61% of Indian urban millennials said they were more likely to join a loyalty program that clearly explained how their data was used. A transparent, consent-first coupon program is not just legally required; it is commercially smarter.

Role of Consent Management Platforms Like ConsentFirst

A Consent Management Platform (CMP) is the technical infrastructure layer that sits between your customer-facing touchpoints — app, website, in-store tablet, WhatsApp enrollment flow — and your loyalty and coupon engine. It captures, stores, versions and makes auditable every consent signal a customer provides or withdraws. In the context of DPDP 2023 compliance, a CMP is not optional infrastructure; it is the evidence layer that proves your coupon communications were lawful.

ConsentFirst is one of the India-specific CMPs that has built its architecture around DPDP 2023 requirements — as opposed to GDPR-oriented CMPs like OneTrust or TrustArc that were designed for European regulatory structures. For Indian retail loyalty programs, the key difference is that DPDP 2023 uses a purpose-based consent model (you must specify what you will do with the data at the point of collection) rather than a lawful-basis model (which allows legitimate interest as an alternative to consent). ConsentFirst and similar India-first CMPs — including consent modules built into platforms like WebEngage and MoEngage when properly configured — enforce purpose tagging at the consent capture stage, which is exactly what a dynamic coupon program needs.

The practical integration challenge is significant. Most Indian mall loyalty platforms or brand loyalty setups have consent data living in four or five different systems: the enrollment CRM, the app backend, the SMS opt-in database (DLT registered), the WhatsApp Business API subscriber list, and often a separate email marketing list. These are not the same consent records. A customer who opted into WhatsApp communications for order updates at a Lifestyle store has not consented to receiving personalized discount coupons via WhatsApp. Sending that coupon without the correct consent record is a DPDP violation, regardless of whether the customer's number is technically in your WhatsApp contact list.

Fundle's integration with consentFirst CMP architecture means that when a Fundle AI Agent evaluates a customer for a dynamic coupon trigger — say, a win-back offer for a customer who has not visited a Manyavar store in 90 days — it first checks the consent record before generating the coupon or dispatching the communication. If the consent record is missing, expired or has been withdrawn, the AI Agent suppresses the trigger and flags the customer for a re-consent journey instead. This is not a manual compliance step; it is automated into the Fundle AI Workflow at the pre-trigger stage.

KPIs to Track for a Legally Compliant Dynamic Coupon Program

Compliance is not a one-time project; it is an operational state that requires continuous measurement. Indian retail marketing managers who treat DPDP compliance as a legal department task — rather than a marketing operations KPI — will find themselves caught off-guard during regulatory reviews or consumer complaints.

The first set of KPIs is consent quality metrics. Track consent capture rate (what percentage of enrolled loyalty members have a valid, purpose-specific DPDP consent record for coupon communications), consent withdrawal rate (a leading indicator of trust erosion — if this exceeds 8–10% in a quarter, your consent language or communication frequency is a problem), and re-consent campaign effectiveness (for legacy members whose consent records predate DPDP and need to be re-captured).

The second set is coupon compliance metrics. Track DLT rejection rate (the percentage of coupon SMSs rejected by TRAI's DLT infrastructure — anything above 2% signals a template or sender ID problem), coupon-to-consent linkage rate (the percentage of issued coupons that have a traceable, valid consent record — this should be 100%; anything below is a regulatory liability), and coupon honor rate at POS (the percentage of presented coupons that are successfully redeemed — unexplained declines above 5% risk Consumer Protection Act exposure).

The third set is commercial-compliance balance metrics. The goal is not to minimize coupon activity in the name of compliance; it is to maximize compliant coupon activity. Track incremental revenue per consented customer (customers with full, purpose-specific consent should show higher engagement because they are genuinely opted in), cost-per-compliant-redemption (the all-in cost of a coupon redemption that has a clean compliance trail), and regulatory incident rate (the number of DPDP complaints, TRAI grievances or Consumer Forum cases related to your coupon program per quarter — target zero).

For mall loyalty operators running Fundle Mall Loyalty across 80–150 tenant brands, an additional KPI is tenant compliance coverage: the percentage of participating brands whose coupon triggers are running through a DPDP-compliant consent record. A gap in tenant compliance creates platform-level liability for the mall operator.

How Fundle solves this

Fundle was built on a conviction that AI-driven loyalty and regulatory compliance are not opposing forces — they are mutually reinforcing. Vineet Narang's vision for the Fundle AI Platform was that a loyalty program which genuinely respects customer data preferences will, over time, accumulate higher-quality behavioral signals than one that hoovers up data indiscriminately and burns trust in the process. That philosophical stance has translated into specific architectural decisions that make Fundle the most compliance-ready dynamic coupon platform operating in Indian retail today.

The Fundle Loyalty Platform's coupon engine is natively integrated with purpose-specific consent management. Every dynamic coupon trigger — whether initiated by a Fundle AI Agent responding to a purchase event, a Fundle AI Workflow executing a win-back sequence, or a Fundle Agentic AI evaluating a real-time basket signal at a mall POS — begins with a consent record check. If the check fails, the trigger is suppressed and routed to a re-consent workflow. This is not a bolt-on compliance layer; it is the first node in every coupon generation graph on the platform. Fundle ensures legal and regulatory compliance in all dynamic coupon programs for 270+ Indian retail brands — a claim that is operationally grounded in this architecture, not a marketing assertion.

For mall operators, Fundle Mall Loyalty provides a centralized consent and coupon compliance dashboard that surfaces tenant-level compliance coverage in real time. A Phoenix Marketcity loyalty head can see, at a glance, which tenant brands have full consent coverage for their coupon audiences, which have gaps, and which are approaching their DPDP data retention limits. The Fundle AI Workflow automates the remediation steps: flagging lapsed consents, triggering re-enrollment campaigns, and pausing non-compliant coupon queues before they create regulatory exposure.

For enterprise retail brands running Fundle Brand Loyalty — think a Manyavar, a FabIndia or a Lifestyle operating their own closed-loop loyalty program — the platform provides pre-registered DLT template libraries for dynamic coupon communications, GST reconciliation APIs for coupon-driven discount documentation, and a complete DPDP consent audit export that can be produced within 72 hours of a regulatory inquiry. Fundle AI Agents handle the ongoing monitoring: tracking consent withdrawal signals, updating suppression lists, and generating weekly compliance health reports for the marketing and legal teams. The result is a dynamic coupon program that is commercially aggressive — personalized, behaviorally triggered, multi-channel — and legally defensible at every step of the issuance-to-redemption journey.