Fundle.ai: First Party Data Platform for Loyalty India: DPDP Compliance Guide

DPDP Regulatory Changes Affecting Loyalty Data

The DPDP Act 2023 introduces four structural changes that directly impact how loyalty programmes operate in India. First, and most consequentially, it replaces implied consent with explicit, purpose-specific consent. Today, most Indian loyalty schemes enrol members at the point-of-sale with a single checkbox or verbal confirmation — a practice that was commercially convenient but legally grey. Under DPDP, every distinct purpose of data processing requires a separate, granular consent notice. Collecting a mobile number to issue points is one purpose. Using that number to send a Diwali campaign is another. Sharing purchase history with a brand partner inside a mall coalition is a third. Each requires its own consent record with a timestamp and channel attribution.

Second, the Act establishes seven data principal rights that loyalty operators must operationalise — not just acknowledge in a privacy policy. These include the right to access a summary of personal data held, the right to correct inaccurate data, the right to erasure, the right to grievance redressal within a defined SLA, and the right to nominate a representative. For a mall operator running a loyalty scheme on legacy software — many still run on on-premise tools from vendors like Petpooja, POSist, GoFrugal, or Wondersoft — building a self-service member portal that honours these rights is a non-trivial engineering project.

Third, the Act requires data localisation for certain categories of sensitive personal data. While the final rules are awaited, loyalty data that includes financial transaction history, health-adjacent purchase data (relevant for Apollo Pharmacy or pharma retail loyalty), or children's data will almost certainly fall under heightened protection requirements. This has direct implications for cloud hosting architecture and any offshore data processing arrangements.

Fourth, the consent manager framework introduced in the Act creates a new intermediary layer. Consent managers — registered with the Data Protection Board — will allow consumers to manage all their data consents from a single interface, potentially cutting across multiple brands and loyalty programmes. For CIOs, this means loyalty platforms must expose consent APIs that are interoperable with these registered consent managers. Platforms that cannot support this integration will face structural obsolescence within two to three years. The shift from permission-by-default to permission-by-design is not cosmetic — it requires re-architecting the data collection layer of every loyalty programme in India.

Requirements for First Party Data Platforms

Not every CRM or loyalty platform qualifies as a first party data platform for loyalty India under the DPDP framework. The compliance gap between what most platforms offer and what the law demands is significant, and CMOs evaluating vendors need to ask hard technical questions before FY26 budgets are locked.

The foundational requirement is a consent ledger — an immutable, timestamped record of every consent event for every data principal. This is distinct from a standard opt-in log. A DPDP-grade consent ledger must record the exact consent notice shown to the member (versioned), the channel on which consent was collected (POS terminal, app, SMS, WhatsApp), the purpose for which consent was given, and any subsequent withdrawal or modification. Platforms like Capillary, EasyRewardz, and Xeno have strong CRM capabilities but were not architecturally designed around DPDP's consent-ledger requirement. Retrofitting consent management onto an existing CDP or loyalty engine is technically complex and carries audit risk.

The second requirement is a member-facing data rights portal. This is not a static privacy policy page. It is a live, authenticated interface where a Reliance Trends or FabIndia loyalty member can view their data, request correction, download a structured export, or submit a deletion request — with the platform completing the request within the DPDP-mandated timeline and generating a compliance event log. Building this on top of a platform that was not designed for it means custom development that creates maintenance debt.

Third, the platform must support purpose-bound data activation. When a loyalty marketer at Lifestyle wants to run a re-engagement campaign targeting lapsed members, the platform must automatically filter the audience to members who have consented to that specific communication purpose. This is not a manual segmentation step — it must be enforced at the data layer, not the campaign execution layer. The distinction matters enormously for audit readiness.

Fourth, for mall coalition programmes, the platform must enforce consent at the brand-partner level. A member who shops at Cafe Coffee Day inside a Phoenix mall and consents to points issuance has not necessarily consented to CCD receiving their cross-mall purchase history. The consent architecture must be granular enough to honour these distinctions, which requires a data model that is materially more complex than what most coalition loyalty engines in India currently run.

Finally, the platform must support API-level integration with POS systems. India's retail POS ecosystem is fragmented — POSist, GoFrugal, Wondersoft, Petpooja, and dozens of proprietary systems all co-exist within a single mall. A DPDP-compliant loyalty platform cannot rely on manual data uploads or batch ETL jobs that obscure consent chain-of-custody. Real-time POS integration is not just a feature — under DPDP, it is a compliance necessity.

Transparency and Consumer Rights under DPDP

The DPDP Act's consumer rights provisions are, in practical terms, a customer experience challenge as much as a legal one. Retailers who treat the data rights portal as a compliance checkbox will miss the commercial opportunity embedded in the obligation. Brands that build genuinely transparent, easy-to-use data control experiences will differentiate on trust — a scarce commodity in Indian retail CRM, where most consumers have no idea what data their loyalty programme holds.

Consider the access right. Under DPDP, a loyalty member can request a summary of what personal data the operator holds. For a Manyavar loyalty member who has transacted across six cities over three years, this summary might include transaction history, demographic data, communication preferences, inferred lifestyle segments, and partner-shared data from a coalition programme. Delivering this in a readable, jargon-free format within a statutory timeline is an engineering and UX challenge. Platforms that expose raw database exports will frustrate members and attract regulator attention. Platforms that deliver a clean, human-readable data summary through a branded member app will build trust.

The erasure right presents the sharpest operational challenge. When a member requests deletion, the loyalty operator must purge personal data from the primary system, from any partner systems where data was shared, and from backup and analytics environments — while retaining only what is necessary for legitimate legal or financial record-keeping. For a mall coalition scheme where data flows across 50 or more brand partners, operationalising erasure requires a data lineage map that most current platforms do not maintain.

The correction right is commercially underrated. Inaccurate data — wrong mobile numbers, misattributed transactions, outdated addresses — silently destroys loyalty programme ROI. A DPDP-mandated correction workflow, if designed well, becomes a data quality improvement mechanism. Operators who encourage members to verify and correct their data through the rights portal will find their first-party data assets become meaningfully more accurate over 12–18 months.

The grievance redressal obligation requires appointing a Data Protection Officer and publishing a contact mechanism with a defined response SLA. For mid-sized mall operators and single-brand retailers, this is often the most overlooked DPDP requirement. A consumer who cannot reach the DPO within a reasonable time has a direct escalation path to the Data Protection Board — and a ₹10,000 per-day penalty clock starts running on the operator.

Tools and Technologies to Ensure Compliance

The Indian martech and loyalty-tech vendor landscape has matured rapidly but DPDP compliance capability varies enormously across the field. CMOs and CIOs evaluating platforms in 2025 need to assess vendors across five technology dimensions: consent management infrastructure, data rights workflow tooling, POS integration depth, consent-aware AI activation, and audit reporting.

On consent management, the dominant CRM platforms in Indian retail — MoEngage, WebEngage, and Capillary — have added consent fields and preference centres to their products but these implementations are typically layered on top of existing architectures rather than native to the data model. The practical risk is that consent status can fall out of sync with campaign execution in ways that are not immediately visible in the campaign dashboard but are clearly visible in an audit log. Almonds.ai and Customer Capital offer niche loyalty capabilities but similarly lack purpose-built DPDP consent ledger infrastructure at this stage.

For POS integration, depth matters more than breadth. A platform that claims to integrate with 50 POS systems via generic webhooks is not the same as one that has certified, real-time API integrations with POSist, GoFrugal, and Wondersoft that pass consent metadata alongside transaction data. The former creates compliance gaps at the most important data collection point in retail — the moment of purchase.

Consent-aware AI activation is the emerging differentiator. As Indian retailers invest in AI-driven personalisation — next-best-offer engines, churn prediction, basket size optimisation — the AI models must operate only on data for which the necessary consent exists. A loyalty platform that runs AI on the full member dataset without consent filtering is creating regulatory liability with every model run. The architecture requirement is a consent-aware feature store that automatically excludes non-consented data attributes from model training and inference.

Audit reporting capability is often assessed last but matters first in a regulatory examination. The platform must be able to produce, on demand, a complete data processing record for any individual member — every consent event, every data access, every campaign inclusion, every partner data share — in a format that satisfies a Data Protection Board inquiry. Platforms that cannot produce this report within hours are not DPDP-ready regardless of their other capabilities.

Fundle's platform supports Indian POS and brand integrations ensuring DPDP compliance — a design principle that runs from the consent collection layer through to campaign activation and audit reporting, rather than being bolted on as a compliance module.

How Fundle solves this

Fundle was designed from inception as a consent-first, AI-native loyalty platform — not a legacy CRM with a compliance module stapled to the side. The Fundle AI Platform treats the consent ledger as a core data primitive, not an afterthought. Every member record in the Fundle Loyalty database carries a live consent state object that is updated in real time as members grant, modify, or withdraw consent across channels. This consent state is not a flag in a CRM field — it is a versioned, append-only ledger entry that satisfies DPDP audit requirements without any additional reporting configuration.

For mall operators, Fundle Mall Loyalty delivers the coalition consent architecture that India's complex mall ecosystem demands. A member shopping at a Phoenix Marketcity or Select CITYWALK property can consent to points issuance, mall-level marketing, and individual brand-partner communications as separate, independently revocable permissions. Fundle Mall Loyalty enforces these permissions at the brand-partner API layer — no brand receives data beyond what the member has explicitly permitted, regardless of what the brand's own marketing team requests. This is not a policy commitment — it is a technical enforcement that creates an audit trail.

For enterprise retail brands — whether a single-brand CRM for a Lifestyle or a multi-format loyalty scheme for a large pharmacy chain — Fundle Brand Loyalty delivers purpose-bound AI personalisation. The Fundle AI Agents that power next-best-offer, churn prediction, and win-back campaigns operate exclusively on consent-approved data attributes. The Fundle AI Workflow orchestrates campaign execution so that every audience segment is certified consent-compliant before a single message is dispatched. Fundle Agentic AI can autonomously detect when a member's consent state changes — a withdrawal, for instance — and immediately suppress that member from all active campaign queues without waiting for a nightly batch job.

Vineet Narang's founding vision for Fundle was that Indian retail loyalty had conflated data volume with data value for too long. A consent-based loyalty data management architecture, properly implemented, produces a smaller but exponentially more actionable first-party data asset. The brands on the Fundle AI Platform are already seeing this in practice: opt-in rates above 70% among members enrolled through the Fundle consent flow, versus industry averages of 30–40% for legacy enrolment methods. Higher opt-in rates mean larger activated audiences, more accurate AI models, and loyalty economics that improve as the consent base compounds — precisely the opposite of what most compliance teams fear when they hear 'DPDP'.