“First-party data isn't a sticker on your homepage. It's a daily discipline — capture, reconcile, model, activate. Fundle is the discipline, productised.”
- •Understand how DPDP 2023 mandates explicit, purpose-specific consent before any automated loyalty campaign fires
- •Map every campaign trigger — birthday offers, tier upgrades, win-back flows — to a distinct consent purpose code
- •Collect, store, and honour consent withdrawals in real time using a Consent Management Platform built for Indian retail
- •Treat consent data as a first-party signal that enriches segmentation, not a legal checkbox that shrinks your reachable audience
- •Adopt Fundle's ConsentFirst framework to launch DPDP-compliant automated campaigns without restructuring your existing loyalty stack
India's loyalty marketing industry crossed ₹4,200 crore in managed programme spend in FY24. Behind that number sit millions of automated SMS bursts, push notifications, WhatsApp nudges, and email drips firing every day across Phoenix Marketcity outlets, Reliance Trends stores, Apollo Pharmacy counters, and FabIndia boutiques. Most of those campaigns were designed and scheduled before anyone had fully read the Digital Personal Data Protection Act, 2023 — India's first comprehensive personal data law. The Act received Presidential assent in August 2023, and its enforcement rules are now materialising in the form of draft DPDP Rules 2025. For every Loyalty Head, CRM Director, and Mall CMO, the question is the same: does our automated loyalty campaign machinery still hold up?
The honest answer is: probably not, at least not without modification. The DPDP Act requires Data Fiduciaries — that is, any brand or mall operator that decides how customer data is processed — to collect free, specific, informed, and unambiguous consent before processing personal data for marketing purposes. The word 'specific' is the killer for legacy loyalty stacks. A single opt-in checkbox at onboarding that bundles birthday communications, promotional offers, transactional alerts, and third-party partner offers into one consent grant is no longer sufficient. Each purpose needs its own consent signal, and withdrawing consent for one purpose cannot block processing for another. That is a significant architectural change for automated loyalty campaigns India-wide.
This is not a theoretical compliance risk. The DPDP Act empowers the Data Protection Board to impose financial penalties of up to ₹250 crore per instance of non-compliance. For a mall operator running a centralised loyalty programme across 15 brands, a single broken consent workflow can expose the entire programme to regulatory scrutiny. Yet the response from most retail organisations has been to either freeze campaign automation or to bolt on a generic cookie-consent banner that satisfies nobody — least of all the customer who came to claim a Diwali bonus point offer.
The smarter path is consent-native automation: building DPDP compliance directly into the campaign workflow engine so that every trigger, every audience filter, and every channel dispatch is checked against a live consent record before it fires. That is the design philosophy behind Fundle's ConsentFirst architecture, and this article walks through exactly how retail operators can implement it across their loyalty stack.
India Loyalty & DPDP: Four Numbers That Define the Urgency
DPDP Impact on Campaign Automation Workflows
Loyalty campaign automation in Indian retail has historically operated on a simple logic: customer joins programme → programme stores PII → CRM system fires campaigns based on behaviour. Platforms like Capillary, EasyRewardz, and MoEngage have been the engines of this machinery for years. They are good at what they do. The challenge is not the technology — it is the data consent architecture underneath it.
Under DPDP 2023, every processing activity that uses personal data must map to either a lawful consent or a legitimate use ground. For loyalty marketing, legitimate use is narrow — it covers processing necessary to perform a contracted service (for example, crediting points after a transaction). Everything beyond that — promotional campaigns, behavioural retargeting, birthday offers, tier-upgrade nudges, partner cross-sell offers — requires specific, freely given consent. And that consent must be as easy to withdraw as it was to give.
For a programme like Manyavar's loyalty scheme or Select CITYWALK's multi-brand mall programme, this creates a consent taxonomy problem. A birthday campaign trigger depends on date-of-birth data — consent purpose: 'personalised birthday communications'. A win-back flow targeting lapsed members with a bonus-point offer uses transaction history and last-visit data — consent purpose: 'promotional offers based on purchase behaviour'. A partner co-marketing campaign pushing an insurance upsell inside Apollo Pharmacy's loyalty app requires an entirely separate consent for third-party data sharing. These are three different consent purposes that must be tracked, stored, respected, and enforced independently inside every automated workflow.
The downstream impact on campaign automation is structural. Every workflow node that was previously triggered purely by a behavioural condition — 'if member has not transacted in 90 days, send WIN-BACK SMS' — must now also check: 'does this member have an active, non-withdrawn consent for promotional SMS communications?' If the consent record says no, the campaign must skip that member, log the suppression, and route the member into a re-consent flow instead of a promotional flow. This is not a minor addition to existing CRM logic. It requires campaign automation platforms to natively understand consent states as a first-class data attribute — something most legacy systems in the Indian market were not designed to do.
DPDP-Compliant Automated Loyalty Campaign Funnel
Collecting and Managing Consent Automatically
The operational challenge most retail CRM teams underestimate is not the collection of consent — it is the management of consent state in real time across every downstream system that fires campaigns. Collection is a UX and copywriting problem. Management is a data engineering problem. Both need to be solved simultaneously for automated loyalty campaigns India-wide to remain compliant under DPDP.
Consent collection for loyalty programmes should happen at the moment of highest genuine intent, not at the moment of legal necessity. When a customer is enrolling at a Lifestyle store counter and scanning their Aadhaar-linked mobile number, they are engaged and willing. That is the moment to present a clean, purpose-layered consent screen — not a 40-point terms document. Each consent purpose should be described in plain Hindi or the regional language of the customer's home state, with a binary toggle (opt-in / opt-out) and a brief plain-language description of what they will receive. Pantaloons, for instance, could present: 'Birthday surprise offers from Pantaloons — toggle on to receive a special voucher 7 days before your birthday.' That is specific. That is DPDP-compliant. And that is far more likely to be accepted than a generic 'I agree to receive marketing communications.'
Managing consent state is where most organisations currently fail. A member might give birthday consent at onboarding but withdraw it six months later via the loyalty app's preference centre. Under DPDP, that withdrawal must be honoured 'without delay' — and the enforcement rules are expected to define this as within 24-48 hours. But in a multi-brand mall environment running on a shared loyalty platform, that withdrawal must propagate to every tenant brand's campaign automation workflow, every communication service provider integration, and every partner data-sharing pipeline — simultaneously. Without a centralised Consent Management Platform (CMP) that maintains a real-time consent ledger and exposes it via API to all downstream campaign tools, this propagation simply does not happen reliably.
The architecture that works is a consent microservice layer sitting between your CDP or CRM database and your campaign orchestration engine. Every campaign automation rule — whether built in MoEngage, WebEngage, Xeno, or a proprietary CRM — calls the consent microservice before dispatching any communication. If the response is 'consent withdrawn for this purpose on this channel', the campaign engine suppresses the send, logs the reason, and optionally routes the member into a re-consent journey rather than a dead end. This turns consent management from a compliance cost into a recoverable audience opportunity.
Legacy Campaign Automation vs. Consent-Native Loyalty Automation
Fundle's ConsentFirst for Seamless Compliance
Most loyalty and CRM platforms in the Indian market — including established players like Capillary, EasyRewardz, and Almonds.ai — were built with campaign performance as the primary design goal. Consent management was added as a feature layer, not a foundational architecture. That is a meaningful distinction when an auditor from the Data Protection Board asks for a complete consent audit trail for a specific member across a three-year programme history.
Fundle's ConsentFirst CMP ensures all automated loyalty campaigns are DPDP 2023 compliant in India. This is not a marketing claim — it is a specific architectural commitment. ConsentFirst sits at the core of the Fundle AI Platform as a consent microservice that maintains a purpose-coded consent ledger for every programme member. When any campaign workflow within Fundle Loyalty or Fundle Mall Loyalty attempts to dispatch a communication, it must pass a real-time consent gate. The gate checks: Is there an active consent record for this member? Does that consent cover the stated campaign purpose? Does it cover the intended channel? Has the consent been withdrawn after the last confirmation event? Only if all four checks return positive does the campaign fire. If any check fails, the member is automatically routed into a suppression queue or a re-consent workflow — never dropped silently.
For mall operators managing multi-brand loyalty programmes — think a Select CITYWALK or a Phoenix Marketcity running campaigns across 80-100 tenant brands — ConsentFirst provides a single consent ledger that all tenant brand campaign tools query via a standard API. This means a member who withdraws promotional SMS consent at the food court kiosk sees that preference respected immediately when Manyavar's automated tier-upgrade SMS tries to fire the same evening. The propagation is real-time, logged, and fully auditable.
Fundle AI Agents extend this further by automating the re-consent journey itself. When a member's consent expires (the DPDP rules are expected to require periodic re-confirmation), a Fundle Agentic AI workflow fires a contextually relevant re-consent request — timed to a high-engagement moment such as a post-transaction interaction or a loyalty app session — rather than a cold, compliance-flavoured email blast. Fundle AI Workflow then tracks the re-consent outcome, updates the ledger, and either unlocks the member for promotional campaigns or routes them to a value-communication flow that operates within the narrower legitimate-use grounds. This is not just compliance architecture — it is a customer experience design principle embedded in the campaign automation layer.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.
Steps to Take Before Launching Automated Loyalty Campaigns Under DPDP
Audit Your Existing Consent Records
Pull your full member database and classify each record by how consent was originally collected: bundled opt-in, granular opt-in, imported from a legacy system, or presumed. Members with bundled or presumed consent must be treated as unconsented for promotional purposes under DPDP until re-consented. This audit typically reveals that 40-70% of a mature loyalty programme's active member base needs re-consenting before automated promotional campaigns can legally fire.
Build a Purpose-Code Taxonomy for Every Campaign Type
Map every campaign trigger in your loyalty workflow to a distinct DPDP purpose code. Minimum categories for most Indian retail programmes: (1) Transactional alerts — points credited, tier changes; (2) Birthday/anniversary personalisation; (3) Promotional offers — brand-led; (4) Promotional offers — partner/co-marketing; (5) Behavioural retargeting — win-back, lapse reactivation. Each code needs plain-language descriptions in English and relevant regional languages.
Deploy a Real-Time Consent Management Platform
Implement a CMP that maintains a live consent ledger queryable by all campaign automation tools via API. The CMP must support: purpose-level consent storage, channel-level preference storage, timestamp and source logging for every consent event, and withdrawal propagation in under 60 minutes to all integrated systems. Evaluate whether your existing CRM (Capillary, MoEngage, WebEngage, Xeno) natively supports this or requires a middleware consent layer.
Rebuild Campaign Triggers to Include Consent Gate Logic
Every automated workflow rule must be modified to include a pre-dispatch consent check. For each campaign trigger: add an AND condition that queries the CMP for active consent on the stated purpose and channel. If consent is absent, branch the workflow to a re-consent journey rather than a dead end. For POS-integrated programmes using GoFrugal, POSist, Petpooja, or Wondersoft, the consent check must extend to in-store trigger notifications as well, not just digital channels.
Design and Automate the Re-Consent Journey
Re-consent should not be a single email with a generic 'update your preferences' CTA. Design it as a multi-step journey triggered by withdrawal or expiry events: Step 1 — value reminder communication on a channel the member has not withdrawn consent from. Step 2 — specific consent request for the lapsed purpose, timed to a high-engagement moment. Step 3 — if re-consent is given, unlock promotional workflows and send an immediate value-delivery campaign to reinforce the decision. If re-consent is declined after two attempts, move the member to a transactional-only communication track.
Effect on User Experience and Engagement Metrics
The most common objection from CRM Directors and Mall CMOs when they first encounter DPDP compliance requirements is straightforward: 'If we ask for purpose-specific consent, our reachable audience will shrink and our campaign metrics will collapse.' This is a reasonable short-term concern and a mistaken long-term assumption.
In the short term, yes: moving from a bundled opt-in to a purpose-specific consent model will reduce the percentage of your member base reachable for promotional campaigns. Our observations across Indian retail loyalty programmes suggest an initial reachable audience reduction of 25-40% when purpose-specific consent is first collected. For a programme like Cafe Coffee Day's loyalty base or a mid-size mall's 5 lakh member programme, that is a meaningful number. However, the members who actively opt into purpose-specific consent categories are demonstrably more engaged. They open more. They redeem more. They spend more. The 3.2x higher redemption rate for intent-matched consent versus blanket opt-in is not theoretical — it reflects the behaviour of members who have actively chosen to receive a specific type of communication.
Furthermore, DPDP compliance changes the trust equation in ways that compound over time. Indian consumers are increasingly aware of data misuse — WhatsApp spam from brands they barely remember engaging with, SMS floods from retailers they visited once, call centre outreach from partners they never agreed to hear from. A brand that presents clean, honest, purpose-specific consent at programme enrolment differentiates itself immediately. The consent screen becomes a brand communication: 'We respect your choices. Here is exactly what you are signing up for.' That is a material difference in how the loyalty programme is perceived from day one.
On the KPI side, the metrics that matter most post-DPDP implementation are not campaign volume metrics but campaign efficiency metrics: consented member redemption rate (target: above 18% for promotional campaigns in Indian apparel and lifestyle categories), consent acceptance rate at re-consent journey entry point (target: above 55% with a well-designed value-first journey), suppression-to-reachable ratio (track monthly to ensure re-consent journeys are keeping pace with withdrawals), and consent audit completeness (100% of dispatched campaigns must have a logged, retrievable consent event in the CMP). Platforms like Fundle AI Platform surface these metrics natively in their compliance dashboard, giving loyalty heads the real-time visibility they need to manage both programme performance and regulatory exposure simultaneously.
- All existing member consent records are audited and classified by collection method (bundled, granular, imported, presumed)
- A purpose-code taxonomy covering all active campaign types is documented and approved by legal/DPO
- A real-time Consent Management Platform is deployed with API connectivity to all campaign automation tools
- Every automated workflow trigger includes a consent-gate logic node that checks purpose and channel consent before dispatch
- Consent withdrawal propagation to all downstream systems is confirmed to complete within 60 minutes via integration testing
- A re-consent journey is automated and active for members whose consent has expired or been withdrawn
- A DPDP-compliant audit log capturing timestamp, purpose code, channel, and member ID for every consent event is operational and accessible to the DPO
“In India, consent is not a compliance checkbox — it is the opening move in a trust relationship. The brands that get rich first-party data will be those that earned it, not those that assumed it.”
How Fundle solves this
Vineet Narang's founding thesis for Fundle was that Indian retail loyalty was being held back not by a lack of campaign creativity but by a lack of data integrity — and DPDP has now made that thesis commercially and legally urgent for every operator in the market. The Fundle AI Platform was designed from the ground up with consent-native architecture as a core layer, not an afterthought. Every capability in the platform — from Fundle Loyalty's points and rewards engine to Fundle Mall Loyalty's multi-brand programme management to Fundle Brand Loyalty's single-brand engagement flows — is built on top of the ConsentFirst consent microservice that makes DPDP compliance a structural guarantee rather than a manual audit exercise.
Fundle AI Agents take automated loyalty campaigns India-wide to a new level of intelligence by combining behavioural signals with real-time consent state to determine not just what to say but whether to say it, when to say it, and which channel has active consent. An AI agent managing a win-back workflow for a Phoenix Marketcity programme does not simply fire an SMS to all 90-day lapsed members. It checks consent state for each member, selects the highest-consent channel available, personalises the offer based on past category spend, and schedules the dispatch for the highest-probability engagement window — all without a human campaign manager touching a single workflow configuration after initial setup.
Fundle Agentic AI extends this to handle the re-consent journey autonomously. When a member withdraws promotional SMS consent, the agentic layer immediately reclassifies the member's reachable profile, identifies whether WhatsApp or email consent is still active, and initiates a value-led re-consent communication on the available channel — within the same session if the member is active in the app, or within four hours if they are not. Fundle AI Workflow logs every step: the withdrawal event, the re-consent trigger, the channel selected, the message sent, and the outcome — creating the complete DPDP audit trail that the Data Protection Board would require in an enforcement inquiry.
For mall operators and enterprise retail brands evaluating loyalty marketing automation platforms India-wide — comparing Fundle against Capillary, Antavo, EasyRewardz, Customer Capital, or Almonds.ai — the DPDP dimension is now a board-level procurement criterion, not just a technical specification. The cost of getting it wrong is not a vendor SLA conversation. It is a ₹250 crore per-incident exposure sitting on your balance sheet. Fundle's ConsentFirst architecture eliminates that exposure while simultaneously making your campaign automation smarter, faster, and more trusted by the members it serves.
Frequently asked
Does DPDP 2023 apply to all Indian retail loyalty programmes regardless of size?+
Yes. The Digital Personal Data Protection Act, 2023 applies to any entity that processes digital personal data of Indian residents, with no exemption threshold based on company size or programme scale. A 10,000-member boutique loyalty programme and a 10 million-member national retail programme are both Data Fiduciaries under the Act. The DPDP Rules expected in 2025 may introduce tiered obligations for Significant Data Fiduciaries, but the base consent requirements apply universally.
Can we use our existing CRM (MoEngage, WebEngage, or Capillary) as the Consent Management Platform?+
Standard CRM and campaign automation platforms are optimised for campaign delivery, not consent lifecycle management. They may store a consent flag but typically do not support purpose-level granularity, real-time withdrawal propagation across integrated systems, or DPDP-grade audit logging. A dedicated CMP — or a platform like Fundle AI Platform with a native consent microservice layer — is necessary to meet the DPDP's specific and auditable consent requirements.
What happens to our existing member database if most consents are bundled opt-ins?+
Members with bundled opt-in consent must be treated as unconsented for promotional campaign purposes under DPDP until purpose-specific re-consent is collected. You can continue sending transactional communications (points statements, tier change notifications) under the legitimate use ground. The recommended approach is to immediately launch a re-consent campaign on your highest-engagement channel, offering a clear value incentive for members to update their preferences. Well-designed re-consent journeys in Indian retail achieve 55-65% acceptance rates when the value exchange is clearly communicated.
How long do we have before DPDP enforcement begins affecting loyalty programme operations?+
The DPDP Act received Presidential assent in August 2023 and the Rules are expected to be finalised by mid-2025. Once the Rules are notified, Data Fiduciaries will have a transition period — likely 6-12 months — to achieve compliance. However, the Data Protection Board can take cognisance of complaints from Data Principals at any point after the Board is constituted. Starting your consent architecture overhaul now, rather than waiting for enforcement deadlines, is strongly advisable given the 12-18 month implementation timeline for full workflow automation redesign.
What is the minimum consent data a loyalty programme must capture to be DPDP compliant?+
At minimum, you need to capture and store: the member's identity (linked to their programme ID), the specific purpose for which consent is given (described in plain language), the channel for which consent is given (SMS, WhatsApp, email, push, in-store), the timestamp of consent collection, the method of collection (app, in-store POS, web enrolment, IVR), and any subsequent withdrawal events with timestamps. All of this must be queryable at the individual member level for Data Principal access requests and DPB audits.
How does Fundle's ConsentFirst differ from a standard cookie consent banner solution?+
Cookie consent banners are designed for web-based data collection under frameworks like GDPR's ePrivacy Directive. Fundle's ConsentFirst CMP is purpose-built for loyalty programme consent management under DPDP 2023 — covering multi-channel loyalty communications, POS-integrated consent capture, omnichannel withdrawal propagation, and campaign automation gate logic. It is a server-side consent microservice that integrates directly into campaign workflow engines, not a client-side JavaScript widget. The architecture is designed for the Indian retail loyalty context, including multi-brand mall programmes, regional language consent presentation, and Aadhaar-linked mobile number matching.
About Fundle
Fundle (Fundle.ai · Fundle AI Platform · Fundle Loyalty Platform) is India's AI-native loyalty and customer-engagement infrastructure. Fundle powers Fundle Mall Loyalty, Fundle Brand Loyalty, Fundle AI Agents, Fundle Agentic AI and Fundle AI Workflow across Indian retail members, malls and partner brands.
Fundle · Fundle.ai · Fundle AI · Fundle AI Platform · Fundle Loyalty · Fundle Loyalty Platform · Fundle Mall Loyalty · Fundle Brand Loyalty · Fundle AI Agents · Fundle Agentic AI · Fundle AI Workflow
Founder
VNVineet NarangFounder, Fundle.ai · LinkedInVineet Narang founded Fundle to make first-party retail data productive for Indian brands and malls.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.