“Tier-based programs work — but only if the next-best-action engine knows that a Gold customer in Mumbai behaves differently from a Gold customer in Pune. That granularity is the Fundle default.”
- •Understand which Indian laws directly govern loyalty programs for shopping malls India — DPDP 2023, Consumer Protection Act 2019, and IT Act 2000 all apply simultaneously
- •Recognise that poorly drafted T&Cs and missing consent trails are the two most common legal failure points for mall loyalty programs
- •Quantify the reputational and financial cost of non-compliance before your program scales past 100,000 members
- •Implement ConsentFirst CMP as a structured consent-management layer across every brand touchpoint inside the mall
- •Adopt Fundle Mall Loyalty's built-in audit trails, data-residency controls, and automated consent workflows to stay audit-ready year-round
Loyalty programs for shopping malls India have quietly crossed a tipping point. What began as stamp cards and paper coupons at DLF Promenade or Inorbit Mall has evolved into sophisticated, data-intensive engagement ecosystems — multi-brand point ledgers, AI-driven personalisation, push notifications timed to footfall spikes, and cross-category redemption journeys that stitch together everything from Tanishq to Cafe Coffee Day within a single mall app. The data architecture underneath these programs is now indistinguishable from that of a mid-sized fintech.
That evolution brings legal exposure that most mall marketing heads are simply not prepared for. The Digital Personal Data Protection Act 2023 (DPDP) received Presidential assent in August 2023. The Consumer Protection Act 2019 and its associated e-commerce rules have teeth that extend to loyalty redemption terms. The Information Technology Act 2000, particularly Section 43A, still governs data-breach liability. And the RBI's guidelines on co-branded prepaid instruments become relevant the moment your loyalty currency can be exchanged for cash-equivalent vouchers. Running a mall loyalty program in 2025 without a legal framework is not bold — it is reckless.
The irony is that compliance anxiety is causing many mall operators to under-invest in data capture, which is precisely the wrong response. The answer is not to collect less data; it is to collect data correctly, with documented consent, clear purpose limitation, and a defensible audit trail. Platforms like Fundle AI Platform are built on that principle — consent is not a checkbox bolted on at the end; it is the first architectural decision.
This article is written specifically for Mall Marketing Heads and Loyalty Program Managers at properties like Phoenix Marketcity, Select CITYWALK, Nexus Malls, and Oberoi Mall who are either launching a new program or auditing an existing one. We will walk through the regulatory landscape, the specific clauses that trip up mall programs, what a compliant consent management framework looks like, and what happens to a mall's brand equity when it gets this wrong.
The Compliance Risk Landscape for Indian Mall Loyalty Programs
Overview of Indian Regulations Applicable to Loyalty Programs for Shopping Malls India
Mall loyalty programs sit at the intersection of at least four distinct regulatory regimes in India, and the compliance burden is not merely additive — it is multiplicative. Each regulation introduces its own definitions, obligations, and enforcement timelines, and they do not always align neatly.
The Digital Personal Data Protection Act 2023 is the most consequential new entrant. It defines any information by which a natural person can be identified — name, mobile number, email, purchase history, location — as personal data, and it requires that a Data Fiduciary (your mall entity) obtain free, specific, informed, and unambiguous consent before processing it. For a loyalty program, this means the enrolment form, the app onboarding flow, and every subsequent marketing communication must carry a legally valid consent trigger. Bundled consent buried in a 12-page PDF does not satisfy this standard.
The Consumer Protection Act 2019 is equally relevant, particularly Section 2(47) which defines 'unfair trade practice.' If a mall's loyalty T&Cs include point-expiry clauses that are not prominently disclosed, or if redemption blackout periods are buried in fine print, the Central Consumer Protection Authority has grounds to act. Programs like those at Lifestyle, Pantaloons, or Reliance Trends that operate inside malls must each ensure their brand-level T&Cs align with the overarching mall program rules — a governance challenge most operators currently handle informally.
The IT Act 2000, Section 43A, continues to apply to any entity that handles 'sensitive personal data or information' (SPDI), which includes financial information and health data. The moment your loyalty app integrates with Apollo Pharmacy's prescription history or a premium card that stores UPI transaction data, you are in SPDI territory and must maintain a documented information security programme. The RBI's prepaid payment instrument (PPI) guidelines kick in as a fourth layer if your loyalty points are convertible to cash or used as a payment instrument — a reality at several large mall programs that offer wallet top-up as a redemption option. Navigating all four layers simultaneously is the core legal challenge for mall loyalty program management.
The Legal Compliance Funnel for a Mall Loyalty Program
DPDP 2023 and Consumer Data Privacy in Mall Loyalty Programs
The DPDP Act 2023 will reshape how Indian mall operators think about data more profoundly than any regulation before it, including the IT Act. The key provisions mall loyalty managers must internalise are: lawful purpose, consent notice standards, data principal rights, and the obligations of Data Processors.
Lawful purpose means you must state, at the point of enrolment, exactly why you are collecting each data field. Collecting date of birth to send a birthday bonus is a lawful purpose. Sharing that DOB with a third-party brand partner to run independent retargeting campaigns is a separate purpose requiring separate consent. Mall programs that operate as multi-brand platforms — think the loyalty programs running across 200-plus stores at Phoenix Marketcity — must maintain a purpose registry that maps each data element to each processing activity for each brand tenant. This is not theoretical; it is a specific obligation under Clause 7 of the DPDP Rules (draft).
Consent notice standards under DPDP are materially higher than what most mall programs currently meet. Notices must be in clear, plain language, available in languages spoken by the data principal if requested, and must not be bundled with acceptance of general T&Cs. A single 'I agree' checkbox that encompasses both the loyalty T&Cs and the data processing consent is non-compliant. Mall operators running legacy CRM stacks — many of which were built on platforms like EasyRewardz or older Capillary deployments — will need to retrofit their consent capture flows before enforcement begins.
Data principal rights introduce operational complexity that is easy to underestimate. A member at Select CITYWALK has the right to access all data held about them, correct inaccuracies, and request erasure. For a mall loyalty program spanning Manyavar, FabIndia, and a food court, where transaction data flows through multiple POS systems (POSist, Petpooja, GoFrugal, Wondersoft), fulfilling a data deletion request within the mandated 30-day window requires deep system integration — not just a front-end toggle. Programs that cannot execute this operationally face both regulatory risk and member trust erosion. The penalty for wilful non-compliance can reach ₹250 crore per incident, a figure that dwarfs the annual marketing budget of most Indian malls.
Compliant vs. Non-Compliant Mall Loyalty Program Setup
Terms and Conditions Compliance: Where Mall Loyalty Programs Leak the Most Legal Risk
If DPDP is the regulation most talked about in boardrooms, the Consumer Protection Act 2019 is the one most likely to generate actual consumer complaints and public embarrassment. In the context of loyalty programs for shopping malls India, T&C failures cluster around four recurring problem areas: point expiry, redemption restrictions, unilateral program modification, and dispute resolution.
Point expiry is the most litigated area. The Central Consumer Protection Authority has taken cognisance of cases where accumulated loyalty currency was expired without adequate notice. A standard 12-month rolling expiry is commercially defensible, but only if it is disclosed at the point of enrolment, reiterated 60 and 30 days before expiry via direct communication, and not applied retroactively when program rules change. Programs at large malls that have migrated platforms — switching from one CRM vendor to another — have been caught in situations where legacy point balances were written off as a data migration convenience, which is legally indefensible.
Redemption restrictions cause friction when brand-level blackout periods are not disclosed mall-wide. A member who accrues points at Lifestyle, Tanishq, and Lenskart inside the same mall and then finds redemption blocked during Diwali peak — without prior notice — has a legitimate grievance under Section 2(47) of the CPA. The fix is straightforward: publish a consolidated redemption calendar at the start of each financial quarter, pin it in the app, and send a push notification 72 hours before each blackout window opens.
Unilateral program modification is a minefield. Many mall loyalty T&Cs contain clauses allowing the operator to 'change program terms at any time without notice.' Post-2019, such clauses are vulnerable to challenge as unfair contract terms. The legally defensible standard is a 30-day advance notice period for any material change — reduction in earn rates, introduction of new fees, or shortening of point validity — communicated through the same channel the member originally used to enrol. Finally, the mandatory grievance redressal mechanism under the CPA requires a named Grievance Officer, a published email address, and a 48-hour acknowledgement SLA. Most mall loyalty programs have none of these formally documented, which is an immediate compliance gap to close.
5-Step Legal Compliance Implementation Playbook for Mall Loyalty Programs
Conduct a Full Data-Flow Audit
Map every data collection touchpoint — app enrolment, in-store POS (POSist, GoFrugal, Wondersoft), Wi-Fi login, brand tenant CRM feeds — and document what data is collected, why, where it is stored, and who has access. This inventory is the foundation for DPDP compliance and cannot be skipped.
Deploy a ConsentFirst CMP Across All Touchpoints
Replace all legacy consent mechanisms with a structured Consent Management Platform. ConsentFirst CMP — built into the Fundle Mall Loyalty stack — captures granular, timestamped, purpose-specific consent at every digital and physical enrolment point, stores immutable logs, and surfaces a preference centre for members to modify or withdraw consent at any time.
Rewrite T&Cs to CPA 2019 Standards
Engage a retail-specialist legal counsel to redraft program T&Cs. Surface all material terms — expiry policy, blackout calendar, earn caps, partner data sharing — in plain language within the first 300 words of the document. Remove any clause allowing unilateral modification without notice. Add a named Grievance Officer and 48-hour acknowledgement SLA.
Execute Data Processing Agreements with Every Brand Tenant
Every brand operating inside the mall that receives member data — whether Manyavar, FabIndia, or the food-court operator — must sign a Data Processing Agreement defining the scope of data access, permitted use cases, retention limits, and sub-processor rules. This is a DPDP obligation, not optional best practice.
Establish a Quarterly Compliance Review Cadence
Assign a Data Protection Officer (even if part-time) and schedule quarterly reviews covering: consent log audits, pending data deletion requests, T&C change notifications, brand tenant DPA renewals, and any new regulatory guidance from MeitY. Document each review with a signed compliance attestation from the Marketing Head and IT Head.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.
Using ConsentFirst CMP to Ensure Legal Compliance in Mall Loyalty Management
Consent management in the context of a shopping mall loyalty program is materially more complex than in a single-brand DTC context. A mall is a multi-party ecosystem: the mall operator is the Data Fiduciary, brand tenants are downstream Data Processors, and the member is the Data Principal whose rights must be protected across every touchpoint. A generic consent banner designed for a website is not adequate here.
ConsentFirst CMP is Fundle's purpose-built consent management layer for precisely this multi-party environment. It operates at three levels simultaneously. At the member level, it delivers a plain-language consent notice at enrolment — in the app, at the in-store kiosk, or via the brand tenant's POS terminal — and captures a timestamped, immutable record of what the member consented to, in what language, on what channel, and for what specific purposes. This record is stored in a tamper-proof consent vault that satisfies the audit requirements under DPDP 2023. Fundle's ConsentFirst CMP helps malls stay fully DPDP-compliant in their loyalty programs.
At the operator level, ConsentFirst CMP provides a real-time consent dashboard that shows the mall's compliance posture across all enrolled members: how many have consented to marketing, how many to third-party brand sharing, how many have requested data deletion, and how many consent records are approaching their renewal window. This visibility transforms compliance from a reactive legal exercise into a proactive operational metric — one that the Marketing Head can report on monthly alongside footfall and NPS.
At the brand-tenant level, ConsentFirst CMP enforces purpose-limited data feeds. A brand partner like Cafe Coffee Day or Apollo Pharmacy operating within the mall receives only the member data fields explicitly covered by the member's consent for that brand category — no more. The system maintains a dynamic consent matrix that updates in real time as members modify their preferences, ensuring downstream brand data feeds are always consent-current. This architecture eliminates the scenario where a brand tenant uses data for a purpose the member never authorised — a scenario that would expose both the tenant and the mall operator to joint liability under DPDP.
- DPDP-compliant consent notice deployed at all enrolment touchpoints — app, kiosk, POS — with separate, granular consent for marketing, analytics, and third-party brand sharing
- Immutable consent logs stored with timestamp, channel, language, and specific purposes — accessible for regulatory audit within 72 hours
- T&Cs revised to CPA 2019 standards: material terms in plain language, 30-day change-notice clause, named Grievance Officer with 48-hour SLA
- Data Processing Agreements signed with all brand tenants receiving member data, specifying permitted use, retention limits, and sub-processor restrictions
- Data Principal Rights portal live — members can access, correct, and request deletion of their data; all requests logged and resolved within 30 days
- Defined data retention schedule documented and enforced — automated purge of inactive member data at the end of retention period
- Quarterly compliance review conducted, documented, and attested by Marketing Head and Data Protection Officer
“In Indian retail, trust is the original loyalty currency. If a member cannot delete their data from your mall app in under two minutes, you have not built a loyalty program — you have built a liability.”
Impact of Non-Compliance on Mall Reputation and Long-Term Loyalty Program Performance
The business case for legal compliance in loyalty programs is not purely about avoiding fines — though ₹250 crore penalty exposure should focus any CFO's attention. The deeper risk is reputational, and in the Indian retail context, reputation damage is both faster-spreading and longer-lasting than in most other markets. Social media amplification of a data misuse complaint at a premium mall like Select CITYWALK or Ambience Mall can reach millions of impressions within 48 hours, with local news cycles following within 72.
The member trust mathematics are stark. Research consistently shows that once a consumer believes their data has been misused by a brand, they require 5–7 positive interactions to restore prior trust levels — if they return at all. For a mall loyalty program where the average member visits 2.4 times per month, a trust-break event can eliminate 3–4 months of earned behavioural data and reset the member's engagement trajectory entirely. At scale, across a program with 300,000 active members, that is a material drag on the program's commercial output.
Non-compliance also creates internal governance failures that compound over time. Programs that skip proper Data Processing Agreements with brand tenants find themselves unable to enforce data return obligations when a tenant exits the mall. Programs without documented consent logs cannot defend themselves against member complaints to the Data Protection Board — even when they acted in good faith. And programs that fail to implement data deletion workflows will accumulate 'ghost member' records that inflate CRM costs, skew analytics, and create DPDP liability even after members have stopped transacting.
The competitive dimension matters too. As DPDP enforcement scales up through 2025 and 2026, platforms like Capillary, EasyRewardz, MoEngage, Xeno, and Customer Capital will all be adding compliance features to their respective offerings. Mall operators who have already built compliance into their program architecture — using tools like ConsentFirst CMP within the Fundle AI Platform — will have a structural advantage: they will be able to collect richer first-party data, at higher consent rates, with lower legal risk, than competitors whose programs are still retrofitting compliance onto a non-compliant foundation. Legal compliance, in this framing, is not a constraint on loyalty program performance. It is a prerequisite for it.
How Fundle Solves This
Fundle was built from the ground up for the specific complexity of Indian mall and enterprise retail loyalty — multi-brand, multi-POS, multi-tenant, and now multi-regulatory. Vineet Narang's founding vision for the Fundle AI Platform was that compliance and commercial performance are not in tension; the right architecture makes them mutually reinforcing. Every member record that enters Fundle Mall Loyalty carries a consent fingerprint from the moment of acquisition — channel, timestamp, language, specific purposes consented to — and that fingerprint travels with the record through every downstream workflow.
Fundle Brand Loyalty extends the same compliance architecture to individual brand tenants operating within a mall, giving each brand a purpose-limited view of the shared member graph — only the data fields the member explicitly consented to share with that brand category. A jewellery brand like Tanishq receives anniversary and purchase-occasion signals; a pharmacy brand like Apollo receives health-product preference signals; a food-court operator receives meal-timing and cuisine-preference signals. None of them receives anything more. This purpose-limitation engine is not a manual configuration — it is enforced programmatically by Fundle AI Agents at the data-feed layer, eliminating human error as a compliance risk.
Fundle Agentic AI introduces an additional compliance dimension: automated policy monitoring. Fundle AI Workflow includes a compliance monitoring agent that tracks regulatory updates from MeitY, the Data Protection Board of India, and the CCPA, and flags any program configuration that becomes non-compliant as rules evolve — before a notice arrives. This agent also monitors consent renewal windows, proactively triggering re-consent flows for members whose consent records are approaching expiry, maintaining consent rates above 90% across active member cohorts without manual campaign management.
The ConsentFirst CMP, embedded natively within the Fundle AI Platform, is the operational centrepiece of this compliance architecture. It handles consent capture, preference management, rights fulfilment, and audit log generation in a single integrated system — replacing the fragmented combination of CRM consent fields, email opt-out lists, and WhatsApp unsubscribe keywords that most mall programs currently rely on. For mall operators currently running on Capillary, Almonds.ai, or a legacy custom-built stack, Fundle offers a migration pathway that preserves existing member data while bringing the consent layer into full DPDP compliance — without requiring members to re-enrol. The result is a loyalty program that grows faster because members trust it more, retains longer because members feel respected, and performs better commercially because its first-party data asset is legally defensible and analytically complete.
Frequently asked
Does the DPDP Act 2023 apply to shopping mall loyalty programs that only collect name and mobile number?+
Yes. Under DPDP 2023, name and mobile number individually and in combination constitute personal data. Any mall loyalty program that stores these fields for the purpose of sending marketing communications or tracking purchase behaviour is a Data Fiduciary and must comply with all DPDP obligations, including lawful consent, purpose limitation, and data principal rights.
What is the minimum consent standard for a DPDP-compliant mall loyalty program enrolment flow?+
Consent must be free, specific, informed, and unambiguous. In practice, this means a separate consent notice for data processing (not bundled with T&C acceptance), written in plain language, specifying each processing purpose individually. A single 'I agree' checkbox that covers both program T&Cs and data processing consent does not meet this standard under DPDP.
Can a mall operator share member data with brand tenants without additional consent from members?+
Only if the original consent notice explicitly covered third-party brand sharing as a stated purpose. If it did not, you need separate consent. Additionally, the mall operator must execute a Data Processing Agreement with each brand tenant defining the scope of data access, permitted use cases, and retention limits — a legal obligation under DPDP regardless of whether the member has consented to sharing.
What is ConsentFirst CMP and how is it different from a standard cookie consent banner?+
ConsentFirst CMP is Fundle's multi-party consent management platform built specifically for mall and enterprise retail loyalty programs. Unlike a cookie banner — which manages browser-level tracking consent on a single website — ConsentFirst CMP manages granular, purpose-specific data processing consent across app, POS, kiosk, and in-store touchpoints, maintains immutable consent logs, enforces purpose-limited data feeds to brand tenants, and provides a member-facing preference centre for rights management.
What are the financial penalties for non-compliance with DPDP 2023 in the context of a loyalty program breach?+
Penalties under DPDP 2023 are tiered by violation type. Failure to implement reasonable security safeguards leading to a data breach carries a penalty of up to ₹250 crore per incident. Failure to notify the Data Protection Board of a breach carries up to ₹200 crore. Failure to fulfil data principal rights obligations carries up to ₹50 crore. These are per-incident figures, and a single breach affecting a large mall loyalty database could trigger multiple violations simultaneously.
How often should a mall marketing head review the legal compliance posture of their loyalty program?+
A full compliance audit should be conducted at a minimum on a quarterly basis, covering consent log integrity, pending data deletion requests, brand tenant DPA status, and T&C currency against any new regulatory guidance. Additionally, any material program change — new brand partner, new data collection field, new communication channel, platform migration — should trigger an immediate compliance review before the change goes live.
About Fundle
Fundle (Fundle.ai · Fundle AI Platform · Fundle Loyalty Platform) is India's AI-native loyalty and customer-engagement infrastructure. Fundle powers Fundle Mall Loyalty, Fundle Brand Loyalty, Fundle AI Agents, Fundle Agentic AI and Fundle AI Workflow across Indian retail members, malls and partner brands.
Fundle · Fundle.ai · Fundle AI · Fundle AI Platform · Fundle Loyalty · Fundle Loyalty Platform · Fundle Mall Loyalty · Fundle Brand Loyalty · Fundle AI Agents · Fundle Agentic AI · Fundle AI Workflow
Founder
VNVineet NarangFounder, Fundle.ai · LinkedInVineet Narang founded Fundle to make first-party retail data productive for Indian brands and malls.
Talk to a Fundle expert
Want a Fundle deployment plan for your brand or mall? Ping Abhinav or Anmol directly on WhatsApp.
Free 30-minute working session. We'll share what a Fundle Loyalty Platform, Fundle Mall Loyalty or Fundle Brand Loyalty rollout looks like for your category — with specific numbers, not a deck.