DPDP Compliant Loyalty CRM: The Complete Selection Checklist

Understanding DPDP Requirements for Loyalty CRM

The Digital Personal Data Protection Act, 2023 establishes a consent-first framework that directly reshapes how loyalty CRM platforms must operate. The act defines seven core obligations for Data Fiduciaries — and every single one has a direct implication for how your loyalty platform is architected, not just how your legal team drafts a privacy policy.

First, consent must be free, specific, informed, unconditional, and unambiguous. In practice, this means a loyalty enrolment flow at a Phoenix Marketcity kiosk or a Lifestyle POS counter cannot bundle consent for marketing communications with consent for basic loyalty program participation. Each purpose — transaction tracking, personalised offers, third-party brand communications, AI-based profiling — must have a distinct consent checkbox. Pre-ticked boxes are explicitly invalid. This breaks the way most mall loyalty apps and brand CRMs currently onboard members.

Second, the act grants Data Principals — your loyalty members — the right to access their data, correct it, and withdraw consent at any time. Withdrawal must be as easy as giving consent. This means your CRM must expose a self-service consent dashboard, not just a 'contact us' email buried in the app footer. For a chain like Apollo Pharmacy running a pharmacy loyalty card or Cafe Coffee Day managing a prepaid wallet database, this is an operational redesign challenge, not a marketing one.

Third, data minimisation and purpose limitation apply strictly. You cannot collect a member's date of birth, income bracket, or family size during enrolment 'just in case' you want to run a segmentation campaign later. The data collected must be necessary for the explicitly stated purpose, and secondary use requires fresh consent. For AI-driven loyalty platforms running RFM scoring, churn prediction, and next-best-offer engines, this creates a governance question: what data feeds the model, and does the member know and consent to that specific use?

Fourth, grievance redressal mechanisms must be operational and accessible. Your CRM vendor must be able to demonstrate a working Data Principal complaint workflow — not a theoretical one. The 72-hour breach notification window to the Data Protection Board is also a backend infrastructure requirement, meaning your CRM must log, detect, and report anomalies in near real time. Selecting a DPDP compliant loyalty CRM is therefore not a legal procurement exercise — it is a technical and operational procurement decision.

Key Compliance Features to Assess in CRM Platforms

When evaluating a loyalty CRM platform for DPDP compliance, the conversation must move beyond feature brochures into system architecture and live product demonstrations. There are five feature domains that separate genuinely compliant platforms from those wearing a compliance badge without the underlying infrastructure.

Consent schema design is the first domain. Ask vendors to show you their consent data model. Can each consent record be tied to a specific Data Principal, a specific purpose, a specific collection channel, a timestamp, and the exact language shown to the user at the moment of consent? If the answer is a database field called 'opted_in: true/false', you are looking at a pre-DPDP architecture. A compliant system maintains an immutable consent log — every grant, every withdrawal, every update — with channel and language metadata attached. This is especially important for Indian retail, where consent may be collected in Hindi, Tamil, Kannada, or Telugu at different store locations.

Data residency and localisation is the second domain. DPDP requires that personal data of Indian citizens be processed in India. Cloud-first CRM vendors with data centres outside India — or hybrid architectures that route Indian loyalty data through Singapore or US nodes — create immediate compliance exposure. Verify where member PII is stored, where it is processed for AI model training, and whether cross-border data transfer provisions are met if any offshore processing occurs.

The third domain is POS integration compliance. Most Indian fashion and food retailers use POS systems like GoFrugal, Wondersoft, POSist, or Petpooja as their primary transaction capture layer. The CRM must integrate with these systems without creating a shadow data flow — an unlogged data pipeline that bypasses the consent layer. Ask vendors to map exactly how a bill generated on POSist reaches the loyalty engine, and whether the consent status of the member is checked before that transaction data is used for profiling or offer personalisation.

Fourth, assess the Data Principal rights portal — the self-service interface your loyalty members will use to exercise DPDP rights. This is a customer-facing product, not a backend admin tool. It must support access requests with a defined SLA (DPDP suggests 30 days), correction workflows, consent withdrawal per purpose, and deletion requests with downstream cascade — meaning if a member requests erasure, the CRM must also de-identify their data across all connected campaign tools, including MoEngage or WebEngage integrations. Platforms like Capillary and Antavo are building towards this, but depth of implementation varies. Fifth, evaluate the audit and reporting layer. Regulators will ask for evidence, not assertions. Your CRM must generate compliance reports on demand: consent rates by channel, withdrawal volumes, data breach incidents, and Data Principal request resolution times.

Evaluating Consent Management Capabilities

Consent management in a DPDP-era loyalty program is a product discipline, not a legal formality. The gap between a consent management layer bolted onto an existing CRM and a purpose-built Consent Management Platform is substantial — and that gap is exactly where regulatory risk lives.

A mature consent management capability must handle four distinct consent lifecycle events: collection, storage, withdrawal, and re-consent. Collection must happen at every touchpoint where personal data is first gathered — in-store POS enrolment, loyalty app registration, brand website sign-up, and WhatsApp opt-in flows that many Indian retailers use for CCD-style engagement. Each channel has a different UI/UX constraint, a different language requirement, and a different technical integration path. A loyalty program operating across Select CITYWALK and a standalone FabIndia store needs consistent consent logic despite entirely different front-end systems.

Storage of consent records must be both durable and queryable. When a DPDP audit occurs, your team needs to retrieve the exact consent record for any given member — showing what they consented to, when, in what language, and through which channel — within minutes, not days. This requires a purpose-built consent data warehouse, indexed for rapid retrieval, with role-based access controls so only authorised personnel can view or export consent data.

Withdrawal is where most platforms fail. The DPDP Act requires that withdrawal be as easy as consent was given. If a Manyavar loyalty member consented to personalised SMS campaigns via an in-store QR code, they must be able to withdraw that specific consent — without withdrawing their entire program membership — from within the loyalty app. The platform must then propagate that withdrawal signal in real time to every downstream system that uses SMS as a channel, including third-party campaign tools. Batch processing with a 24-48 hour lag is not acceptable under DPDP.

Re-consent workflows are the fourth pillar. When a loyalty program changes its data use purposes — say, it begins using transaction data to train an AI recommendation model — the CRM must identify all existing members who have not consented to that new purpose and trigger a structured re-consent campaign. Platforms that lack this capability will either run AI features on unconsented data (a DPDP violation) or avoid AI personalisation entirely (a competitive loss). Fundle's ConsentFirst CMP, which already manages consent for over 1.33 Cr loyalty members, handles all four lifecycle events natively, with multilingual support covering the 10 most common Indian languages used at retail touchpoints.

Verifying Data Security and Auditability

Data security under DPDP is not solely an IT department concern — it directly affects how your loyalty CRM is architected and operated. The act requires Data Fiduciaries to implement reasonable security safeguards. While the act uses the word 'reasonable', the Data Protection Board's enforcement guidance is expected to reference ISO 27001, SOC 2, and sector-specific standards. For retail loyalty programs handling crores of transaction records, the bar will be high.

At the infrastructure level, evaluate whether the CRM vendor holds certifications that demonstrate operational security discipline: SOC 2 Type II for US-origin cloud infrastructure, ISO 27001 for information security management, and PCI-DSS compliance if the loyalty program touches payment card data. Do not accept vendor self-attestations — request the actual audit reports with findings and remediation timelines. A vendor that holds SOC 2 Type I but not Type II has demonstrated a point-in-time security posture, not a sustained one.

At the application level, the CRM must implement role-based access controls that limit which internal team members can view raw PII. A campaign manager at Pantaloons should be able to run a segmentation on age band and city without ever seeing actual member phone numbers. Data masking, pseudonymisation, and field-level encryption for sensitive attributes — email, phone, address, payment method — must be on by default, not optional configuration. Platforms that expose full PII in standard campaign builder views create insider threat risk and DPDP exposure simultaneously.

Auditability is the operational test of security. Your CRM must log every data access event — who queried what member data, at what time, from which IP address, for what stated purpose — and retain those logs for a minimum of three years. This is the evidence layer that protects you during a regulatory investigation. Ask vendors to show you an actual audit log export from their system. The ability to generate a complete data processing timeline for a single Data Principal — from enrolment through every campaign touch to eventual deletion — is the gold standard. Platforms like MoEngage and WebEngage have strong engagement analytics, but their audit log depth for DPDP compliance purposes varies and should be verified independently before assuming adequacy.

How Fundle Meets and Exceeds DPDP Compliance Standards

Fundle was architected from day one as an AI-first loyalty platform for Indian malls and enterprise retail brands — and that means it was designed for the regulatory environment India is moving into, not the one it is leaving behind. Vineet Narang's founding vision was explicit: build the infrastructure layer that makes compliance and personalisation mutually reinforcing, not mutually exclusive.

The centrepiece of Fundle's compliance architecture is the ConsentFirst CMP — a purpose-built Consent Management Platform that is native to the Fundle AI Platform, not a third-party integration. ConsentFirst handles user consent for over 1.33 Cr loyalty members across Fundle's mall and brand deployments, managing the full consent lifecycle — collection, storage, withdrawal, and re-consent — with multilingual support across 10 Indian languages. Every consent event is stored in an immutable log with purpose, channel, language, and timestamp metadata, making regulatory audit response a matter of minutes rather than days.

Fundle Loyalty — the core engine powering Fundle Mall Loyalty and Fundle Brand Loyalty — integrates with the Indian POS ecosystem through certified connectors for POSist, GoFrugal, Petpooja, and Wondersoft. Critically, the consent check is embedded in the transaction ingestion pipeline: if a member's consent for transaction-based profiling has been withdrawn, that transaction data is processed only for points calculation — not fed into the AI personalisation or segmentation engines. This purpose-limitation enforcement happens at the data layer, not as a campaign-time filter.

Fundle AI Agents and Fundle Agentic AI — the platform's conversational and autonomous AI capabilities — operate on consent-gated data pools. When a Fundle AI Workflow executes a next-best-offer recommendation for a member at a Select CITYWALK brand store, the AI engine checks the consent registry in real time before including that member in the inference batch. Members who have not consented to AI-based profiling are served rule-based offers instead, with a re-consent nudge surfaced in the loyalty app. This architecture means Fundle can run state-of-the-art AI personalisation across consenting members while maintaining strict DPDP compliance for the full member base — a balance that platforms retrofitting compliance onto existing AI stacks cannot achieve cleanly. Fundle's data residency is India-only, the platform carries enterprise-grade security certifications, and its vendor contract includes DPDP-specific SLAs, breach notification commitments, and Data Processor liability clauses that hold up in regulatory scrutiny — not just in procurement conversations.