Why DPDP Compliant Loyalty CRM Is Non-Negotiable in India

The Real Cost of Ignoring Explicit Consent in Loyalty Data Use

Walk into any mid-to-large format Indian retailer — Lifestyle, Pantaloons, Reliance Trends — and the loyalty onboarding process at the POS is almost identical: the cashier asks for a phone number, a membership is created, and somewhere in the fine print of the receipt or a barely visible poster, it says the brand may use this information for promotional purposes. This is the status quo. It is also a legally precarious, commercially wasteful architecture that the DPDP Act is designed to dismantle.

The commercial cost shows up before any regulator intervenes. When consent is implied rather than explicit, the data collected is noisy. Members who did not consciously agree to share their purchase history, browsing behaviour, or household size are unlikely to engage meaningfully with personalised communications built on that data. Indian retail benchmarks consistently show that untargeted loyalty SMS campaigns generate open rates below 8% and conversion rates under 1.2%. Compare that with consent-verified, preference-mapped segments — where members have explicitly stated they want offers on kidswear, or anniversary jewellery, or ethnic wear for festive occasions — and conversion rates jump to 2.8–3.5%. The math for a 5-lakh member programme is worth tens of crores in incremental revenue annually.

There is also the question of third-party data sharing. A large number of Indian loyalty programmes — particularly those run by mall operators who aggregate members from dozens of brands inside a single property — share member data across brand partners. Under implied consent, this is a grey area. Under the DPDP Act, it is clearly illegal without explicit, purpose-specific consent for each data sharing arrangement. Mall operators at properties like Phoenix Palassio Lucknow or Nexus Seawoods Mumbai who are running shared loyalty currencies across brands must now map every data flow and obtain separate consent for each purpose. Legacy CRM platforms built before 2023 are architecturally incapable of doing this — they were not designed to store consent at the attribute level or to honour withdrawal in real time.

The reputational cost is increasingly visible too. India's consumer internet users — particularly the 25–40 urban cohort who constitute the top 20% of spenders in organised retail — are becoming meaningfully more aware of data rights. A loyalty programme that is seen as harvesting data without clear permission is one that loses its most valuable members first. Consent is not a compliance checkbox; it is a trust signal, and in loyalty, trust is the only durable currency.

What the DPDP Act Actually Requires for Consent Management in Loyalty CRM

The DPDP Act 2023 is structured around the concept of a 'Data Fiduciary' — any entity that determines the purpose and means of processing personal data. Every retail brand running a loyalty programme is a data fiduciary the moment it collects a member's name and phone number. The obligations this triggers are specific and non-negotiable, and most existing Indian loyalty CRM deployments — including those built on platforms like Capillary, EasyRewardz, or homegrown stack — are not fully compliant with the Act's consent requirements as currently drafted.

First, consent must be obtained before data processing begins, not after. This means the moment a cashier at an Apollo Pharmacy counter creates a loyalty profile for a walk-in customer, a consent notice must be served — in the customer's preferred language — explaining exactly what data will be collected, for what specific purposes, and for how long it will be retained. The notice must be written in plain language, not legalese. The DPDP Act explicitly requires that the notice be as clear as possible. Bundling consent into a 40-clause T&C document does not meet this standard.

Second, consent must be granular and purpose-specific. A member consenting to receive transactional alerts — bill receipts, point balance updates — has not thereby consented to receive promotional messages, or to have their data shared with a brand partner for targeted advertising. Each purpose requires separate consent. This has significant architectural implications: a loyalty CRM platform must be able to store, retrieve, and honour consent states at the purpose level, not just at the member level. Legacy CRM systems that store a single binary 'opted-in / opted-out' flag per member are structurally incompatible with this requirement.

Third, and perhaps most operationally challenging for mall loyalty operators, is the right to withdraw consent at any time with effect being as easy as giving consent. A member who consented at a Phoenix Marketcity kiosk must be able to withdraw that consent through any channel — app, WhatsApp, SMS, in-store — and the withdrawal must propagate across every connected system within a reasonable time. If a brand on the mall's loyalty network continues to send promotional messages after a member has withdrawn consent, both the brand and the mall operator may be jointly liable. This demands real-time consent synchronisation across the entire data ecosystem — something that is technically hard to build and operationally harder to maintain without a purpose-built consent management layer like Fundle's ConsentFirst CMP.

Designing Consent Experiences That Members Actually Complete

Here is the practical tension every loyalty programme manager faces: consent flows that are legally comprehensive tend to be experientially terrible, and consent flows that are fast and frictionless tend to be legally inadequate. The DPDP Act does not mandate that consent collection be slow or complex — it mandates that it be clear, informed, and affirmative. Designing for both simultaneously is a UX and product challenge, not just a legal one.

The best-performing consent experiences in Indian retail share three characteristics. First, they use a progressive disclosure model — collect the minimum consent required for the core loyalty value proposition (points accrual, redemption, transactional alerts) at enrolment, and layer in enrichment consents later, tied to a specific value exchange. A Cafe Coffee Day member who has been asked to consent to share their beverage preference data will do so much more willingly if the ask comes with an immediate, tangible reward — a free upgrade on their next order — than if it appears as a legal form on first sign-up. Progressive consent flows see 35–45% higher completion rates than all-at-once consent walls in Indian retail app deployments.

Second, language and format matter enormously in the Indian context. A consent notice written in English at a FabIndia store in Coimbatore, or at a Manyavar franchise in Patna, will be ignored or misunderstood by a significant share of customers. DPDP-compliant consent requires that the notice be comprehensible — which in a market with 22 scheduled languages and widely varying literacy levels means investing in regional language support, icon-based visual consent summaries, and audio consent options for assisted onboarding at POS. This is not a nice-to-have; it is what 'informed' consent means in the Indian context.

Third, the consent experience must feel like the beginning of a relationship, not a legal hurdle. The framing matters. Brands that present consent collection as 'Help us personalise your experience' with a clear explanation of the specific benefit — 'So we can remind you before your Tanishq purchase anniversary with an exclusive offer' — see materially higher opt-in rates than brands that present it as 'Please read and accept our privacy policy.' In A/B tests run on Indian retail loyalty apps, benefit-framed consent screens outperform compliance-framed screens by 28–40% on completion rate. The consent experience is the first act of the loyalty relationship; it sets the tone for everything that follows.

KPIs That Prove DPDP Compliant Loyalty CRM Is Working

Compliance without measurement is just process theatre. A DPDP compliant loyalty CRM should produce measurable improvements in data quality, campaign performance, and member lifetime value — not just a cleaner legal posture. Here are the KPIs that matter at an operator level.

Consent coverage rate is the foundational metric: what percentage of your active member base has fully DPDP-compliant consent on file? Anything below 60% indicates a material legal exposure and a compromised addressable audience for your marketing team. Best-in-class loyalty programmes in India are targeting 80%+ consent coverage within 12 months of DPDP operationalisation, with 90%+ for new members onboarded post-compliance launch. This should be a board-level KPI for any retailer with a loyalty programme of more than 5 lakh members.

Consented segment campaign performance — measured as open rate, click-through rate, and conversion rate by consent tier — should be tracked separately from broadcast metrics. You will almost certainly see that fully consented, preference-mapped segments outperform the rest by a factor of 2–3x. This data is your most powerful internal argument for accelerating the re-consent campaign; it turns compliance into a revenue story.

Consent withdrawal rate is a leading indicator of programme health and communication quality. A withdrawal rate above 3% per quarter signals that your communications are not delivering enough value to justify the data exchange in the member's mind. It is an early warning system. Track it by channel, by segment, and by communication type. If withdrawals spike after a specific campaign, that campaign failed the trust test — which is a product and editorial problem, not just a compliance problem.

Data enrichment depth per consented member — measured as the number of declared preference attributes per member — is the long-term value metric. A member who has consented to share their occasion calendar, category preferences, and household composition is worth 4–6x more to your AI personalisation engine than a member whose profile contains only a name and a phone number. Over time, the gap in revenue per member between a shallow-data base and a deep-consent base is the single largest driver of loyalty programme ROI divergence in Indian retail.

How Fundle solves this

Vineet Narang founded Fundle on the belief that loyalty technology in India had been built backwards — starting with data extraction and retrofitting trust, instead of starting with trust and letting data follow. Every layer of the Fundle AI Platform is designed with consent as the primary architectural primitive, not an afterthought bolted onto a legacy points engine.

At the front end of the member journey, Fundle's ConsentFirst CMP — the consent management layer that sits across all Fundle Loyalty deployments — handles the full consent lifecycle at enrolment and throughout the member relationship. It serves localised, plain-language consent notices in 10+ Indian languages, supports progressive disclosure consent flows optimised for POS-assisted onboarding (compatible with POSist, GoFrugal, Wondersoft, and Petpooja integrations), and stores purpose-level consent flags with full timestamped audit trails. Fundle's ConsentFirst CMP manages consent for over 1.33 crore loyalty members ensuring compliant data processing — making it one of the largest consent-managed loyalty populations in Indian organised retail.

For mall operators running Fundle Mall Loyalty, the cross-brand consent architecture is particularly critical. When a member earns points at a fashion anchor and redeems at an F&B outlet on the same property, two separate brand data fiduciaries are involved. Fundle Mall Loyalty's consent layer manages each brand's data sharing relationship with the member independently, ensuring that the opt-in for Brand A does not imply consent for Brand B. This is architecturally unique in the Indian mall loyalty market and directly addresses the most common DPDP exposure for mall operators.

On the AI side, Fundle AI Agents and Fundle Agentic AI workflows are designed to operate only on consented data segments. When Fundle AI Agents generate personalised next-best-offer recommendations, trigger win-back journeys, or orchestrate cross-category upsell campaigns, they first query the consent state of each member and operate strictly within the permitted data processing scope. Fundle AI Workflow pipelines carry consent metadata through every transformation step, so that a segment built for a WhatsApp campaign automatically excludes members who have not consented to WhatsApp marketing — without requiring a manual suppression step from your CRM team. For brands using Fundle Brand Loyalty, this means your AI-personalised programmes are not just commercially smarter; they are legally defensible from day one.