Introduction
Loyalty programs form the bedrock of customer retention and promotion strategies in Indian retail and e-commerce. They help in understanding and predicting customer behaviour. Loyalty programs also collect and analyze vast troves of personal data. This includes mobile numbers, transaction histories, geolocation, and behaviour insights. The Digital Personal Data Protection Act, 2023 (“DPDPA”), has ushered in a new regime of privacy and data processing in India. This means that loyalty programs can no longer rely on opaque or blanket consents. Retailers must ensure that any use of personal data must be accompanied by informed and specific consents which must also be revocable. For high-volume retailers, the need to shift from data maximization to a compliance first approach that still offers value to the client is significant. The real challenge is to build these requirements into the operational fabric of the business, but not in a way that compromises customer experience.
Consent as a New Currency in Retail
To the retailer, gaining customer consent to process personal data is still a form of sales. This is a major shift from old practices where joining a loyalty program was interpreted as a one-time blanket consent to process data. The DPDP Act changes this by:
- Customer expectation: Control over how their data is processed.
- Retailer challenge: Designing processes in a way that the entire process is frictionless for the user while still adhering to regulatory requirements.
Law at the Point of Enrolment
The DPDPA requirements influence how loyalty programs are designed for all the touchpoints such as checkout counters, online shopping carts, and app registrations. Some notable sections are:
- Section 5 mandates the display of clear and unambiguous notices on what data is collected, for what purpose, and what are the rights of the customer. The notices are to be in English or any one of the 22 scheduled Indian languages.
- Section 6 deals with the requirements for valid consent and its various dimensions. Consent should not be obtained through pre-ticked boxes or bundled agreements.
- Section 9 mandates the processing of children’s data i.e., below 18 years of age, only with verified parental consent.
- Section 10 places Large Retailers under certain obligations as Significant Data Fiduciaries (“SDF”) which include appointing a DPO, carrying out Data Protection Impact Assessments (“DPIAs”) and Audits.
- Section 8(6) Breach notification is obligatory to the impacted customers and the regulator. Penalty of up to ₹200 crore for not doing so.
These regulations compel the development of systems to unroll customers in a manner that is demonstrably compliant to the regulations.
Designing Consent into the Customer Journey
Compliance exercises should not be relegated to a back-office function, especially for high-volume retailers. Consent must be evident and available for every step in the customer journey.
- Onboarding
- Use layered notices by first listing benefits, followed by clear purpose explanations, and ending with the privacy policy.
- Include separate opt-ins for marketing, profiling, and partner sharing.
- Ongoing engagement
- Provide dashboards in apps or on sites where customers can manage their consent.
- They should be able to adjust their marketing preferences, update or change their details, and withdraw consent for any specific purpose.
- Partner alignment: Ensure that your vendors and partners, including any banks, analytics firms, and delivery providers, are contractually and technically ready to honour consent signals.
- Exit
- Do not block customers from exiting the program.
- Inform customers about consequences, e.g., loss of accumulated points, but still respect withdrawal requests promptly.
Friction, Fatigue, and the Indian Consumer
As with any legal compliance, there are also behavioural challenges. Customers expect speed and having too many steps in a process will lead to drop-offs.
Retailers must therefore manage:
- Clarity overload: Notices must be short enough to be read, but detailed enough to inform.
- Multiple languages: Accessibility by translation into official languages is vital, but careful interface design will be required for this to work.
- Smart consent design: Group optional consents under expandable sections or use simple visual cues to avoid fatigue.
Compliance can improve customer confidence instead of discouraging participation with well design.
Legacy Data: A Compliance Reckoning
The consent collection that has been poorly documented over decades pose several risks. The Retailers should:
- Assess all saved databases and determine records where valid consent was not obtained.
- Justify data and either delete it or revalidate consent.
- Ask customers for new data consent directly and honestly to prevent distrust.
This is a sensitive and resource-demanding task that should not be avoided. Failure to do this will result a legacy of unreconciled data for retailers that will result litigation threats and reputational risks.
Practical Benefits of Compliance
While the DPDPA imposes strict obligations, compliance-focused loyalty programs offer strategic advantages:
- Trust: High compliance results in lower distrust and stronger data confidence.
- Operational confidence: The risk of fines, penalties, and compliance gaps greatly diminishes.
- Increased focus from investors: Strong controls from DPDP Act compliance result in ESG governing gains.
- Competitive differentiation: There are easy to copy discounts and competitors will erode market share.
AMLEGALS REMARKS
The DPDP Act resets how loyalty programs operate in India. An ecosystem once based on implicit or blanket consent must now be rebuilt around clarity, precision, and revocability. For high-volume retailers, this involves updating the enrolment process, designing compliance-driven enrolment and consent dashboards, retraining staff, and renegotiating contracts with third-party vendors who administer loyalty programs. The difference going forward will be between superficial compliance and genuine accountability. In the long term, cynicism-driven accountability will not work. Retailers who design compliance into the loyalty programs themselves will be in the best position to gain trust from regulators and loyalty from customers. In India, the future of loyalty programs will not be about the number of members per program, but the quality of consent.
For any queries or feedback, feel free to connect with mridusha.guha@amlegals.com