Retail Chains and Loyalty Programmes: A DPDP Act Impact Study

Executive summary

"Your mobile number, please?" is the commonest data request in Indian retail. At a supermarket till or pharmacy counter, the answer becomes the key to an e-bill, a loyalty account, WhatsApp campaigns and, increasingly, one profile joining the store to the retailer's app.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) opens its list of legitimate uses with this very scene. Illustration (I) to s.7(a) describes a customer who buys from a pharmacy and asks for a payment receipt on her phone: the pharmacy "may process the personal data of X for the purpose of sending the receipt". Beyond the receipt, a data fiduciary (the business that decides why and how personal data is processed) generally needs the data principal's consent, given after an itemised notice.

Headline impact rating: High. Five of the twelve areas in the Trayambic scorecard are rated High. The three biggest changes:

1. 1.The number at the till is optional, and so are its uses. No law we found requires a phone number for an ordinary sale, and GST invoice rules ask for an unregistered buyer's name and address only from ₹50,000. A number given for an e-bill supports the e-bill; loyalty enrolment, offers and profiling need separate consent.
2. 2.Loyalty programmes multiply fiduciaries. The retailer, a coalition operator, partner brands, card issuers and the platform vendor each need a defined role, and basket data cannot move between them without a specific ground.
3. 3.Stores have become sensors. Loss-prevention cameras can, in our view, rely on the offences exemption; footfall analytics and facial recognition for marketing cannot.

Physical stores sit outside the Third Schedule's three-year erasure rule; a retailer's online arm with two crore or more registered users does not. The main obligations commence on 13 May 2027.

Background

Who this study covers

Supermarket, apparel, lifestyle and electronics chains; malls, with their own apps, parking, Wi-Fi and gift cards; pharmacy chains; and loyalty and coalition operators, with the point-of-sale (POS) and CRM vendors behind them. Trayambic's e-commerce impact study covers marketplaces and direct-to-consumer brands; this study covers the store and its programmes.

Whose data, and what data

The data principals are shoppers, loyalty members, children in kids' clubs, pharmacy patients, gift-card buyers, people on camera, store and franchisee staff, and brand promoters.

The data runs from phone numbers and birthdays to purchase baskets, visit times, masked card digits and UPI IDs, prescriptions, delivery addresses, warranty registrations, CCTV, device identifiers picked up by sensors, Wi-Fi logins, parking vehicle numbers and staff records.

Where it flows

From the till to the loyalty engine and CRM; then to messaging vendors, analytics tools, partner brands and coalition partners. Payments run through acquirers. Prescriptions go into the pharmacy's statutory register. Store identities are merged with the app. Customers' numbers also sit on sales staff's own phones for one-to-one selling.

Legal framework

The DPDP Act and Rules

• Personal data (s.2(t)). "Any data about an individual who is identifiable by or in relation to such data." A phone number qualifies; so, in our view, does a device identifier a store can recognise on a later visit.
• Consent (ss.5, 6; Rule 3). Consent must be "free, specific, informed, unconditional and unambiguous", limited to data "necessary for such specified purpose", preceded by an itemised notice and as easy to withdraw as to give. Those who consented before the Act's commencement must receive a notice "as soon as it is reasonably practicable" (s.5(2)).
• Legitimate uses (s.7). Section 7(a) with its pharmacy illustration; s.7(i) for employment, including "safeguarding the employer from loss or liability".
• Accuracy and children (ss.8(3), 9(3)). Accurate data where it drives a decision or goes to another fiduciary; no "targeted advertising directed at children".
• Access (s.11(1)(b)). A person may learn "the identities of all other Data Fiduciaries and Data Processors" with whom her data was shared.
• Offences (s.17(1)(c)). Processing "in the interest of prevention, detection, investigation or prosecution of any offence" is exempt from most of the Act, though not from ss.8(1) and 8(5).
• Large online platforms (Rule 8; Third Schedule). An e-commerce entity (a platform for e-commerce as the Consumer Protection Act, 2019 defines it) with at least two crore registered users in India must erase data after three years without engagement, on 48 hours' notice, except data needed for account access or a "virtual token" usable to obtain goods, services or money.

Consumer and tax law

• Consumer Protection Act, 2019, s.2(47)(ix). Disclosing personal information given in confidence by a consumer is an unfair trade practice unless done in accordance with law.
• Consumer Protection (E-Commerce) Rules, 2020, rule 4(9). For the online arm, consent only by explicit affirmative action, never pre-ticked boxes.
• CGST Rules, 2017, rule 46. A tax invoice records an unregistered recipient's name and address where the taxable value is ₹50,000 or more (clause (e)), and below that only if she asks (clause (f)).
• Dynamic QR codes. Businesses with turnover above ₹500 crore print a dynamic QR code on B2C invoices (Notification No. 14/2020-Central Tax, 21 March 2020). CBIC Circular No. 146/02/2021-GST lists its contents; none concerns the customer.
• CGST Act, s.36. Accounts and records are kept until 72 months after the annual return's due date.

Payments

• Card data. RBI's tokenisation circulars of 7 September 2021 and 24 June 2022 bar merchants from storing card data; the 6 April 2018 circular keeps payment system data in India.
• Gift cards. Under the RBI's Master Directions on Prepaid Payment Instruments (PPIs), closed-system PPIs, usable only to buy from the issuing entity, are not a payment system needing RBI authorisation (para 2.1). Gift PPIs from authorised issuers are capped at ₹10,000, cannot be reloaded, and the issuer keeps the purchaser's KYC details (para 10.1); PPI transaction logs are kept for ten years (para 6.3).

Marketing, pharmacy and stores

• TRAI's commercial communications regulations were amended in February 2025 and on 18 September 2026; the 2026 text treats consent as "explicit or inferred" but preserves DPDP obligations. Trayambic's ad-tech study explains why TRAI's inferred consent is not DPDP consent.
• Schedule H1, Drugs Rules (G.S.R. 588(E), 30 August 2013). Supply is recorded in a separate register with the prescriber, patient, drug and quantity, kept for three years.
• Telangana Public Safety (Measures) Enforcement Act, 2013. Commercial establishments where 100 or more people may gather must run cameras at entry, exit and parking, keep footage for 30 days and produce it to the police.
• CCTV essential requirements (S.O. 1652(E), 9 April 2024; S.O. 4378(E), 9 October 2024). Cameras sold in India must be security-tested.
• CERT-In Directions (28 April 2022). Cyber incidents are reported within six hours.

How the layers fit

Section 38 makes the DPDP Act additional to these laws and lets it prevail in a conflict. Tax, drug and payment rules mostly require retention, which s.8(7) respects, and s.16(2) keeps the RBI's payment data localisation. Consumer law and the DPDP Act both bite on sharing customer data with partners.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

The number at the till

Start with what the law does not require. Rule 46 asks for an unregistered buyer's name and address only from ₹50,000, the B2C QR code carries no customer data, and the Schedule H1 register needs the patient's name, not her number. For an ordinary sale, the number is the customer's to refuse.

The pharmacy illustration sets the limit for numbers that are given: a number given for an e-bill may be used to send the e-bill. Loyalty enrolment, offers and sharing with a brand are new purposes needing consent and a Rule 3 notice.

Can a discount be conditional on joining? In our view, yes, if the shopper can decline: the sale and a printed bill stay available without it, the notice says what membership involves, and leaving is as easy as joining. Refusing to bill without a number is different. It makes the sale conditional on data the sale does not need, which cuts against the "unconditional" and "necessary" limbs of s.6(1).

• Incentives shape data quality. Staff targets for "number capture" produce pressure and wrong numbers. A mistyped number sends a stranger the customer's receipts and offers. Reward consented enrolments, not captures.
• Ask two questions. "Printed bill or e-bill?" and, separately, "Would you like to join our programme?" Treat payer names and UPI IDs on payment confirmations as payment data, not a mailing list.

Loyalty, coalitions and gift cards

Own programmes. The retailer is the fiduciary and the loyalty platform its processor, under a contract with Rule 6 security terms, breach notice in hours and deletion at exit.

Coalitions. A fiduciary decides purpose and means "alone or in conjunction with other persons" (s.2(i)), and in coalitions roles multiply:

• The operator runs the member account and is a fiduciary for it.
• Each partner is a fiduciary for its own sales. In our view, sending the operator a transaction so the member earns points fits s.7(a): she showed her membership number to earn them.
• The operator returning member profiles, or other partners' baskets, to a partner for its own marketing is a disclosure between fiduciaries that needs specific consent. Consent to "the programme and its partners" is unlikely to be specific enough.
• Each disclosure must be answerable under s.11(1)(b), by naming the partner, and accurate under s.8(3); a careless one also risks s.2(47)(ix) of the consumer law.
• A co-branded card brings in a bank with its own fiduciary role; Trayambic's banking study looks at co-branding from the bank's side, and its ad-tech study at selling audiences to brands.

Points and gift cards. A retailer's own gift card is, in our view, a closed-system PPI, outside RBI authorisation, so its data rules come from the DPDP Act alone. A mall card spendable across many stores may be a gift PPI, in which case the authorised issuer, not the mall, holds the purchaser's KYC. In our view retention follows value: data needed to honour a balance can stay while it is valid, and the Third Schedule protects virtual tokens on the online arm. When points expire and the member goes quiet, the purpose has ended.

Cameras, sensors and faces

CCTV for loss prevention. Trayambic's cybersecurity impact study sets out why, in our view, s.17(1)(c) turns on purpose rather than on who processes. Cameras over entrances, tills and stockrooms that deter and detect theft can rest on it, and in covered parts of Telangana malls and large stores must run them anyway. Access should be limited and logged.

Footfall and heat maps. Counting people at the door, with nobody identified, is not processing personal data. Following one person across zones, or recognising a returning phone by its Wi-Fi or Bluetooth signals, is processing of personal data once the identifier can be tied to a person, for instance through a Wi-Fi login. No legitimate use covers analytics: aggregate at the sensor, discard raw identifiers quickly, or ask for consent at Wi-Fi sign-in.

Facial recognition. Two uses must be separated:

• Watchlists of suspected shoplifters may fall within s.17(1)(c), but a match leads to a decision about the person, so s.8(3) accuracy applies. In our view a watchlist entry should rest on a recorded incident, be confirmed by a person before anyone acts, expire, and stay within the company unless a specific offence justifies sharing.
• Recognising loyalty members or regular customers for service or offers needs consent. A sign at the door is notice, not consent.

Pharmacies, staff and the omni-channel join

Pharmacy counters. The Schedule H1 register is kept for three years, which s.8(7) respects. A refill reminder the patient asks for fits s.7(a). Targeting offers from medicine purchases needs consent and, where it reveals a condition, should in our view be avoided altogether; health data at scale is the sensitivity the s.10 SDF factors name. Trayambic's health-tech study covers e-pharmacy.

Store staff. Section 7(i) covers attendance, till cameras and shrinkage investigations; Trayambic's article on employee monitoring sets the limits. The newer risk is one-to-one selling on staff's own WhatsApp: customers' numbers on personal phones leave with the employee. Move it to retailer-controlled business accounts. Brand promoters on the floor are employed by the brand, so the retailer must decide whether they may collect customer data at all, and under whose notice.

The omni-channel join. Matching store purchases to an app account by phone number creates a single profile, a new purpose the notice must name. The app's registered-user count, not the store's, decides whether the Third Schedule applies; below two crore users, s.8(7) still requires erasure when the purpose ends.

Worked example (illustrative)

A regional chain runs 140 supermarkets in three southern States, 30 in Hyderabad, with pharmacy counters in 25. Its loyalty programme has 30 lakh members and shares points with a fuel retailer; its app has 12 lakh registered users; larger stores have footfall sensors. From 13 May 2027:

• Till. Billing works without a number. E-bills rest on s.7(a); enrolment is a separate, recorded choice.
• Existing members. Each receives a s.5(2) notice listing the data held, its uses and how to withdraw or complain.
• Coalition. The fuel partner receives only what is needed to credit points; marketing exchanges need specific consent, and the joint notice names the partner.
• Cameras and sensors. Hyderabad stores keep 30 days of footage, as Telangana's law requires where it applies, and other stores match it. Sensors discard device identifiers within the hour.
• Pharmacy. H1 registers are kept for three years, and pharmacy purchases are excluded from marketing segments.
• App. With 12 lakh users, the Third Schedule does not apply, but dormant profiles are purged under s.8(7).
• Breach. A messaging vendor's misconfigured interface exposes two lakh members' names, numbers and last purchases. The chain notifies the Board and each member without delay, reports to CERT-In within six hours and files the Board's detailed report within 72 hours.

Compliance framework

Checklist

Roadmap to 13 May 2027

Now to December 2026. Inventory every entry point (tills, apps, Wi-Fi, sensors, pharmacy, staff phones), list partners and vendors, and stop number-capture targets.

January to March 2027. Rebuild billing and enrolment flows, rewrite contracts, reset cameras and sensors, and separate pharmacy data.

April to May 2027. Send notices to existing members, test the breach runbook with the messaging vendor, switch on retention jobs and train store teams.

Ongoing. Review each new partner, sensor or campaign before launch, and track any Board guidance, SDF designations and the final form of TRAI's 2026 amendments.

Recommendations

1. 1.Never make the sale depend on the number. A number given for a receipt is for the receipt.
2. 2.Ask about the bill and the programme separately, and record each answer.
3. 3.Write every coalition flow down with its ground, and take specific consent for anything that is not crediting or redeeming points.
4. 4.Keep loss prevention and marketing apart. Cameras that rest on s.17(1)(c) must not feed analytics or recognition.
5. 5.Keep health purchases out of marketing, and keep H1 registers for exactly as long as the law requires.
6. 6.Take customer data off personal phones and out of unmanaged exports.
7. 7.Count the app's registered users to know whether the Third Schedule applies.

Key takeaways

• The DPDP Act's s.7(a) pharmacy illustration sets the baseline: a number given for a receipt may be used for the receipt; loyalty, offers and partner sharing need consent.
• No law we found requires a phone number for an ordinary retail sale; GST invoices need an unregistered buyer's name and address only from ₹50,000.
• In coalition programmes, crediting points fits s.7(a), but passing member profiles or baskets to partners for their marketing needs specific consent.
• Loss-prevention cameras can in our view rest on s.17(1)(c); footfall analytics and facial recognition for marketing need consent or anonymisation at source.
• The Third Schedule's three-year erasure rule turns on the online arm's registered users, but s.8(7) erasure applies to every store database.