Short Answer
Retail brands must collect explicit consent for loyalty and marketing, maintain consent records across POS, app, web, and WhatsApp, honour withdrawal across all channels, and protect customer data with audit-ready safeguards.
Retail is one of the most data-intensive industries, touching customers across stores, e-commerce, loyalty programs, WhatsApp campaigns, SMS, and email. DPDP requires that every one of these touchpoints carry the same consent posture.
Practically, retail brands must: (a) replace bundled terms-and-conditions consent with separate opt-ins for loyalty, marketing, profiling, and analytics; (b) synchronise consent state in real time between CDP, CRM, POS, and channel tools so an opt-out in WhatsApp also suppresses email and SMS; (c) audit legacy customer databases and re-consent where records are missing; (d) keep audit logs that prove when and how consent was captured; (e) train store associates on consent capture at POS.
Non-compliance attracts penalties up to ₹250 crore, but the larger risk is customer trust erosion in a brand-led industry.
Law Reference
Sections 5–8 – Notice, Consent, Legitimate Use, Obligations
Retail brands without unified consent typically discover that 30–50% of their CRM is non-compliant. Fixing this before enforcement protects both revenue and reputation.
A fashion retailer with 200 stores integrates OneConsent across POS, app, and loyalty, ensuring an in-store opt-out instantly stops WhatsApp campaigns the same day.
Was this answer helpful?
Our team is here to help you with any questions about DPDP compliance.