DPDP Compliance for Retail Brands

Question

Accepted Answer

Retail is one of the most data-intensive industries, touching customers across stores, e-commerce, loyalty programs, WhatsApp campaigns, SMS, and email. DPDP requires that every one of these touchpoints carry the same consent posture.

Practically, retail brands must: (a) replace bundled terms-and-conditions consent with separate opt-ins for loyalty, marketing, profiling, and analytics; (b) synchronise consent state in real time between CDP, CRM, POS, and channel tools so an opt-out in WhatsApp also suppresses email and SMS; (c) audit legacy customer databases and re-consent where records are missing; (d) keep audit logs that prove when and how consent was captured; (e) train store associates on consent capture at POS.

Non-compliance attracts penalties up to ₹250 crore, but the larger risk is customer trust erosion in a brand-led industry.