Dealer, retailer, mason and mechanic loyalty programmes: what do we need?
Reviewed by InfraVeritas360 ResearchFirst published Last reviewed
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary
Short answer: Consent with a clear notice; collect only what rewards need
Loyalty schemes collect names, phone numbers, photos, ID and bank details to pay rewards. Joining is a choice, so this rests on consent with a clear notice. Collect only what rewards and tax rules need, keep bank details in one secure place, and make leaving the scheme easy. The loyalty vendor acts for you. Dealer KYC for appointment is a separate purpose from loyalty.
Why it matters
Section 5 needs a notice. Section 6 sets what valid consent is, including easy withdrawal. Section 8(1) covers the loyalty vendor.
- Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
- Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
- Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
- Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
- Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
A worked example
A cement company's mason app asked for Aadhaar, PAN, bank details and a family photo. The review keeps only what rewards need, adds a short notice in the local language, and moves bank details to the payout system.
Steps
- List the fields the app and forms collect, and drop what rewards do not need.
- Show a short notice at sign-up in the local language.
- Keep bank details in the payout system only.
- Add a data schedule to the loyalty vendor contract.
- Close and delete inactive members' data on a set period.
Evidence to keep
- Field list with reasons
- Sign-up notice and consent records
- Vendor schedule
- Inactive member deletion log
Common mistakes
- Bank details in spreadsheets sent by email
- Field staff enrolling masons without telling them
- Loyalty data reused for unrelated offers
Who does what
- DPO / Privacy lead: Loyalty complaints are early warnings. Review them monthly.
- CISO / Security head: Payout files and the loyalty app need strong access and logs.
- HR head: Sales staff targets can push enrolment without consent. Train on this.
- Operations head: Depot and sales staff enrol members. They must show the notice and not fill forms for people.
- Plant head / factory manager: If dealers visit the plant for meets, the registration list is personal data.
- Finance department: Bank details only through the payout portal.
- Marketing department: No campaign without a consent check.
What a good answer from management sounds like
“Members join with a notice and a clear choice. Bank details sit only in the payout system. Members can leave in the app, and inactive accounts are closed on schedule.” Effort and time: Medium · 6 to 10 weeks.