Loyalty programmes are profiling engines, linking identity, spend and behaviour to personalise and predict.
In short
Loyalty programmes build rich profiles, which the Act treats as high-consent processing, giving members rights over the profile you create. Penalties reach ₹250 crore.
What changes for this sub-sector.
Building rich member profiles for personalisation and prediction needs informed consent.
Loyalty data collected to run the programme cannot silently power unrelated marketing or data sales.
Members can see, correct and erase their profile and points data, and withdraw consent.
Sharing loyalty data with partners or co-brands needs consent and contracts.
Loyalty accounts are attractive targets; protect them with strong controls.
Retain member data while the membership is active, then delete.
Fix profiling consent and purpose limits first.
The readiness check surfaces profiling, purpose and sharing gaps.
Take the readiness check →