Designing Retail CX in a Consent-First World
By Rakesh Raghuvanshi, Founder & CEO, Sekel Tech
How India’s DPDP Act is forcing brands to rethink personalisation, data flows, and customer trust
Editorial Note | CXQuest
Customer experience has long relied on invisible data flows—often smooth, often unquestioned. But India’s Digital Personal Data Protection (DPDP) Act is forcing brands to confront a hard truth: experiences built on unexamined data access are no longer sustainable.
In this guest perspective, Rakesh Raghuvanshi, Founder & CEO of Sekel Tech, explores what “consent-first” truly means for retail CX—not as a legal obligation, but as a design challenge. Through practical scenarios from apps to frontline stores, he highlights why lawful experiences can still feel broken, and what leaders must rethink to preserve trust in a privacy-forward world.
From Data Abundance to Consent-First CX
For years, retail brands built their customer experience strategies on a simple assumption: more data meant a better experience. Phone numbers were collected at checkout without much explanation. App behaviour was tracked quietly in the background. Purchase histories were stitched together across systems. The logic was straightforward. The more a brand knew about a customer, the more personalised and seamless the experience could become.
The DPDP Act and the End of Invisible Data Flows
That assumption is now being tested with the advent of the Digital Personal Data Protection Act. The landmark Act reshapes how customer experience must be designed, delivered, and sustained in a consent-first world. For retail and multi-location brands, this translates into a structural change in how customer experiences work.
Why Fragmented Journeys Become Riskier Under Consent
Retail journeys are inherently fragmented. A customer might discover a product on social media, visit a store to see it in person, speak to a support executive for specifications, join a loyalty programme for a discount, order online for home delivery, and return the item at a different store location. Each of these touchpoints generates data. In the past, that data flowed freely across systems, often without the customer being fully aware of how it travelled or how long it stayed there.
Under the DPDP Act, consent now sits at the centre of every meaningful interaction. Data can only be collected for a stated purpose, used only for that purpose, and retained only for as long as it is necessary. Customers can withdraw consent at any time. This means experience flows must be designed to adapt in real time rather than assuming permanent access to customer data.
When Lawful CX Still Feels Broken
One of the most visible pain points that emerges from this shift is fragmented personalisation. Any modern retail brand wants to recognise customers instantly, continue conversations across channels, and make relevant recommendations. Under the DPDPA, however, continuity depends entirely on whether a customer has consented to each specific use of their data.
Partial Consent and the Illusion of Personalisation
Consider a simple app scenario. A customer downloads a retail app and consents to transaction history access so they can track past orders. They deny consent for browsing behaviour tracking, location access, and marketing notifications. What they expect is straightforward. They want to see past orders, receive relevant product recommendations, and view nearby store inventory.
What actually works under partial consent is far more constrained. The app can show past orders. It can generate recommendations based only on past purchases. It cannot use browsing behaviour. And, it cannot show nearby store inventory without location access. Features that once worked automatically now degrade. From the customer’s perspective, the experience feels broken. From the brand’s perspective, the system is behaving correctly.
This gap between lawful behaviour and customer expectation is where most retail systems struggle. Customers do not think in terms of consent categories. They think in terms of outcomes. When personalisation breaks, even for a lawful reason, it feels like a service failure.
Frontline CX: Where Consent Friction Becomes Visible
The same friction appears even more sharply at the frontline. Imagine a customer walking into a tyre store and saying they are looking for winter tyres for their BMW. In the past, a staff member could instantly check the system and say, “Mr Sharma, last time you bought 225/45R18. We have those in stock.” The transaction would be over in minutes.
In a poorly designed DPDP-compliant flow, the interaction becomes awkward. The staff member asks for a phone number. The customer asks why it is needed. The staff member explains that it will be stored, used to check purchase history, and used to send offers. The customer says they do not want offers. The staff member replies that they cannot look up the history without consent. The customer walks out frustrated. Here, nothing illegal has happened. But still, trust has been lost, and a sale has been lost with it.
Designing Consent Around Customer Benefit
The better design is not to remove consent, but to explain it in terms of customer benefit. The staff member can first use a vehicle compatibility database that requires no personal data and say, “For a BMW 3 Series, you need 225/45R18. We have those in stock.” Only then do they ask if the customer would like them to retrieve past order history, explaining that the phone number will not be stored unless the customer explicitly wants it remembered. The experience still works even if the customer says no.
Why Legacy Systems Struggle With Consent Reality
This is the real operational reality of the DPDPA. Most retail systems today are failing this test because consent has been treated as a compliance checkbox rather than a design principle. Many organisations have added consent management tools to existing CRM, POS, and marketing systems. But these systems were built on the assumption of permanent access to customer data.
When a customer withdraws marketing consent, one system may update immediately, while another syncs only at the end of the day. A message goes out that should never have been sent. From the customer’s perspective, the brand looks careless or intrusive, regardless of intent.
Binary Consent vs Real Customer Choice
Another structural problem is that consent is treated as binary. Customers want to say yes to order updates but no to promotional messages. Yes to in-store recommendations but no to online tracking. Or yes to service reminders but no to behavioural profiling. Most legacy systems flatten these choices into a single yes or no flag. As a result, you have broken experiences and confused customers.
Graceful Degradation as a CX Capability
This is where the concept of graceful degradation becomes critical. Systems must be designed to adapt when data availability changes. Experiences should shift to contextual intelligence rather than identity-based personalisation when customers exercise their rights.
Context Over Identity: The New Personalisation Model
In practical terms, this means basing recommendations on what a customer is doing in the current session rather than who they are. A quick service restaurant does not need to know your name, phone number, and entire purchase history to suggest fries when you add a burger to your cart. It only needs to understand the context of your current order. This kind of design delivers nearly the same conversion impact with far less personal data.
What the DPDP Act Forces Leaders to Confront
The DPDP Act has raised the bar for how intentionally experience systems must be designed by forcing brands to ask harder questions. What data is truly essential to deliver value? Which experiences genuinely require personal identifiers, and which can be driven by context or intent? How can customers be offered choices that are clear without being overwhelming?
For leadership teams, the implications are strategic. Consent management, data architecture, and experience design can no longer live in separate silos. If consent decisions are made in one environment and experience logic in another, fragmentation becomes inevitable.
The Act also pushes brands to examine their ecosystem. Delivery partners, CRM vendors, analytics providers, and marketing agencies all touch customer data. But from the customer’s perspective, there is only one brand. If a third party violates expectations, trust is still lost at the brand level.
Privacy, Trust, and the Future of Retail CX
The uncomfortable truth is that many retail experiences of the past were smooth because customers were unaware of how much data was being collected. The DPDP Act ends that era and shifts the balance of power back to the customer.
Going forward, privacy and customer experience are inseparable. A customer who feels respected is more likely to share data. A customer who feels surprised or misled will withdraw consent. The best design will be the one that anticipates this behaviour rather than reacting to it. For customers, this means more control. For brands, it means more responsibility. And, or leaders, it means rethinking how success is measured.
Author Profile – Rakesh Raghuvanshi, Founder & CEO- Sekel Tech
A seasoned digital marketing and analytics expert, Rakesh Raghuvanshi brings deep insights from his career as a marketer engaging directly with customer touchpoints. As Founder and CEO of Sekel Tech, recognized as the world’s No. 1 Challenger Tech Product company, he leads a SaaS platform delivering hyperlocal Dynamic Engagement Commerce solutions that empower brick-and-mortar businesses to drive in-store sales through search, social, and mobile channels.
Guided by the belief that “actions prove more than words,” Rakesh focuses on transparent attribution models linking online marketing to offline impact. Sekel’s real-time insights, bot-driven interventions, and contextual content distribution ensure superior ROI, helping global brands build direct customer relationships and win organically in a mobile-first world.
Editorial Closing: CXQuest Takeaway on Consent-first CX
The DPDP Act makes one thing clear: customer experience, in fact, can no longer be designed independently of privacy, consent, and data architecture. What once felt like seamless personalisation now demands intentional trade-offs, clearer communication, and systems that adapt when data access changes.
For CX leaders, the opportunity lies not in resisting consent—but in designing experiences that remain valuable even when customers choose restraint. In a consent-first world, trust becomes the most durable CX differentiator.
