Your Festive Contest Form Is a DPDP Event.

Sometime in the next fortnight, most Indian malls will switch on the festive machine. A lucky draw with a drum at the atrium. A "scan to enter" contest on every pillar. WhatsApp opt-ins for Diwali offers. A brand partner's activation with its own signup sheet. A bill-upload promotion that rewards receipt photos. A kids' dandiya night with a registration desk.

Each of those collects personal data. Between Navratri and Diwali a mall gathers more names, phone numbers, email addresses and receipts than in the six months before it, and almost all of it arrives through forms and flows designed before the Digital Personal Data Protection Act existed.

That is the exposure. Not the loyalty database, which has been looked at. The festive form, which has not.

Where the law stands, briefly

The Act was passed in 2023. The Rules that make it operational were notified on 13 November 2025, with obligations phased in over eighteen months: the Data Protection Board first, the consent-manager framework a year on, and the remaining obligations from May 2027. Your counsel will tell you how each applies to your properties, and this article is not legal advice.

The principles, though, are not in doubt and have not been for three years. A person must be told, at or before the point of collection, what data is being collected and for what purpose. Consent has to be specific to that purpose, given by a clear action, and as easy to withdraw as it was to give. Data collected for one purpose is not free for another. Children's data needs a parent's verifiable consent. And the organisation has to be able to show all of this, for a named person, when asked.

Now hold that list against a paper slip dropped into a drum.

Why the festive form is worse than the loyalty form

Loyalty enrolment is one deliberate moment. Somebody sits at a desk, reads something, signs up. That process has been reviewed at most malls, and the published guidance on granular consent applies to it.

Festive collection is the opposite: dozens of casual moments, across many hands, at the busiest time of the year. A slip filled in with a shopping bag on one arm. A tablet screen tapped through in four seconds. A partner's promoter with a clipboard. A "YES" typed into a WhatsApp thread. A receipt photographed and uploaded.

The notice is thinnest exactly where the volume is highest. That is the structural problem, and no amount of diligence at the loyalty desk fixes it.

Five places the festive campaign breaks

Purpose drift. The form says "for the lucky draw". The list is used for campaigns until next Diwali. One narrow purpose was stated; many broad uses followed. Every message sent to that list after the draw is a use the person did not agree to.

The partner list. A brand activation collects entries. The partner keeps a copy, the mall keeps a copy, and the notice, if there was one, named neither. Who is responsible for that data is a question both parties will answer differently, and the shopper was told nothing.

The bill photo. A receipt-upload promotion collects far more than a spend figure. A photo of a bill carries other purchases, sometimes a card fragment, sometimes another person's name. The promotion needed one number and stored a document.

The kids' event. Registrations for a children's dandiya night collect a child's name and a phone number at a desk. The Act treats children's data differently, and a registration sheet with no parental step is precisely the case it was written for.

The record. When a shopper asks what they agreed to and when, the mall has to produce that person's notice and consent. A drum of slips cannot. A kiosk tablet with no per-entry record cannot. A WhatsApp thread can, technically, if someone is prepared to search it by hand.

The first complaint will be one person

The instinct is to picture enforcement as a regulator arriving with a checklist. That is not how it starts.

It starts with one shopper, mildly irritated by a fourth message about a sale they never asked about, who writes in to ask what they agreed to. The grievance process the Act requires then needs the mall to answer that person, specifically, in a defined time. Everything above is exposed at once: the purpose that drifted, the partner who has the data, the receipt that was stored whole, the record that does not exist.

And there is a timing point the phased deadlines hide. The list built this Diwali will still be on the mall's systems in May 2027, when the remaining obligations apply. The deadline does not protect this season's data. It arrives while that data is still being used.

Four questions for the campaign launch meeting

1. For each festive touchpoint, what does the notice say the data is for, and does the planned use match it?
2. Which touchpoints put data into a partner's or agency's hands, and does the notice say so?
3. Pick one entrant from last year's lucky draw. Can you produce what they saw and what they agreed to, in minutes?
4. Does the festive list have a date on which it is deleted, and a way for a person to leave it as easily as they joined?

If all four have answers, the campaign is a compliance event with a record and this article owes you nothing. If the third one produces silence, that is the finding, and it is the CFO's, because the exposure is financial and reputational before it is technical.

What a well-run festive campaign looks like

• Every touchpoint, physical or digital, carries a short notice specific to its purpose. Not a policy link. A sentence.
• A consent record exists per person and can be retrieved by name or number, whichever the touchpoint collected.
• Partner and agency sharing is named in the notice, and the partner's obligations are written down.
• Bill-upload promotions collect the minimum: the amount and the store, not the document.
• Children's events include a parental step before any data is taken.
• The festive list has a retention date, and withdrawal is one action.
• None of this slows the campaign. It changes what the form says and what the system keeps.

The villain here is not the marketing team, which is doing what it has always done, and not the brand partner. It is a form designed for a different era, reused because it worked last year.

Where Portcart fits

Portcart is built to give malls one view of the shopper journey: discovery, engagement and commercial activity in a single measurable line. Engagement on that line is built so that consent is captured for a stated purpose at the moment of collection, and the record for any one person can be produced when asked. It does not make a campaign compliant on its own, and it is not legal advice. It removes the reason most malls cannot pass the one-shopper test.

The meeting worth having

Before the first festive campaign goes live, run the one-shopper test on last year's lucky draw in the launch meeting, with Legal in the room.

If it fails, book a Festive Campaign Consent Check with us. It is a working review of every festive collection touchpoint you plan to run, form by form and flow by flow: what each notice says, what each use is, who else receives the data, and what record exists per person. Bring the actual forms, the kiosk screens and the partner agreements. The exposure is in those documents, not in the policy on the website.