Skip to content
PromotEdge

Home World of Marketing DPDP Act for marketers

Guide · Rules for marketers · DPDP Act

DPDP Act for marketersleads, forms and WhatsApp

A lead form is where most of your data duties begin. Tell people what you take and why, ask for a clear yes, and keep proof. Who this is for: founders, marketing heads and sales heads who collect leads and message people in India.

Get a growth plan See the table
Since 201565+ in-house teamKolkata office, 5 team bases

By Saurav AgarwalPublished 22 Oct 202613 min read

Brands we have worked with

  • Sai Angan
  • Rupa Peekaboo
  • Tea Junction
  • Zandu Vigorex
  • Fox & Mandal
  • Veedol
  • Tata Efee
  • Avadh Sugar & Energy
  • Taj Cement
  • Weichai
  • Rerasathi
  • Honest AI
  • Walton
  • Supertron
  • Balrampur Foundation
  • Fine Organics
  • Kopran
  • Bengal Aerotropolis Projects Limited
  • FIVB
  • Hanumanta Foods
  • Linc
  • Nitya Gold & Diamonds
  • Novozymes
  • PSPL
See all 123 clients
/ 01 The short answer

What does the DPDP Actmean for lead work?

If you collect names and phone numbers, the Digital Personal Data Protection Act treats your firm as a data fiduciary, and your lead form is where its duties start. Give a plain notice, ask for a clear yes, keep proof and make stopping easy.

PromotEdge builds lead forms and follow-up systems for Indian companies, and this guide reads the official texts in plain words.

This is general information, not legal advice. For your case, speak to a lawyer. This guide explains official text in plain words. Last checked: 22 October 2026.

We read the Digital Personal Data Protection Act, 2023 (the Act) and the Digital Personal Data Protection Rules, 2025 (the Rules) on 22 October 2026, as Gazette PDFs on meity.gov.in. We also read two Meta pages on WhatsApp opt-in. Every claim below names its section, rule or page.

A few terms first. Personal data is data about a person who can be identified from it. A data principal is that person. A data fiduciary is whoever decides why and how the data is used. Processing means almost anything you do with it: collecting, storing, using, sharing and deleting. The Board is the Data Protection Board of India.

Key takeaways
  • The Act covers digital personal data, and a lead record with a name and phone number is that (sections 2(t) and 3).
  • You need a lawful ground. For most lead work that is the person's consent, or the use for which she volunteered the data (sections 4 and 7(a)).
  • A notice must come with or before the request for consent. Rule 3 sets what it contains, and rule 1 puts rule 3 in force on 13 May 2027, by our count.
  • Withdrawing consent must be about as easy as giving it, and you must be able to prove notice and consent (sections 6(4) and 6(10)).
  • Meta's WhatsApp pages ask for opt-in permission. We read no official Indian text that applies the Act to WhatsApp messages in particular.

Our beliefWe look at your business first. Marketing comes second.

/ 02 The text in plain words

What each part saysand what to check

Read on 22 October 2026 from the Gazette PDFs of the Act and the Rules. Where the text is silent, we say so.

Section or ruleWhat it saysWhat a marketer should check
XAct s.2(i), (j), (t), (x)Defines a data fiduciary (who decides why and how personal data is used) and a data principal (the person). Defines personal data (data about an identifiable person) and processing (collecting, storing, using, sharing, erasing and more).A lead record with a name and phone number fits. So does a WhatsApp contact list. Make a list of every place you hold them.
Act s.3The Act covers digital personal data processed in India. It also covers processing outside India when goods or services are offered to people in India. It does not cover data used for a personal or domestic purpose, or data made public by the person or by someone the law obliges to publish it.The exemption is narrow. Whether a number found in a directory fits it, the text does not say. Ask a lawyer before you use it.
Act s.4Personal data may be processed only for a lawful purpose, either with consent or for certain legitimate uses. Lawful means not expressly forbidden by law.Write down, for each list, which of the two grounds you rely on.
Act s.5(1) and (3)A notice must come with or before the request for consent. It tells the person what data you want and why, how to withdraw consent and use her rights, and how to complain to the Board. The person must be able to read it in English or an Eighth Schedule language.Place the notice next to the form button. Offer a language choice.
Act s.6(1) and (2)Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action. It covers only the data needed for the stated purpose. Any part of a consent that breaks the law is invalid.No pre-ticked boxes. Ask only for the fields you need. Keep the tick for promotions apart from the enquiry.
Act s.6(3)A request for consent must use clear, plain language. It must offer English or an Eighth Schedule language. It must give the contact details of the data protection officer, or of another person who answers the person's queries.Put a named contact on every form.
Act s.6(4) to (6)A person may withdraw consent at any time, and withdrawing must be about as easy as giving it. After that, you must stop processing within a reasonable time and make your processors stop, unless a law requires or allows it.Test the stop path on every channel. Does one STOP reach the CRM, the email tool and the WhatsApp tool?
Act s.6(10)If a question about consent comes up in a proceeding, the data fiduciary must prove two things. The notice was given, and consent was given as the Act and Rules require.Keep a record for each lead. See the record checklist below.
Act s.7(a)Data a person volunteers for a specified purpose may be used for that purpose, unless she has said she does not consent. The Act's examples: a receipt sent to a shopper's phone, and a broker who answers a message asking for help and stops when told the help is no longer needed.Use this ground for the thing the person asked for. The text does not say whether a later promotion is the same purpose, so name promotions in the notice.
Act s.8(1) and (2)The data fiduciary stays responsible for processing done for it by a processor. A processor may be used only under a valid contract.Check the contracts with your agency, CRM, SMS and WhatsApp providers.
Act s.8(5) and (6); Rules 6 and 7Take reasonable security safeguards. Rule 6 lists the minimum, such as encryption or similar protection, access control, logs and backups. After a breach, tell each affected person without delay. Tell the Board too, with fuller details within seventy-two hours (rule 7).Know who can open your lead sheets. Name one owner for a breach plan.
Act s.8(7); Rule 8Erase personal data when consent is withdrawn, or when it is reasonable to assume the purpose is no longer served, unless a law requires you to keep it. Rule 8 sets a fixed three-year period only for large e-commerce, online gaming and social media firms (Third Schedule).Set a deletion rule for cold leads. Rule 8(3) also asks for logs to be kept at least one year. The text does not say how the two fit. Ask a lawyer.
Act s.8(9), (10) and 13; Rules 9 and 14Publish the contact of the data protection officer or of a person who answers questions. Set up a way to settle grievances. Rule 14(3) asks you to publish a response time of no more than ninety days. A person must use that route before going to the Board (s.13(3)).Put a contact and a grievance address on the site, and in every reply to a rights request (rule 9).
Act s.9; Rules 10 and 12A child is anyone under eighteen (s.2(f)). Before processing a child's data you need verifiable consent from a parent or guardian. Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children.If a campaign can reach under-18s, do not retarget them. Ask a lawyer how to treat age.
Act s.11 and 12A person who gave consent can ask for a summary of the data you process, the names of others you shared it with, and correction, completion, updating or erasure.Know where each person's data sits so that you can answer.
Act s.33 and the ScheduleAfter an inquiry, the Board may impose a penalty if a breach is significant. The amounts in the Schedule are maximums. The Board weighs the nature, gravity and repetition of the breach (s.33(2)).Treat the numbers as ceilings and not as prices. See the penalty section.

Figures as of 22 Oct 2026.

Section numbers are from the Act unless marked as a rule. The last column is our own suggestion, not part of the text.

Who this is for

This is for people who run marketing at an Indian company. You may run a website form, a lead ad, an event sign-up sheet, a CRM or a WhatsApp list. It does not cover TRAI rules on SMS and calls, or the lead form rules of ad platforms. We did not read those for this guide.

Which dates apply?

Section 1(2) of the Act says it starts on dates the Central Government sets by notification, and that different parts may start on different dates. We did not open an official notification that says which sections of the Act are in force today, so we do not say. A release from the Press Information Bureau (PIB), posted 14 November 2025, says the Rules mark the full operationalisation of the Act, and that they give an 18-month phased timeline.

Rule 1 of the Rules sets the Rules' own dates. The Gazette is No. 760, dated Thursday 13 November 2025. We counted from that date. PIB posted its release a day later, so ask your company secretary to confirm the exact dates.

  • Rules 1, 2 and 17 to 21 started on publication, 13 November 2025. They cover the title, definitions and the set-up of the Board.
  • Rule 4, on consent managers, starts one year after publication. By our count that is 13 November 2026.
  • Rules 3, 5 to 16, 22 and 23 start eighteen months after publication. By our count that is 13 May 2027. This block holds the notice (rule 3), security (rule 6) and breach reports (rule 7). It also holds erasure (rule 8), the published contact (rule 9), children (rules 10 and 12) and rights (rule 14).

A consent manager is a registered person who helps someone give, manage and withdraw consent from one place (section 2(g)). A normal marketer does not need to be one.

What must the notice contain? (Rule 3)

Section 5 of the Act asks for a notice. Rule 3 says what it must be like. The notice has three parts.

  • It must make sense on its own, without the reader needing any other page you publish (rule 3(a)).
  • It must be in clear, plain language. It must list the personal data item by item. It must name each purpose and describe the goods, services or uses the data enables (rule 3(b)).
  • It must give a link to your website or app and any other means to withdraw consent, use the person's rights and complain to the Board. Withdrawal must be about as easy as giving consent (rule 3(c)).

PIB's release calls this a standalone notice. A long privacy policy with a tick box next to it may not meet rule 3(a). The text does not say that outright, so ask a lawyer.

WhatsApp: what Meta's pages say

We read the WhatsApp Business Messaging Policy page on 22 October 2026. It shows a last updated date of 23 September 2026. We also read Meta's developer page on getting opt-in. It shows no date.

  • Policy page: you may contact a person on WhatsApp only if she gave you her number or username and you have her opt-in permission.
  • Policy page: you choose the method of opt-in, and you must follow applicable law.
  • Policy page: you must respect requests to block, stop or opt out. You must also secure the notices, permissions and consents needed to collect, use and share people's information.
  • Developer page: an opt-in must say clearly that the person agrees to hear from the business, and must name the business. Examples of methods are SMS, a website, a phone menu, or in person and on paper.
  • Both pages: separate opt-ins for each message category are suggested, and clear steps to opt out.
  • Developer page: it mentions a November 2024 policy update under which the opt-in can be general and need not be specific to WhatsApp.

What the DPDP Act adds, and what we did not find

We did not read an official Indian text that applies the Act to WhatsApp messages in particular. The Act covers digital personal data in general (section 3). A mobile number saved with a name fits the definition of personal data. Whether a number alone does, the text does not say.

So the rules stack. Meta asks for opt-in and a named business. The Act asks for a notice, a clear yes and proof. One way to meet both is a single opt-in line. It names your firm, says WhatsApp, states the purposes and says how to stop. This is our method and not a rule.

What if a person messages you first? The Act gives an example in section 7. A broker answers a message that asked for help and stops when the person says she no longer needs it. The text does not say you may then add that person to promotional broadcasts. For those, ask for opt-in.

For the platform side, such as templates and the business account, read our WhatsApp Business API guide. API means application programming interface, the way software talks to WhatsApp.

A lead form checklist

These are the points a form and its notice should cover. They come from section 5, section 6 and rule 3, put into a form. The order and wording are ours.

  • Your business name, and a plain line saying who is asking.
  • The data you collect, listed field by field: name, mobile number, city, company.
  • Each purpose in one line: to call about the enquiry, to send a quote, to send offers on WhatsApp.
  • A separate, unticked choice for promotions, apart from the enquiry itself.
  • The channels you will use: call, SMS, email, WhatsApp.
  • How to stop: reply STOP, click a link or write to an address. It must be about as easy as signing up.
  • How to ask for a copy of the data, ask for a correction or erasure, and complain. Add the contact and the grievance route.
  • A link to the full privacy page. The notice itself must still stand alone.
  • English, plus a language choice.

A consent record checklist

Section 6(10) puts the burden of proof on you. A record you can open for any one person in a minute answers it. Keep these items for every lead.

  • Who: the name, phone number or email.
  • When: the date and time.
  • Where: the form name, the page address, the ad, the event or the chat.
  • What they saw: the notice text and its version number. Keep a copy of each version.
  • What they did: ticked a box, pressed a button or sent a message.
  • Which purposes and channels they agreed to, each recorded on its own.
  • Any withdrawal: the date, the channel, and when processing stopped in every tool.
  • Who got the data from you, such as your CRM, your agency and your messaging tool.

What to do about the lists you already hold

Section 5(2) speaks of consent given before the Act's commencement. For that case, the data fiduciary must send a notice as soon as reasonably practicable. It may keep processing the data until the person withdraws consent. That helps lists with a real record of agreement. It does not say what to do with lists that have none.

  • Count your lists and group them by source: website forms, ads, events, referrals, bought files.
  • For each group, find the record of how each person agreed. Note the groups that have none.
  • Send a notice to the groups with a record, in the way section 5(2) describes.
  • For groups with no record, the text is silent. Section 6(10) puts the burden of proof on you where consent is the basis. Decide with your lawyer. Our method is to pause promotions to them and ask for a fresh opt-in.
  • Remove people who have said stop. Correct wrong numbers. Section 8(3) asks for accuracy when data is used to decide something about a person or is passed to another fiduciary.
  • Apply a deletion rule to old, cold leads (section 8(7)). Ask your tool providers where copies sit.
  • Pick a date and an owner, and write down the result.

Children and campaigns

A child, under section 2(f), is anyone under eighteen. Section 9(3) says a data fiduciary shall not undertake "tracking or behavioural monitoring of children or targeted advertising directed at children". Section 9(4) lets the rules lift this for some classes and purposes. The Fourth Schedule to the Rules lists them. The ones we read are health care, schools, crèches, child transport and a few safety or legal purposes. Ordinary advertising is not on that list.

The text does not define directed at, and it does not say how a marketer should find out a person's age. If your campaign can reach under-18s, ask a lawyer before you build retargeting.

What are the penalties?

Under section 33, the Board may impose a penalty after an inquiry if it finds a breach significant. The Schedule sets the maximums. Item 1, reasonable security safeguards (section 8(5)), is up to two hundred and fifty crore rupees. Items 2 and 3, breach intimation (section 8(6)) and children's data (section 9), are up to two hundred crore rupees each. Item 7, breach of any other provision of the Act or Rules, is up to fifty crore rupees.

Sections 5 and 6 have no row of their own. We read them as falling under item 7. Ask a lawyer to confirm. These are ceilings. Section 33(2) lists what the Board weighs, such as the nature and gravity of the breach, repeats, the gain made and the steps taken to reduce harm.

Section 17(3) lets the Central Government exempt some classes of data fiduciary, including startups, from section 5 and a few other duties. We found no such notification in the texts we read. Do not assume you are exempt.

Slips we watch for

This is our own checklist from how forms and lists are usually built. It is not a finding from the Board, and it names no company.

  • One tick box covers terms, the enquiry and promotions together, so the yes is not specific.
  • A box is ticked already, so there is no clear action by the person.
  • The form asks for more fields than the stated purpose needs.
  • The notice sits inside a long privacy page, and the form shows only a link.
  • The notice is in English only.
  • The WhatsApp opt-in line does not name the business.
  • A person who asked for a quote is moved to a promotional broadcast without a new yes.
  • A STOP reply is honoured in one tool but not in the CRM or the email tool, so a message goes out again.
  • No record of which wording a person saw.
  • Leads are shared with an agency or a tool with no written contract.
  • Lead sheets sit in personal phones and open drives, with no control on who can see them.
  • Nobody owns the contact and grievance inbox.
  • Youth or education campaigns run with no thought of age.

When to ask a lawyer or company secretary

Ask before you act in these cases. Which sections are in force today? Could your firm be notified as a significant data fiduciary (section 10)? Also ask about data from directories or public profiles, lists with no consent record and any campaign near under-18s. Ask about sending data outside India (section 16 and rule 15) and the contracts with your processors. This guide is information, not legal advice. Your lawyer or company secretary decides what applies to you.

When to call us

PromotEdge builds forms, CRM set-ups and WhatsApp flows for Indian companies. See our lead generation, CRM and marketing automation and WhatsApp marketing work. For a second pair of eyes on your forms and lists, we offer a free 30-minute strategist call and a one-page plan, for projects we think we can help. We take on a limited number, so we'll tell you honestly if it is a fit. Ask for a growth plan. For outreach to other firms, known as business-to-business (B2B) selling, read the B2B lead generation guide.

/ 03 Before you publish or send

What to checkstep by step

  1. 01

    List where data comes in

    Every form, lead ad, event sheet, chat and import, with the fields each one takes.

  2. 02

    Name the purpose

    One plain line for each use of the data, including promotions.

  3. 03

    Write the notice

    Data item by item, purposes, and how to withdraw, use rights and complain (section 5, rule 3).

  4. 04

    Ask for a clear yes

    An unticked box or a button press, with promotions kept apart from the enquiry. On WhatsApp, name the business.

  5. 05

    Offer a language choice

    English and an Eighth Schedule language (sections 5(3) and 6(3)).

  6. 06

    Make stopping easy

    A stop path on every channel, and one stop that reaches every tool.

  7. 07

    Keep the record

    Who, when, where, which wording, what they did, what they agreed to.

  8. 08

    Publish the contact

    A named person for questions, and a grievance route with a response time (section 8, rules 9 and 14).

  9. 09

    Check vendors and security

    A written contract with each processor, control on who opens lead files, and a breach plan with one owner.

  10. 10

    Review old lists and age

    Group by source, send notices, pause what has no record, and handle under-18 reach.

We opened each source below on 22 October 2026. The Act and Rules may be amended, so check the current text before you act. This is general information, not legal advice. For your case, speak to a lawyer. This guide explains official text in plain words. Last checked: 22 October 2026.

  • Source: Ministry of Law and Justice, Gazette of India Extraordinary No. 25, the Digital Personal Data Protection Act, 2023, 11 August 2023 | www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf. Used for: sections 1(2), 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 13, 17(3), 33 and the Schedule.
  • Source: Ministry of Electronics and Information Technology, Gazette of India Extraordinary No. 760, the Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025 | www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf. Used for: rules 1, 3, 6, 7, 8, 9, 10, 12, 14 and the Third and Fourth Schedules.
  • Source: Press Information Bureau, Ministry of Electronics and IT, release on the DPDP Rules, 14 November 2025 | www.pib.gov.in/PressReleasePage.aspx?PRID=2190014. Used for: the 18-month phased timeline and the standalone notice.
  • Source: Meta, WhatsApp Business Messaging Policy, page shows last updated 23 September 2026, read 22 October 2026 | whatsappbusiness.com/policy. Used for: opt-in permission, opt-out and consent duties.
  • Source: Meta for Developers, WhatsApp getting opt-in page, no date on the page, read 22 October 2026 | developers.facebook.com/docs/whatsapp/overview/getting-opt-in. Used for: what an opt-in must state and the methods it lists.
  • Not opened or not found: an official notification of which sections of the Act are in force today. Any official Indian text that applies the Act to WhatsApp messages. TRAI rules. Ad platform lead-form rules. Any startup exemption under section 17(3).
  • The table's last column, the checklists, the slips and the list review are our own framing.

Brands and people are named only as public examples. They are not PromotEdge clients or endorsers unless stated.

What people say

What clients say

What clients told us after working with PromotEdge.

Fine Organics
“PromotEdge and their team did an excellent job with our website. They engaged with every team member, understanding their needs with great patience before collating them into a user requirement and a design spec. The result was both aesthetically pleasing and usable. PromotEdge continues to support us and our ever-growing and very demanding wish list. We hope to grow this relationship beyond website design and into content development. I am confident that PromotEdge's team will continue to guide us in delivering product content to our global customers, making the website an important tool for product awareness and lead generation.”
Bimal ShahBimal ShahExecutive Director at Fine Organic Industries LimitedManufacturing
TATA Metaliks
“PromotEdge has been working with our organization for social media management and other creative activities. They are responsive, supportive and hard working. We look forward to a long and positive relationship with them.”
Medha SharmaMedha SharmaStrategic Head at TATA MetaliksSteel and metals
Birdman Chemeng Pvt Ltd.
“PromotEdge has been a unique creative group amongst unique creativity world. Approaching, analysing, understanding the deliverables with ethos and transferring the same into a spellbound creative identity, just cut out for clients’ requirement are signature values of the team. A huge ROI, thy name is PromotEdge.”
Rajat ChatterjeeRajat ChatterjeeHead Business Development at Birdman Chemeng Pvt Ltd.Manufacturing
Utkarsh India
“An aligned partner is always a welcoming step. Someone who can think deep through lines, understand the matrix of product management. Fortunate enough, PromotEdge has been a partner in progress for me. Their uniqueness lies in their hands down knowledge of delivering the strategy and communication needed for the hour. A practical approach to ensuring return of investment has been the day one mantra. An advisory to an executionist, the systematic approach by team PromotEdge has been the impeccable.”
Bobby SrinivasBobby SrinivasChief Manager Marketing & Brand Marketing at Utkarsh IndiaSteel and metals
Magik Lighting
“We are thoroughly impressed with the extensive knowledge and professionalism demonstrated by PromotEdge. Their adept management of our digital and creative requirements has significantly contributed to our satisfaction with their digital marketing services and expertise.”
Rahul MishraRahul MishraAssistant Manager Digital Marketing & Ecommerce at Magik LightingElectricals
Shyam Metalics Group
“We have been working with PromotEdge for almost a year. We have engaged them to manage our Digital marketing campaigns and are impressed with the outcome. Within weeks, we had noticed an increase in performance and they continuously worked on adapting to a new strategy if required to get the maximum mileage for us based on our requirements. A big thank you to their team, and I would highly recommend them to anyone who is considering growing on their Digital Space.”
Shubham GadodiaShubham GadodiaDeputy Brand Manager at Shyam Metalics GroupSteel and metals
Brahmaputra Volleyball League
“I really want to thank Sayantan and his team from PromotEdge because what I find good in them is that, the team. When the team is wonderful, the outcome will definitely be wonderful. I have seen the first cut of the reel which they shot the first day, and they gave us on the morning of the second day. The entire first day they worked so hard and over the night they have edited and on the morning they shared it with us. This is just fabulous and the commitment they have shown. The FIVB team has said that they are very happy with team PromotEdge. And when I showed this clip to my friends, those who are from this industry, they (also said that they) have done a fabulous work. So happy and compliments to the team -- Sayantan and PromotEdge team. Thank you.”
Abhijit BhattacharyaAbhijit BhattacharyaFormer Captain Indian VolleyBall Team; and Founder of Brahmaputra Volleyball LeagueSports
Rishta Foods
“PromotEdge is one of the most hard working creative agency that LISTENS ! Do I need to say anything more ?!!!! Saurav is one of the most open person I have come across who is ready to speak abt the elephant in the room , that no body wants to talk about !”
Harsh GuptaHarsh GuptaManaging Director at Rishta FoodsFMCG
Prime Volleyball League
“I would just like to congratulate, PromotEdge Led by Sayantan and his Team who have done an absolutely fantastic job of branding for the Kolkata Thunderbolts, the Branding, the social media campaign was bang on, and I think it help not just the Kolkata Thunderbolts but its really helped me because in the East there was at least one Team that looking very well promoted and branded. Thanks guyz, well done.”
Joy BhattacharjyaJoy BhattacharjyaCEO at Prime Volleyball LeagueSports
iLead
“I am delighted with the successful launch of our new website, thanks to the exceptional support from PromotEdge. I extend my gratitude to Benjamin and the team for their dedication and hard work, which has resulted in a new, fresh-looking site that perfectly meets our expectations.”
Mom MitraMom MitraMarketing Head at IleadEducation
Nitya Gold & Diamonds
“I commend PromotEdge as a content and advertising partner. I applaud their top-notch team, swift problem-solving, and outstanding digital media work for my brand. I express my happiness and eagerness for a long-term partnership.”
Priyanka GuptaPriyanka GuptaDirector at Nitya Gold & DiamondsJewellery retail
PRAN RFL Group
“PRAN & PromotEdge have been working together for last 1.5 years. Throughout, the work experience is good and satisfactory. As a client, we found PromotEdge very professional and dedicated towards any project assigned to them. Most importantly, They have a bunch of energetic young people who always think from clients’ point of view and come up with the solution which is appropriate for them. I would personally refer PromotEdge to those who want creative and contemporary work. We wish PromotEdge a successful journey ahead.”
Sharif Rezwan KabirSharif Rezwan KabirBrand Manager at PRAN RFL GroupFMCG
Unimark Group
“As a progressive and emerging digital marketing company, PromotEdge is doing something right to enhance the experience of companies associated with them. The format they have created is great, there is a smooth flow of communication, great brainstorming sessions and additionally super ideations and executions. Pritha, the account manager, has always been supportive. Whether day or night, weekday or weekend, she came through and solved the problems.”
Anish Basu MallikAnish Basu MallikMarketing Executive at Unimark GroupReal estate
FIVB
“Hi, my name is Hitesh Malhotra. I'm working in FIVB. We are working with PromoteEdge (with Team Sayantan). I would like to give you a brief detail. So when we started this project, we had a good discussion with them. And personally, I feel PromotEdge is kind of a one stop solution for us. So basically, they provided us the whole storyboarding regarding the digital assets and how we can use those with our ambassadors programme. They helped us a lot to structurize the whole concept from our side. So in fact, there were a lot of great ideas they provided, guiding us...what we should do and what we should not do in this regard. And the best part was that they were very clear from there, from the whole blueprint. So they understood our request from the proposal and then accordingly they executed it.”
Hitesh MalhotraHitesh MalhotraSports Development at Fédération Internationale de Volleyball - FIVBSports
ABP Education
“Working with PromotEdge has been an enriching experience for ABP at many different levels. Your understanding of the digital space, customized brand solutions and prompt servicing have helped us achieve our brand goals with so much ease. I would like to especially thank the creative development team, the digital strategy team and above all the servicing team with whom I have worked in close association with, for their all-round support. I wish you all the best in your upcoming projects and I look forward to collaborating with you in future as well.”
Satabdi SahuSatabdi SahuLead - Brand and Content at ABP EducationEducation
“The PromotEdge Agency stay with us all these 3 days, since when we arrived..more, more than 3 days. Since in the airport, they stayed together with us (FIVB team). Sayantan and his team is providing you to see this video. I just (want to say) _Shukriya_. Thank you so much for your team, because we are here in front of the camera but all the team is behind. The entire team together did this great job so that you can see how much volleyball is a lovely sport.”
GibaGibaBrazilian Former Volleyball PlayerSports
“In the city of Kolkata , there are very few full service advertising agencies which are compact, agile, quick and yet have the vision and creative /executional abilities of large reputed agencies. My experience with PromotEdge has been extremely satisfying and they have done world class job for Brand Building exercise of LION INDIA.In my professional life spanning over 4 decades I have always worked with leading agencies like Lintas, Grey, etc so my benchmarking was rather high. I am delighted to say that i did find the agency measuring up nicely on every parameter of our expectations. The team led by Avik Guha comes majorly from experienced staff who have had experience in large agencies. Added to this is the” young oozing with unique new.”
Hardeep SinghHardeep SinghMarketing Consultant
“It’s a great way to be back at PromotEdge. I had a great time working them in Kolkata Tunderbolts doing the Volley Biswas character and they all are like good friends like family Saurav Bhaiya, Avik Da, and as I speak, I see Sayantan da walking in. HA HA! But it’s been a great experience I am glad to again meeting them and being here at the PromotEdge. Make Calcutta relevant again.”
Priyam GhosePriyam GhoseContent Creator
Read all 20 testimonials
Running lead forms or WhatsApp lists?

Know what you hold.And why you hold it.

Get a growth plan Call us WhatsApp us

Or leave your number. A strategist calls you in one working day.

We use these details only to call you back. Privacy policy.

Common questions.

  • A firm that decides why and how it uses personal data is a data fiduciary (section 2(i)). It needs a lawful ground, usually consent. It must give a notice with or before the consent request, honour withdrawal, and be able to prove notice and consent (sections 4, 5, 6).

  • The Act asks for consent or a certain legitimate use, such as the purpose a person volunteered her data for (sections 4 and 7(a)). Meta's WhatsApp policy page asks for opt-in permission. We read no official Indian text that applies the Act to WhatsApp messages in particular.

  • Under section 5 and rule 3, the notice lists the personal data item by item and each purpose. It describes what the data enables. It says how to withdraw consent, use rights and complain to the Board. It must make sense on its own, in plain language, with a language choice.

  • Per rule 1, rule 3 on the notice starts eighteen months after publication in the Gazette of 13 November 2025. By our count that is 13 May 2027. Rule 1 puts consent managers (rule 4) one year after, by our count 13 November 2026. We did not read which Act sections are in force today.

  • Section 6(10) puts the burden of proof on the data fiduciary. Our method is to record who, when, where, which notice version, what the person did, and what she agreed to. Also record any withdrawal and when processing stopped in every tool, including your agency's.

  • The Schedule sets maximums. Breach of any provision without its own row can reach fifty crore rupees (item 7). Security and breach notice duties, and children's data, have higher ceilings. The Board weighs the nature, gravity and repetition of the breach (section 33(2)). Ask a lawyer about your case.

  • Section 5(2) covers consent given before commencement. You must send a notice as soon as reasonably practicable, and you may keep processing until the person withdraws. The text does not say what to do with lists that have no consent record. Ask a lawyer, and pause promotions to them meanwhile.

  • Section 9(3) bars a data fiduciary from targeted advertising directed at children, and a child is anyone under eighteen. The Fourth Schedule to the Rules lists exemptions, such as health care and schools. We saw no exemption for ordinary advertising. The text does not define directed at.