Reaching out
Rules for contacting strangers for work in India and abroad
In India, the DPDP Rules phase in through May 2027, TRAI regulates commercial calls and texts, and WhatsApp requires opt-in, so treat a found contact as a way to ask, not as permission.
By Invenitor team. Updated .
What should you know before you read this?
This is a plain summary for people contacting others one at a time, checked on 2026-11-01. It is general information and not legal advice. Laws change, they differ by country, and details matter. Ask a lawyer if you plan to contact many people, or if you work in a regulated sector.
Most guides on this subject cover the US and Europe and stop there. If you work in India, the rules for calls and WhatsApp matter just as much as the rules for email, so this guide begins with them.
What does India's DPDP law change?
India's Digital Personal Data Protection Act, 2023 is coming into force in phases, under rules notified in November 2025. A summary by the law firm Shardul Amarchand Mangaldas lists these dates:
| Date | What applies |
|---|---|
| 14 November 2025 | Commencement provisions, and setting up the Data Protection Board |
| 14 November 2026 | Registration of consent managers |
| 14 May 2027 | Notice and consent duties, breach reporting, security safeguards, and the rights of individuals |
The person or company that decides why and how personal data is used is called a data fiduciary. When you decide to use someone's contact details, you may be one. Ask a lawyer how the law's exceptions apply to your case, particularly for data a person has made public themselves.
What applies to calls and text messages in India?
TRAI's rules on unsolicited commercial communication are aimed at telemarketing. Key points, from TRAI's own documents:
- Promotional auto-dialler and robocalls should go through 140-series numbers (TRAI press note). Service and transactional calls of that kind go through the 1600 series.
- Against unregistered telemarketers, telecom providers can issue warnings, apply a usage cap of twenty calls and twenty messages a day, and disconnect after repeated violations (TRAI regulation, 2025).
- People can register preferences and report spam through the DND app or by calling or texting 1909.
A single call to a business about a specific matter is a long way from dialling a list. But if you call many people with a promotion from your own mobile number, these rules are aimed at you.
Can you message someone on WhatsApp if you have their number?
Not for business, unless they opted in. WhatsApp's business policy says you may only contact people if "they have given you their mobile phone number or username" and "you have received opt-in permission from the recipient". It also says "You must respect all requests (either on or off WhatsApp) by a person to block, discontinue, or otherwise opt out" (WhatsApp Business policy).
A number you found in a search does not meet that test. Many Indian guides skip this, since WhatsApp feels so informal. Use it after someone has shared their number with you and agreed to it. Being blocked and reported can also affect your own number.
What about email to the US, the EU and Gmail users?
If your recipients are abroad, their local rules can apply to you. A summary of the ones you are most likely to meet:
| Rule | What it asks | Source |
|---|---|---|
| US CAN-SPAM | No misleading headers or subjects, identify the message as an ad, give a physical location, offer an opt-out, and honour it within 10 business days. Penalties reach $53,088 per email. | FTC guide |
| Gmail, all senders | Set up SPF or DKIM, and keep spam below 0.30%, with a target of under 0.10%. | |
| Gmail, over 5,000 a day | Also DMARC, alignment, and one-click unsubscribe on marketing mail. | |
| EU and UK | Rules vary by country and by whether the recipient is a person or a company. GDPR requires a lawful basis for using personal data. Take advice. | Not checked: the UK regulator's page refused our check |
What does Invenitor itself require of you?
Invenitor's Terms make you responsible for how you use what you get. They prohibit using the data for unconsented electronic marketing, telemarketing or automated outreach, and they describe you as responsible for any communication you start. Invenitor does not send messages for you.
Anyone can ask to have their details removed at the removal page. If someone tells you to stop, stop, whether or not any law requires it.
What habits keep you on the right side of all this?
These habits suit almost every rule above, and they also get better replies:
- Write to one person at a time, with a reason that applies to them.
- Say who you are and how you found them.
- Use a real name and a real reply address, and never mislead in the subject line.
- Make it easy to say no, and act on it the same day.
- Keep one do-not-contact list of your own.
- Keep only what you need. Delete details you no longer have a reason to hold.
- Do not automate messages to people who have not agreed to them.
Keep the cost of finding someone in perspective. A search is 20 credits (₹40), while a damaged domain or a reported number is much harder to repair. See how to write a first email.
Common questions
- Is cold emailing legal in India?
- No Indian law bans all of it, but rules are changing, and the DPDP Act's notice and consent duties are listed for May 2027. Ask a lawyer about your own case.
- Can I add someone to my mailing list because I found their email?
- Do not. A mailing list needs agreement, and a found address is not agreement.