Customer photos and testimonials need a clear purpose

Imagine a customer agreeing to a photograph after a successful installation. The team posts it on a local social account. Six months later, the same photograph appears in a paid campaign alongside the customer’s name, neighbourhood and a quotation assembled from a longer message. Those are several decisions, even though the business is using one image.

Before collecting a customer story, define what you want to publish and why. A clear conversation at the beginning is easier than reconstructing an ambiguous agreement after the asset has spread across channels.

Decide what the permission is meant to cover

A recognisable image, a name attached to a review, or a distinctive combination of details can be personal data within section 2(t). As of 22 October 2026, the relevant substantive DPDP duties are scheduled for 13 May 2027 under the commencement notification. The steps here prepare for the future framework and do not replace assessment of other applicable rights or existing obligations.

For consent-based use, sections 5 and 6(1) will require the relevant notice and specific, informed consent, alongside the other statutory conditions. Explain the proposed purpose, publication channels, identifying details and meaningful consequences. ‘We may use your information’ is a poor description of a prominent public campaign.

Do not assume a transaction makes promotional participation compulsory. Keep the customer’s ability to receive the purchased service separate from an optional request to feature them, unless a different arrangement has been specifically assessed and clearly explained.

Check the complete asset

Look beyond the main subject. A photograph can reveal another person in the background, a house number, a prescription, a computer screen or a child’s school badge. A testimonial screenshot may expose the sender’s phone number and other messages.

Remove unnecessary information before publication. If another identifiable person remains, consider their position separately. The main customer’s agreement does not automatically speak for everybody in the frame. Where children are involved, the additional framework needs its own careful assessment; do not treat the adult’s participation as a shortcut.

Review the final caption too. A harmless-looking image can become more identifying when combined with a full name and precise location. Decide whether those additions contribute to the intended story or merely add exposure.

A hypothetical installation case study

A local solar installer wants to show a completed residential project. It explains that the proposed story will appear on its website and one named social channel, using an exterior photograph and the customer’s first name. The customer can see the proposed wording before release.

The team notices that the photograph includes a visible house number and a neighbour. It selects a different angle and removes unnecessary location detail. The approved text describes the work without inventing a performance claim or turning a casual compliment into a measured outcome.

Later, the marketing team wants to use the image in a different paid campaign with a detailed customer profile. It checks whether that purpose and level of identification were covered. If not, it has a new conversation instead of treating the original agreement as unlimited permission.

Keep the evidence connected to the asset

Use an internal asset identifier linked to the applicable notice, permission, approved version and intended channels. Record who can authorise a change. You do not need a sprawling folder of personal documents to establish that a particular publication was agreed.

If a customer has already posted a review publicly, assess that situation precisely. Section 3(c)(ii) contains a future scope exclusion for data made publicly available by the individual concerned, or by another person legally obliged in India to make it public. It is narrower than ‘anything found online’. Even when it is relevant, it does not settle every issue about editing a quotation, implying an endorsement or using someone else’s creative material.

Plan for a later change of mind

Under the coming section 6(4) to 6(6) framework, withdrawal of consent must be possible with comparable ease, with the affected processing stopped within a reasonable time unless another legal authority or requirement permits continuation. Identify the channels and agencies you control so a request reaches the people able to act.

Explain practical limits accurately. You may be able to remove a website asset and stop a future campaign, while a physical leaflet already distributed or an independent third-party copy presents a different problem. Do not promise complete internet erasure. Document the action taken and unresolved matters, and assess any retained evidence separately.

The central failure is permission that cannot be tied to a use. Keep the photograph, the words, the audience and the customer’s decision connected throughout the asset’s life.