Can we send offers to past customers and leads?

Short answer: Only with separate consent and an easy way to stop

Marketing needs consent that is separate and specific, unless the person clearly expects it from the relationship. Bought or scraped lead lists are risky because you cannot show consent. Every message should carry an easy way to stop.

What the law says

Section 6 sets the consent standard. Section 5 needs a notice. Section 9 bars targeted advertising at children.

Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
Section 9 · Rules 10, 12: For anyone under 18, get verifiable consent from a parent or lawful guardian, and do not track, behaviourally monitor or target advertising at children. Rule 12 and the Fourth Schedule exempt some classes and purposes, for example clinical establishments and healthcare professionals to the extent needed to protect the child's health.

Steps

Separate service messages from marketing messages.
Ask marketing consent separately, with a clear action.
Stop using bought lists unless the seller can show consent for you.
Add an easy stop option to every message.
Respect the telecom preference rules for calls and SMS.

Evidence to keep

Marketing consent records
Lead source records
Stop requests and their handling

Common mistakes

Treating account sign-up as marketing consent
Agency lists with no consent proof
A stop option that does not work

How it plays out by sector

Banking, financial services and insurance: Telemarketing must follow TRAI's preference rules as well as DPDP consent.
IT, ITeS, BPO and GCC: B2B prospect lists still need a lawful source and an easy unsubscribe.
Public sector undertakings and utilities: Do not let partners use consumer lists for their own offers.
Healthcare and hospitals: Health package offers to past patients need separate consent.

From each seat

CEO / MD: Growth teams feel this first. Back the rule that marketing runs only on clear consent; it protects the brand.
Marketing department: Every campaign list needs a consent source. If you cannot say where the consent came from, do not use the list.

What a good answer from management sounds like

“Marketing runs only on separate consent. Lead lists are checked, and stop requests take effect within a day.” Effort and time: Light to medium · 4 to 8 weeks.