Part of our guide: Is AI Calling Legal in India? TRAI, DND, DPDP and Consent (2026)
Key takeaways
- A recording of an identifiable caller is digital personal data under the DPDP Act, so notice, a lawful basis, security and erasure duties apply.
- Most of the DPDP Rules 2025 obligations (notice, security, breach reporting, retention, rights) start on 13 May 2027, so use the months before then to fix your process.
- A lead who asked to be called has given you a basis to call them; tell them the call is recorded and why, and let them object.
- Write a retention period for each type of call data (audio, transcript, summary, sheet status) and automate deletion.
- Your calling provider is normally your Data Processor; responsibility stays with your business, so get the contract right.
If your team records sales or support calls, the DPDP call recording question is no longer theoretical. India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 decide how you tell callers about recordings, why you keep them, who can listen and when you delete them. This checklist turns those rules into steps a business owner can run this quarter.
This article is general information, not legal advice. For decisions specific to your business, speak to a lawyer who works on data protection.
What does the DPDP Act say about call recordings?
The DPDP Act does not mention call recordings by name. It covers personal data about an identifiable individual in digital form, and a recorded voice linked to a phone number, a name or a CRM row fits that description. So your recordings, transcripts and AI call summaries all carry the same duties as any other customer record.
Under the Act itself, the law covers personal data collected digitally, and data collected offline and digitised later. For a calling team that means the paper walk-in register you type into a Google Sheet is covered too, not just the web form.
For recordings, the duties that matter most are:
- Notice (Section 5): tell people what data you collect and why, how to exercise their rights and how to complain. The notice can be in English or any language in the Eighth Schedule of the Constitution — useful when your calls run in Hindi, Kannada or Tamil.
- Consent (Section 6) or legitimate use (Section 7): you need a lawful basis for each purpose.
- Security (Section 8(5)): reasonable safeguards to prevent a breach, including for processing done by your vendors.
- Erasure (Section 8(7)): delete data when consent is withdrawn or the purpose is served, unless another law makes you keep it.
- Rights (Sections 11–13): access, correction, erasure and a working grievance channel.
When do the obligations actually start?
The PIB release on the notified Rules describes an 18-month phased compliance period. The commencement dates in the notification break down like this:
| Phase | Date | What starts |
|---|---|---|
| 1 | 13 November 2025 | Definitions and the Data Protection Board of India (Rules 1, 2, 17–21) |
| 2 | 13 November 2026 | Registration and duties of Consent Managers (Rule 4) |
| 3 | 13 May 2027 | Notice, security safeguards, breach intimation, retention, rights and the rest (Rules 3, 5–16, 22, 23) |
These dates are summarised in the SCC Online note on the notified Rules and in Hogan Lovells' analysis. As of October 2026 we have not seen an official change to this timeline, though some commentators have reported media expectations of a shorter one. Check MeitY before you lock your plan.
Do you need DPDP Act consent to record a business call?
Not always. The Act gives two routes: consent, or a "legitimate use" such as data a person voluntarily provided for a specific purpose. A lead who asked for a call-back has shared their number for that call. Recording is a separate step, so disclose it at the start and give an easy way to object.
The voluntary-enquiry route (Section 7(a))
Section 7(a) lets you process data "for the specified purpose for which the Data Principal has voluntarily provided her personal data", as long as she has not said she does not consent. The Act's own illustration is close to home for property sellers: a person messages a real estate broker asking for help finding a rental and shares her details; the broker may use them to send matching options, and must stop once she says she no longer needs help. You can read the section and illustrations on this annotated copy of Section 7.
For a calling team, that suggests:
- A Facebook or Instagram lead form asking "Request a call-back" supports a call about that enquiry.
- It does not obviously support calling the same person about an unrelated product six months later.
- When the person says "please don't call me again", stop, and record that preference so no agent or campaign dials them again.
When to ask for consent instead
If you plan to use recordings for something the caller would not expect (training a voice model, marketing analysis across products, sharing with a partner) rely on consent. Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give. A recorded "haan, theek hai" after a clear question is far stronger than a buried line in your website's privacy policy.
Keep the recording disclosure to one short sentence in the caller's language, then pause. Our callers told us long opening monologues feel rushed, so the disclosure works best as "This call is recorded for quality and to note your requirement — is that okay?" followed by silence, not a paragraph of legal text.
The DPDP call recording checklist: 10 steps
Work through these in order. The first four set your basis; the next four protect the data; the last two prove you did it. Most teams can finish steps 1–5 in a week; steps 6–10 need your IT person or calling provider.
- List every place call data lives. Audio files, transcripts, AI summaries, the Google Sheet or CRM columns your calls write to, daily email reports, WhatsApp follow-up logs. You cannot protect what you have not listed.
- Write the purpose for each. For example: "recordings — quality checks and resolving disputes about what was promised on the call"; "status column — knowing who to call back".
- Pick the lawful basis per purpose. Voluntary enquiry for calling the lead back; consent for anything beyond that.
- Fix your notice. Add call recording to your privacy notice in plain language, and add the one-line disclosure to every call script, in each language the agent speaks.
- Respect objections instantly. "Don't call me" or "don't record" must update the lead record the same day. Our platform's DND checks and calling-hour windows help, but the opt-out list is yours to maintain.
- Lock down access. Decide who can play recordings (sales head and QA, not the whole team) and who can watch calls live. Features like live call monitoring are useful for quality, so give that access to named people only.
- Share data privately. When we connected a D2C health and wellness brand's lead sheet (about 1,500 rows), it was shared with our service account as Editor and never made public. An "anyone with the link" sheet full of phone numbers is the kind of gap the security duty is about.
- Set retention and automate deletion. See the table below. Manual deletion "every few months" rarely happens.
- Prepare for rights requests. Under the Rules, access, correction and erasure requests must be answered within 90 days, according to the PIB release. Know how you would find one person's recordings by phone number.
- Write a breach plan. The Rules require you to inform affected people without delay, and the Board with a detailed report within 72 hours. Agree with your calling provider how fast they will alert you.
How long should you keep call recordings? (data retention for calls)
For data retention, calls are like any other record: keep each type of call data only as long as its written purpose needs it, then delete it unless another law requires longer. The DPDP Rules 2025 also set a one-year minimum for certain logs and associated data. Decide periods per data type with your adviser, then automate them.
The table below is a working template, not a legal standard. Fill in the last column with your adviser.
| Call data type | Typical purpose | What to consider | Your retention period |
|---|---|---|---|
| Audio recording | Quality checks, resolving disputes about what was said | Longest-held item for most teams; restrict access | ______ |
| Transcript | Search, coaching, auditing scripts | Same sensitivity as audio; delete together | ______ |
| AI call summary | Handover to sales, follow-ups | Often needed while the lead is active | ______ |
| Status / outcome in Sheet or CRM | Knowing who to call, when | Needed while the lead is in your pipeline | ______ |
| Call logs (number, time, duration) | Billing, security, investigations | The Rules set a minimum one-year retention for certain logs | At least 1 year |
| Opt-out / do-not-call list | Not calling someone again | Keep as long as you call anyone; it protects the person | ______ |
Two practical points. First, Section 8(8) of the Act treats a purpose as over if the person has not approached you for a prescribed period, so a lead who went silent long ago is a candidate for deletion. Second, deleting a recording should also delete its transcript and summary — otherwise you have kept the content and only thrown away the audio.
What should you ask your AI calling provider about DPDP call recording?
When you decide who gets called and why, your business is the Data Fiduciary and the provider is usually your Data Processor. The Act keeps responsibility with you, including for what your processor does. So ask where data is stored, who can access it, how deletion works and how fast you will hear about a breach.
A short due-diligence list for any AI calling services vendor, including us:
- Contract: Is there a written agreement that says the provider processes data only on your instructions?
- Access: Which of their staff can hear recordings, and is access logged?
- Integrations: How does the platform connect to your Sheet or CRM: private sharing, or public links? Check the integrations setup before go-live.
- Deletion: Can you delete one person's recordings, transcripts and summaries on request, and in bulk by date?
- Number filters: Can it restrict calls to Indian (+91) numbers and skip malformed ones? We flag numbers typed with a "+" but no country code instead of guessing.
- Breach alerts: How quickly will they tell you, given your own 72-hour reporting window?
Common mistakes with call recordings
These are the gaps we see most often when businesses connect their calling data to a new system. None needs expensive software to fix; each needs a decision and a named owner. Fix them before May 2027, when the main DPDP Rules duties start.
- Disclosing in only one language. If the agent switches to Kannada or Marathi when the caller does, the recording notice has to work in that language too.
- Recording "just in case" with no written purpose. Without a purpose you cannot defend the retention period.
- Keeping transcripts after deleting audio. The words are the personal data; the file format is not the point.
- Public spreadsheet links. Lead sheets shared as "anyone with the link can edit" are common and avoidable.
- Ignoring "don't call me". Under Section 7(a) the basis ends when the person objects. Under TRAI's rules, repeated unwanted calls also invite complaints; see our guide on TRAI's 2026 anti-spam rules for automated calls.
- Treating it as the vendor's problem. The penalty schedule in the Act runs up to ₹250 crore for failing to take reasonable security safeguards, and the fiduciary carries it.
How does this fit with the rest of call recording law in India?
The DPDP Act governs the data. TRAI's commercial communication regulations govern the call itself: who you may call, from which number series and how complaints are handled. You need both. Our pillar guide, is AI calling legal in India, walks through how the two sets of rules sit together.
A sensible order for most businesses: fix your opt-out handling and number series first (that protects you from complaints today), then build the DPDP call recording process above so it is running well before 13 May 2027. If you want to see how recordings, transcripts and access controls work on a live agent built for your business, book a 20-minute demo — we'll call your phone with an agent set up for your business.
Frequently asked questions
Does the DPDP Act ban recording business calls in India?
No. The DPDP Act 2023 does not ban call recording. It treats a recording of an identifiable person as digital personal data, so the normal duties apply: a clear purpose, notice, a lawful basis such as consent or a voluntarily provided enquiry, reasonable security, honouring rights requests and erasing data when the purpose is over. This is general information, not legal advice.
Do I need consent to record a call with a lead who filled my form?
Section 7(a) of the DPDP Act allows processing for the specific purpose a person voluntarily shared their data for, unless they object. A lead who asked for a call-back has arguably shared their number for that call. Recording is a separate use, so we recommend telling the caller at the start that the call is recorded, and why, and offering a way to object.
How long should we keep call recordings under the DPDP Rules?
The Act says personal data should be erased once its purpose is served, unless another law requires you to keep it. The DPDP Rules 2025 also set a minimum one-year retention for certain logs and associated data. In practice, set a written retention period for each call data type with your legal adviser, and automate deletion.
When do the DPDP Rules 2025 obligations start?
The Rules were notified in November 2025 with phased commencement. Board-related rules applied at once, the consent manager rule from 13 November 2026, and the main obligations on notice, security, breach reporting, retention and rights from 13 May 2027. Check MeitY's site for any later change before you finalise your plan.
Is my AI calling provider responsible for DPDP compliance?
Mostly, no. When you decide why and how leads are called, your business is the Data Fiduciary and the calling provider usually acts as your Data Processor under a contract. The Act keeps responsibility with the fiduciary, including for processing done on its behalf, so the contract should cover security, access, breach alerts and deletion.
We build and run AI calling agents for Indian businesses from Gurugram, in Hindi, English and regional languages. Our articles draw on calls we have run ourselves and link to primary sources such as TRAI, DoT and MeitY for anything regulatory. Spotted something out of date? Write to support@digitalcallers.com.
See it on your own leads
In a 20-minute demo we set up an agent for your business and call your phone while you watch.
