Is AI Calling Legal in India? TRAI, DND, DPDP and Consent (2026)

Is AI calling legal in India? Yes. No Indian law bans a business from using an AI voice agent to call customers or answer their calls. What the law does regulate is commercial calling itself, automated calling, and the personal data that flows through every call. In 2026 those rules tightened, so here is what applies, where it comes from, and a checklist you can run before your next campaign.

Is AI calling legal in India?

AI calling is legal in India. There is no ban on AI voice agents. The legal question is not "AI or human?" but "what kind of call, to whom, with what permission, from which number, and what happens to the data?" Telecom rules from TRAI, data protection under the DPDP Act and sector rules from RBI and IRDAI all apply.

Think of it in layers. A call made by an AI agent must pass the same tests as a call made by a telecaller, plus a few that apply because it is automated. Here are the main ai calling rules India businesses deal with:

What is different about an automated call?

Two things. First, the 2026 TRAI amendment treats calls started by software without direct human dialling as A2P calls, which must be declared. Second, an AI agent can make thousands of calls an hour, so any mistake, such as a wrong list, a missing DND check or a bad calling window, is repeated at scale. Compliance has to be built into the system, not left to individual callers.

What about inbound AI calls?

When a customer calls you and an AI receptionist answers, the telecom spam rules largely fall away, because the customer started the call. Data protection still applies: the agent collects names, numbers and needs. Our after-hours front-desk agent for a North Karnataka real-estate developer is a good example of keeping it narrow. It never gives project details; it only takes the caller's name, interest and preferred call-back time, and promises a call from the project team.

What do TRAI's rules say about AI and automated calls?

TRAI's TCCCPR rules classify commercial calls as promotional, service or transactional, require them to come from registered senders and designated number series, and, since September 2026, require automated (A2P) calls to be declared in advance. Undeclared automated calls are treated as unsolicited commercial communication, which exposes the sender to complaints, flagging and disconnection.

Promotional, service and transactional calls

The consolidated TCCCPR text published by TRAI in May 2026 defines a transactional call as one triggered by a customer's own transaction, within thirty minutes of it, such as an OTP or a confirmation. Service calls give information about a product or service the customer has, such as delivery updates or warranty information. Promotional calls advertise or sell, and adding promotional content to a service call makes the whole call promotional. That last point catches many businesses: a delivery-confirmation AI call that adds "and we have a festive offer for you" has become a promotional call.

Automated calls must now be declared

On 18 September 2026, TRAI announced the Third Amendment to the TCCCPR. Per TRAI's press release, A2P calls are voice calls initiated by an application, software system or automated platform without direct human dialling, including autodialled, robocall and pre-recorded or artificial-voice calls. Senders must declare A2P use and the numbers they will use to their telecom provider in advance; A2P calls made without that declaration are treated as unsolicited commercial communication. A termination charge of up to 5 paise per minute applies, with designated commercial series and authorised calls exempt.

Even before this, the consolidated TCCCPR required senders to notify their originating access provider in advance about the use of auto-dialers or robo-calls. So on TRAI AI calls, the direction has been consistent: tell your telecom provider what you are doing, from which numbers. Our explainer on TRAI's 2026 anti-spam rules for automated calls covers dates, phasing and the detection rules in detail.

Which numbers can commercial calls come from?

TRAI's February 2025 amendment kept promotional calls on the 140 series, put service and transactional calls on the 1600 series, and restricted ordinary 10-digit numbers from being used for telemarketing. Banks, NBFCs, insurers, mutual funds and pension managers were given deadlines in early 2026 to move service and transactional calls to 1600 numbers.

How complaints and detection work now

Under the same February 2025 amendment, consumers can complain within seven days, and five complaints in ten days against a sender trigger action. A first violation bars outgoing services on all of the sender's telecom resources for 15 days; later violations mean disconnection across all operators for a year and blacklisting. In 2026, TRAI added AI/ML-based detection: operators flag numbers with a high probability of spam and share them, and three complaints in ten days plus an AI flag can trigger action.

How do DND rules affect business calls?

The DND (Do Not Disturb) framework lets every mobile user block promotional calls by category, time band and day, through 1909, operator apps or TRAI's DND app. DND rules for business calls mean you should not make promotional calls to people who have blocked them unless you hold verifiable consent, and you should follow up inquiries within seven days.

What customers can block

Under the TCCCPR, customers can set preferences for categories, time bands and types of days, including public holidays. TRAI's 2026 amendment introduces a BLOCK PROMO option: Upstox reports that texting BLOCK PROMO to 1909 blocks promotional communication but not transactional, service or government calls, and that "fully blocked" preferences move to BLOCK PROMO.

The seven-day inquiry rule

The 2026 amendment allows commercial follow-up for seven days from a customer's inquiry, provided the inquiry was written or digital and the sender keeps it in verifiable form. For AI calling this is the most practical rule of all. A Facebook lead form, website enquiry or WhatsApp message is your record. Call within minutes, not weeks. Our platform checks Google Sheets for new rows every two minutes and picks up Facebook and Instagram lead ads as they arrive, which keeps you well inside that window.

Consent, opt-outs and the 90-day rule

Consent is your basis for calling someone beyond that window. TRAI's 2026 amendment says legacy consents count only if obtained through verifiable means and registered on the operator's digital platform. If a customer opts out, the February 2025 amendment bars the sender from seeking consent again for 90 days. Build opt-outs into the agent: when someone says "don't call me again", the call should end politely and the number should be suppressed.

Calling hours

The TCCCPR lets customers choose the time bands in which they accept promotional communication. Separately, RBI sets hard limits for recovery calls (covered below). Our view: run every campaign inside a defined calling-hour window, with no early-morning or late-night calls, whatever the category. Our platform enforces calling-hour windows and DND checks before dialling, and only dials Indian (+91) numbers when a campaign is set that way.

What does the DPDP Act mean for AI calls?

The Digital Personal Data Protection Act, 2023 governs the personal data in your calls: names, numbers, recordings and transcripts. You need a lawful basis (usually consent, or data the person gave you for a purpose), a clear notice, reasonable security, and erasure once the purpose is served. The main obligations apply from 13 May 2027.

Consent and notice

The DPDP Act, 2023 requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and withdrawable as easily as it was given (Section 6). Every consent request must be accompanied or preceded by a notice (Section 5). For dpdp act consent calls, that means the lead form or opt-in that leads to your AI call should say plainly that you will call, why, and how to stop it.

Section 7(a) also allows processing for the specified purpose for which a person voluntarily provided their data, unless they have said they don't consent. Someone who fills in a form asking for a call-back about a plot has given you their number for that purpose; it is not permission to call them about an unrelated product.

When do the obligations apply?

The DPDP Rules, 2025 were notified on 13 November 2025. According to SCC Online's summary, the provisions on the Data Protection Board applied immediately, the consent manager rule (Rule 4) applies from 13 November 2026, and Rules 3, 5 to 16, 22 and 23, covering notice, security, breach reporting, retention and more, apply from 13 May 2027. A Mondaq article of 14 August 2026 reports this schedule as unchanged.

Security, breaches, retention and erasure

The 72-hour and one-year points are from the summaries by SCC Online and Cyril Amarchand Mangaldas. Penalties under the Act's schedule go up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach, and up to ₹50 crore for other breaches of the Act.

A real example of security in practice: when we connected a D2C health and wellness brand's lead sheet (about 1,500 rows at the time), the sheet was shared privately with our service account as an Editor, never made public. Only Indian (+91) numbers were called, and numbers typed with a "+" but no country code were flagged for review rather than guessed. That last habit matters for data accuracy as much as for compliance.

Is TRAI consent the same as DPDP consent?

No. IndiaLaw's analysis of the 2026 amendment points out that consent under TRAI's framework covers calls and SMS and is separate from consent under the DPDP Act. In practice, design one clear opt-in that satisfies both: what you will contact people about, by which channels, and how to stop.

Do you need consent to record AI calls?

Recording is processing personal data, so the DPDP Act's notice and purpose principles apply as its obligations come into force. IRDAI's telemarketing guidelines require insurance tele-callers to tell customers the call is recorded. The safe practice for every business is to say so in the opening line and keep recordings only as long as needed.

What the agent should say

We are not aware of a single Indian statute that sets one recording-disclosure script for all businesses, so we recommend the simplest approach: disclose it. An example opening, in Hinglish, for a hypothetical real-estate enquiry (fill in the brackets): "Namaste [name] ji, main [project name] ki taraf se bol rahi hoon. Aapne hamare plot ke baare mein enquiry ki thi. Yeh call quality ke liye record ho rahi hai. Kya abhi do minute baat kar sakte hain?" Short, honest, and it asks permission to continue.

Two lessons from our own calls apply here. Get the opening language right before go-live: a wrong default-language setting once made one of our agents go silent at the start until we fixed it. And use the person's name with "ji" or "avare" rather than guessing "Sir" or "Madam".

Should the agent say it is AI?

We did not find an Indian rule that specifically requires an AI voice agent to announce itself as AI on every call. Our recommendation is that the agent never claims to be human and answers honestly if asked. People who feel deceived complain, and under TRAI's 2026 rules, complaints plus an AI flag can lead to action against your numbers.

How long should you keep recordings?

Keep them for a defined purpose, such as quality review, dispute resolution or training, then delete them. Don't keep everything forever "just in case"; the DPDP Act requires erasure once the purpose is served unless the law requires retention. Our platform stores recordings, transcripts and summaries, and lets teams watch live calls on the live monitor, which is useful for spot checks during a new campaign. For a step-by-step version, see our DPDP Act call recording checklist.

What sector rules apply to lending, collections and insurance?

Regulated sectors carry extra rules. RBI prohibits recovery calls before 8 a.m. or after 7 p.m. and bans intimidation or harassment. Banks, NBFCs and insurers must make service and transactional calls from 1600-series numbers. IRDAI's telemarketing guidelines set conduct and disclosure rules for insurance calls. Automation does not change any of these.

Lending and collections (RBI)

RBI's circular of 12 August 2022 on recovery agents lists calling a borrower before 8:00 a.m. and after 7:00 p.m. for recovery of overdue loans as a prohibited practice, along with persistent calling, and requires that regulated entities and their agents do not resort to intimidation or harassment of any kind. It applies to commercial banks (excluding payments banks), cooperative banks, NBFCs including housing finance companies, all-India financial institutions and asset reconstruction companies. An AI agent making EMI reminder or collection calls for these entities must follow the same rules: tight calling windows, sensible retry limits and a respectful tone. See our pages on AI calling for banking and collections.

1600 numbers for financial services

TRAI set early-2026 deadlines for financial entities to move service and transactional calls to the 1600 series: 1 January 2026 for commercial banks, 1 February for large NBFCs, payments banks and small finance banks, and 1 March for remaining NBFCs, cooperative banks and regional rural banks, as reported by Storyboard18. For IRDAI-regulated entities, the deadline was 15 February 2026, under a TRAI direction of 16 December 2025 reported by PTI.

Insurance (IRDAI)

IRDAI's telemarketing and distance-marketing guidelines, as reported by TaxGuru, require tele-callers to tell clients that the call is being recorded and that they are entitled to a voice copy, and say calling hours follow TRAI and DoT orders. Check IRDAI's current master circulars for the latest version before launching; insurers should also review our page on AI calling for insurance.

What happens if you break the rules?

Penalties hit three places: your telecom resources, your data-protection exposure and your sector licence. TRAI's rules allow barring and disconnecting every number you hold and blacklisting you for a year; the DPDP Act allows penalties of up to ₹250 crore; and RBI and IRDAI supervise their regulated entities directly.

Citizens are also reporting more. The Department of Telecommunications runs the Chakshu facility on Sanchar Saathi for reporting suspected fraud communication. In a Rajya Sabha reply on 5 February 2026, the government said citizens reported 5,19,662 suspected fraud communications through Chakshu in 2025, as reported by Angel One. A legitimate business that calls people who asked to hear from it has little to fear, but a careless campaign can look like fraud to the person receiving it.

AI calling compliance checklist

Before launching any AI calling campaign, confirm what type of call it is, where the number came from, that consent or an inquiry record exists, that DND and calling-hour checks run, that automated calling is declared, that the opening line discloses who is calling and the recording, and that data is secured and deleted on schedule.

1. Classify the campaign. Promotional, service or transactional? Keep offers out of service calls.
2. Trace every lead. Store the form, ad lead or message, with a timestamp, for each number.
3. Check the window. Inquiry leads within seven days; otherwise only with verifiable consent.
4. Run DND and opt-out suppression before every dial, not once a month.
5. Declare automated calling and the numbers used to your telecom provider, in writing, and keep the confirmation.
6. Use the right numbers. 140 for promotion, 1600 for regulated service calls, no ordinary 10-digit numbers for telemarketing.
7. Set calling hours per campaign; for loan recovery, never before 8 a.m. or after 7 p.m.
8. Write a compliant opening line: who is calling, why, that the call is recorded, and a question asking if it's a good time.
9. Handle "stop" properly. The agent ends politely, says goodbye and suppresses the number.
10. Secure and expire data. Private sheets, access-controlled recordings, a written retention period.

Common mistakes that create legal risk

Most compliance trouble with AI calling comes from ordinary shortcuts, not exotic legal gaps: calling old or bought lists, mixing offers into service calls, using ordinary mobile numbers for promotion, skipping the A2P declaration, and keeping data forever. Each is easy to fix before launch and expensive after.

• Calling bought or scraped lists. No inquiry record, no verifiable consent, high complaint risk.
• "It's just a reminder" with an offer attached. That makes the whole call promotional.
• Assuming a human-sounding agent isn't automated. The A2P definition turns on how the call is started, not how it sounds.
• Hanging up abruptly. It feels rude and invites complaints. Our platform now holds the hang-up until the goodbye has finished playing.
• Mixing facts across projects. In an early set-up, one of our agents loaded facts from several projects and mixed up prices and locations. Giving wrong information is a consumer-protection problem as well as a sales one. We now give each project its own agent with its own locked facts.

This guide is general information, not legal advice. Rules change, so check the official texts and take advice from a qualified lawyer for your business. Is AI calling legal in India? Yes, when you call people who asked to hear from you, from declared numbers, with honest disclosure and careful data handling. For the bigger picture, start with our complete guide to AI calling in India, and if you'd like to see a compliant set-up on your own leads, book a 20-minute demo and we'll call your phone with an agent set up for your business.

Written by the DigitalCallers Team

We build and run AI calling agents for Indian businesses from Gurugram, in Hindi, English and regional languages. Our articles draw on calls we have run ourselves and link to primary sources such as TRAI, DoT and MeitY for anything regulatory. Spotted something out of date? Write to support@digitalcallers.com.