AI calling compliance: India, UK, US and UAE.
AI voice calls follow the same telecom and data-protection rules as human calls, plus a few that target automated calling. In India that means TRAI's DND and DLT framework, a September 2026 declaration for A2P calls, and the DPDP Act. This hub links each guide and states plainly which compliance claims VAAMI does and does not make.
Last reviewed 1 October 2026. General information, not legal advice.
Three guides for calling Indian numbers.
Each guide answers a different question. Read the DND guide first to classify your calls, the DLT guide to register, and the DPDP guide to design recording and retention.
DPDP Act and AI voice calls
Notice, consent, retention and breach duties when an AI agent records or transcribes a call. Includes sample disclosure lines in English, Hindi and Hinglish.
DND registry and AI calling
Preference categories, promotional versus service calls, time bands, the 2026 A2P declaration and a scrubbing workflow.
TRAI and DLT for AI calling agents
Entity, header and template registration, and who does what between you and Vaami.
Short definitions live in the glossary: DND registry, DLT registration, DPDP Act, TCCCPR, call recording consent and the 140, 160 and 1600 number series.
What changed in India in 2025 and 2026?
Two sets of rules moved. On the telecom side, TRAI amended the TCCCPR in February 2025, requiring commercial communication to use registered headers or special number series, tightening the definitions of promotional, service and transactional calls, and requiring senders to notify their operator in advance about autodialler or robo-call use. On 18 September 2026 it issued a third amendment that defines Application-to-Person calls, includes artificial-voice calls in that definition, requires advance declaration of A2P use and calling-line ranges, and introduces operator-side AI/ML spam detection. The first parts take effect thirty days after gazette publication, and others at sixty and ninety days.
On the data side, the government notified the DPDP Rules on 13 November 2025. The consent-manager framework applies from 13 November 2026, and the notice, security, breach, retention and rights rules apply from 13 May 2027. Because TRAI's amended text says nothing in the telecom rules exempts a sender from DPDP obligations, a compliant outbound programme has to satisfy both. The guides above work through each.
For a business, the practical order is to decide the call class and consent basis, set up registration and declaration, and then design the opening disclosure and retention settings. If you want to see these steps inside a call flow rather than on paper, the outbound calling product and India AI calling agent page show how campaigns are run, and pricing lists the plans.
Where compliance is covered for other regions.
Each regional page has its own compliance section. These one-line summaries describe what the page covers, not a legal opinion on your campaign.
| Market | What the page covers |
|---|---|
| United Kingdom | UK GDPR and ICO alignment, a data processing agreement as standard, and FCA-aware scripting for financial services. |
| United States | HIPAA-ready architecture with a signed BAA on enterprise healthcare plans, and TCPA-aware outbound tooling: consent management, Do Not Call checking and opt-out handling. |
| US debt collection | Regulation F call-frequency limits, FDCPA calling hours and TCPA consent for autodialled and prerecorded calls. |
| United Arab Emirates | Arabic and English voice agents, with a compliance section covering UAE Federal Decree-Law 45 of 2021, DIFC, ADGM and TDRA. |
| Dubai | TDRA approval for outbound campaigns, Do Not Call screening, permitted hours, and recording disclosure. |
| Saudi Arabia | Najdi and Hejazi Arabic agents, Saudi PDPL alignment, the CST anti-spam regulation and SAMA awareness. |
| Canada | PIPEDA and Quebec Law 25, CASL and National Do Not Call List checking. |
| Australia | Privacy Act 1988 and Australian Privacy Principles, the Do Not Call Register and the Spam Act 2003. |
What compliance claims does VAAMI make, and not make?
| Area | Status | Detail |
|---|---|---|
| GDPR and UK GDPR | Verified | Vaami states it is compliant with GDPR and UK GDPR. |
| SOC 2 Type II | In progress | Not yet certified. We do not call Vaami SOC 2 certified. |
| HIPAA | HIPAA-ready architecture | A signed Business Associate Agreement is available on enterprise healthcare plans. |
| TRAI and DLT (India) | Supported, per customer | Vaami supports TRAI/DLT-registered sender IDs and template scrubbing for outbound campaigns to Indian numbers. DLT registration is completed per customer as part of onboarding. |
| DPDP Act (India) | No certification claimed | Vaami typically acts as a processor for the calling business, which stays the Data Fiduciary. See the DPDP guide for what the business must do. |
| Legal advice | Not provided | Vaami is a technology vendor. Classifying your campaigns and your consent basis is your counsel's decision. |
For encryption, access control and data-handling detail, see the security page and the privacy policy.
Common questions on AI calling compliance.
Is AI calling legal in India?
Yes, but it is regulated like any other commercial calling. TRAI's TCCCPR governs who may be called and in what category, its September 2026 amendment adds an advance declaration for automated (A2P) calls, and the DPDP Act governs the personal data in the call once its core Rules apply from 13 May 2027. Each guide in the India section explains one layer.
Which compliance claims does VAAMI make?
Vaami states that it is compliant with GDPR and UK GDPR, that SOC 2 Type II is in progress and not yet certified, that its architecture is HIPAA-ready with a signed BAA available on enterprise healthcare plans, and that it supports TRAI/DLT-registered sender IDs and template scrubbing, with DLT registration completed per customer. It makes no claim to give legal advice.
Does VAAMI register my business for DLT or DND?
No. DLT registration belongs to the calling business as the Principal Entity. Vaami's team helps with the process during onboarding and supports registered sender IDs and template scrubbing once it is done.
Do the same rules apply to AI agents as to human callers?
Generally the same call rules apply, and some regulators add rules because the caller is automated: TRAI's 2026 amendment defines A2P calls to include robo-calls and artificial voice, and US rules on autodialled and prerecorded calls apply to artificial-voice calls. Check the regional guide for the market you call.
How current is this information?
The India guides were last reviewed on 1 October 2026 against TRAI's September 2026 regulation, the DPDP Rules notified in November 2025 and the DPDP Act. The regional pages describe each market's framework at a summary level. Rules change, so confirm against the primary source before you launch a campaign.
Where do I start if I am launching AI outbound calls in India?
Start with the DND and AI calling guide to classify your calls and plan scrubbing, then the TRAI and DLT guide for registration, then the DPDP guide to design the recording disclosure and retention. Then book a demo and bring one use case.
Sources
- TRAI: TCCCPR Third Amendment Regulations, 2026 (18 Sept 2026) (2026)
- TRAI: Press release on the Third Amendment (18 Sept 2026) (2026)
- MeitY / Gazette of India: Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) (2025)
- PIB: Government notifies DPDP Rules to empower citizens and protect privacy (2025)
- PRS Legislative Research: Digital Personal Data Protection Bill, 2023 (2023)
Last reviewed 1 October 2026. Vaami is a technology vendor, not a law firm. Nothing on this site is legal advice; confirm requirements with qualified counsel before launching a campaign.
Bring one campaign and we will map it.
In a demo we walk through registration, scrubbing, disclosure lines and retention for your use case.