DPDP Act and AI voice calls: recording, consent and retention.

Where the DPDP Act stands today.

The DPDP Act was enacted in August 2023. The government notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025 and set a phased commencement: the Rules on the Data Protection Board took effect on notification, the consent-manager framework (Rule 4) takes effect one year after notification, on 13 November 2026, and Rules 3 and 5 to 16 take effect eighteen months after notification, on 13 May 2027. Those later rules cover the notice, security safeguards, breach intimation, retention, children and data-principal rights that matter for call recording.

Two practical points follow. First, you have a window to design the call flow properly rather than patch it later. Second, nothing here is a reason to wait: the same recordings you make today will still exist on 13 May 2027, and the Act applies to personal data that is processed digitally, which includes audio and transcripts. If you want the term explained on its own, see the DPDP Act glossary entry.

Penalties are large. The Act's schedule sets a ceiling of up to ₹250 crore for failure to maintain reasonable security safeguards and up to ₹200 crore for failure to notify a breach or to meet the obligations around children's data. Those are maximums set by the Act, imposed by the Data Protection Board after an inquiry, not fixed tariffs.

Is recording an AI call legal in India?

Indian law has no single “two-party consent” statute of the kind some US states have. We found no general rule that requires every participant to consent before a business records its own call. Rules on intercepting a call by someone who is not a party sit in telecom law, historically the Indian Telegraph Act, 1885 and now the Telecommunications Act, 2023, and they are aimed at third-party interception, not at a business recording its own customer conversations.

The binding constraint on a business is therefore data protection. Once the Rules apply, the voice of the person you called, their phone number, what they say and the transcript are personal data. You need a lawful ground to process them, a notice, and a way to honour their rights. Banking, insurance and other regulated sectors can also have recording and retention expectations of their own, which this page does not cover. Read the call recording consent glossary entry for the short version.

What does DPDP ask of a business whose AI agent records calls?

The calling business, as Data Fiduciary, carries these duties:

• A lawful ground. Process on consent, or for a legitimate use the Act lists. One listed use covers data a person has voluntarily provided for a specified purpose and has not indicated they do not consent to. Using it for a cold outbound call is a stretch, because the person did not volunteer anything.
• A notice. Rule 3 says the notice must be understandable on its own, give an itemised description of the personal data and the specific purpose, link to the fiduciary's website or app, and describe how to withdraw consent (as easily as it was given), exercise rights and complain to the Board.
• Reasonable security safeguards. Rule 6 lists encryption or masking, access control, logs and monitoring, backups, a one-year log retention, and a contract with any processor that provides for safeguards.
• Breach intimation. Rule 7 requires telling each affected person without delay, telling the Board without delay, and sending the Board a detailed report within 72 hours.
• Erasure and retention. Erase when the purpose is served or consent is withdrawn, unless a law requires retention. Rule 8(3) separately sets a one-year minimum for certain data, traffic data and logs.
• Rights and grievance handling. Rule 14 requires publishing how people can exercise their rights and a grievance system that responds within a period not exceeding ninety days. Rule 9 requires publishing contact details for someone who can answer questions.
• Children. Verifiable parental consent for anyone under 18 (Rule 10).

Consent itself must be free, specific, informed and unambiguous, given by a clear affirmative action, and limited to the purposes in the notice. A notice that says “by continuing you agree” is the weakest design. Better to ask a yes or no question and log the answer.

What should the AI say at the start of the call?

An opening disclosure has to do four things in a few seconds: identify the caller, say it is an AI agent, say the call is recorded and transcribed and for what purpose, and give a way to object. The full Rule 3 notice is too long for audio, so send it as a link by SMS or WhatsApp and reference it on the call. Here are sample lines for your counsel to adapt. They are templates, not approved wording.

The Act lets a notice be given in English or any language in the Constitution's Eighth Schedule, so match the language of the call. Vaami lists Hindi, Hinglish, Tamil, Telugu, Kannada, Marathi, Bengali, Gujarati, Punjabi and Malayalam among its Indian languages; see the Hinglish voice agent page or the Hindi page for how those calls sound.

Retention and erasure: how long to keep recordings?

Decide retention per artefact, not per call. Audio is the most sensitive and the most expensive to protect. A transcript is easier to redact. A call log (number, time, outcome, consent flag) is what you need to prove you followed your own rules. Rule 6 and Rule 8(3) both point to one year for logs and traffic data, so many teams keep audio for a short period and the log for at least a year.

Vaami's privacy policy states that call recordings and transcripts are retained for 90 days by default, after which they are permanently deleted, and that account administrators can access them through the platform. Confirm the retention setting that applies to your deployment during onboarding, and remember that withdrawal of consent should trigger erasure of the data you hold on that person unless a law requires you to keep it.

Processors, cross-border transfers and Vaami's role.

In DPDP terms you, the calling business, are the Data Fiduciary. A voice AI platform that handles calls on your behalf is typically a Data Processor, and the Act keeps you accountable for what it does. You need a contract that binds the processor to reasonable security safeguards. Vaami's privacy policy says call audio and transcripts are processed on its infrastructure solely to deliver the service, that data is encrypted in transit and at rest, and that end-customer voice data is not used to train its AI models without your explicit consent. See the privacy policy and the security page for the current wording. Vaami makes no DPDP certification claim, and the duties above stay with you as the fiduciary.

Cross-border: the Act allows transfers outside India except to countries the government restricts by notification, and Rule 15 adds that a fiduciary must meet any requirements the government specifies by order. Ask any vendor where audio, transcripts and model inference are processed, record the answer, and re-check for government orders before launch. If you also call UK, EU or Gulf numbers, other regimes apply; the compliance hub points to each regional page.