What is DPDP Act (India)?
The Digital Personal Data Protection Act, 2023 is India's data-protection law. Its Rules were notified in November 2025 and apply in phases, so businesses recording or analysing calls need notice, consent and safeguards.
Also known as: Digital Personal Data Protection Act, 2023, DPDPA, DPDP Rules 2025
What it requires
The Act governs processing of digital personal data. Core ideas are a clear notice telling people what is collected and why, consent for stated purposes, the ability to withdraw consent, reasonable security safeguards, and breach reporting. A call recording that identifies a person is personal data, as is a transcript.
Timeline as of October 2026
The DPDP Rules, 2025 were notified on 13 November 2025 with phased commencement: the Data Protection Board provisions came first, the consent manager framework follows about a year after notification, and the main obligations on data fiduciaries apply about 18 months after, in May 2027. Dates are set in the notification, so check it before planning around a specific one.
Common mistake
Waiting for the final deadline to start. Retrofitting consent into a running call flow, such as adding a disclosure at the start of calls and a retention schedule for recordings, takes testing. Treat the phase-in as the period to design it properly.
Primary sources
Regulations change. Check the current text before relying on a detail. This page is general information, not legal advice.
Where this shows up at Vaami
Vaami's compliance content on recording and consent is covered on its DPDP and call-recording page; verified frameworks listed in its facts are GDPR and UK GDPR.
See it on a real call.
Hear how a Vaami voice agent handles this on a live conversation in your language and your use case.