The DPDP Act and AI Voice Calls: A Practical Guide, Not a Legal Opinion

The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025, operationalising the DPDP Act, 2023. The Rules run on an 18-month phased compliance window — full compliance is required by 13 May 2027, rolled out in three phases. If you run automated outbound or inbound calling in India, that clock is already running.

This is a practical summary, not legal advice — talk to counsel before you rely on it for a compliance decision.

The core requirement is free, informed, explicit consent before you process someone’s personal data — a phone call carrying voice, and often name and transaction details, counts. The Rules are specific about how that consent has to be asked for: a standalone, clear, plain-language notice describing exactly what data is collected and exactly why, not a clause buried in a longer terms document.

For a voice call specifically, that translates into two things most automated calling setups skip: the call has to disclose that it’s automated, and it has to disclose that it’s recorded, before either becomes relevant to the conversation.

Under the Act, whoever decides who gets called and why is the data fiduciary. Whoever carries out that instruction and keeps the record — the calling platform — is the data processor. The obligations differ, and a lot of the confusion in this space comes from vendors being vague about which one they are.

A data processing agreement should make this explicit in writing. If a vendor can’t produce one before you sign, that’s worth treating as a signal, not a formality to chase down later.

• The agent identifies itself as automated at the start of every call.
• The agent discloses that the call is recorded, also at the start.
• A caller who asks for a person gets transferred — this isn’t optional under a genuine disclosure obligation.
• You have do-not-call suppression and permitted calling windows enforced at the platform level, not left to individual agents to remember.
• You know where the recordings and transcripts are actually stored, and you have a deletion path that works within your contracted retention period.

We built to this checklist, not around it — disclosure on every call isn’t configurable off, and data sits in Mumbai (AWS ap-south-1) by default. The full breakdown of roles, retention, and what we are and aren’t certified for is on Security & trust, and the complete legal language is on DPDP & call data handling.