How long to keep call recordings in India: every rule in one place

How long do you have to keep call recordings in India?

It depends on who you are and why the call was made. We found no general Indian law that fixes one period for all call recordings. Each sector regulator sets its own period for the calls it oversees, and the periods differ widely, from six months for a lender's recovery calls to five years for a research analyst's client calls.

The differences make more sense once you see what each period is for. A recording is evidence, and most regulators tie its period to how long a complaint or dispute about the call can still arise. SEBI links brokers' records to the window in which investors can take a complaint to arbitration, and IRDAI links insurance sales records to the life of the policy and any claim. That is our reading of the pattern, not a principle any regulator states.

From 13 May 2027 the DPDP Rules also add a one-year floor for every Data Fiduciary. A Data Fiduciary is any business that decides why and how personal data is used, so in practice this reaches almost every business that records customer calls. The same law pulls the other way too: the DPDP Act requires erasure once no law or purpose still needs the data, so keeping everything indefinitely is not a safe default.

The working rule follows from that. Where two rules cover the same recording, keep it for the longer period, then delete it. The table lists every rule we found that touches call recordings, and the sections after it explain the ones that need judgement. Whether you may record a call in the first place is a separate question, covered in whether call recording is legal in India.

SEBI's rules for brokers and research analysts

The Securities and Exchange Board of India (SEBI) has the two most detailed recording rules, and they work differently. A stockbroker's period moves with the arbitration window, while a research analyst's period is fixed at five years. The guide to SEBI's call-recording rules for brokers covers the wider framework those rules sit in.

RBI and IRDAI: recovery calls, video KYC and insurance sales

The Reserve Bank of India (RBI) and the Insurance Regulatory and Development Authority of India (IRDAI) each regulate a few specific kinds of call. Outside those, neither sets a period for ordinary service or sales calls, as far as we found.

When the DPDP Act says erase and a regulator says keep

The rules in the table sometimes point in different directions. When the DPDP Act says erase and a regulator says keep, the regulator wins for as long as its period runs. The DPDP Act requires erasure when consent is withdrawn or the purpose is served, except where "retention is necessary for compliance with any law for the time being in force" (section 8(7)).

So a customer can ask for a recording to be deleted, but a business does not always have to agree at once. A customer who withdraws consent cannot force a broker to delete a disputed phone-order recording, and the broker deletes it once the SEBI period and the dispute have both ended. Disputes extend periods in the same way elsewhere: RBI recovery recordings stay until a court case is disposed of, and SEBI can ask for specific records to be kept until further notice.

The harder question runs the other way, and it is about the one-year floor. From 13 May 2027 every Data Fiduciary must keep "such personal data, associated traffic data and other logs of the processing for a minimum period of one year" (DPDP Rules, rule 8(3)). That is longer than RBI's six months for recovery calls.

Rule 8(3) is written for access by the government and the other purposes listed in the Rules' Seventh Schedule. It does not mention call recordings, so it is unclear whether the audio itself, or only the data about the call, must be kept for a year. The guide to what the DPDP Act means for voice AI covers the rest of the Rules.

For ordinary service and sales calls, this is most of the law. Unless a sector rule covers them, such as IRDAI's for insurance telesales, the DPDP Act's erasure duty and, from 13 May 2027, its one-year floor are the main rules to plan around. Logs are also covered separately. CERT-In's 2022 directions require logs of all ICT (information and communication technology) systems, such as a telephony platform's server logs, to be kept for a rolling 180 days within Indian jurisdiction (CERT-In directions, direction (iv)). CERT-In's FAQ lets them sit abroad if they can be produced in reasonable time.

Keeping recordings in a form a court will accept

Knowing how long to keep a recording is half the job. The other half is keeping it so it cannot be changed without a trace and can be found quickly. IRDAI is the most specific: records must be kept "in an inalterable and easily retrievable form", and voice records "shall be digitized and encrypted" (2011 guidelines, para 12). RBI's video KYC rule asks for a date and time stamp that allows easy search (para 27(3)(i)).

Court use adds its own demands. To use a recording in court you need a certificate under section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023 (BSA), which replaced the certificate under section 65B of the Evidence Act from 1 July 2024. The certificate format is in the Act's Schedule. Part A is filled in by the party producing the record, such as the person in charge of the system, and Part B by an expert, and both parts must state the file's hash value.

A hash is a short code computed from the file, such as a SHA-256 value, which changes if even one byte of the file changes. If you record the hash when the call ends, you can later show the file has not been altered. In practice that means:

• Store the original file, not only a compressed or transcribed copy.
• Compute and store a hash (for example SHA-256) when the call ends.
• Keep the call's metadata with it: numbers, time stamps in IST, campaign, agent or bot version.
• Log every access, export and deletion.
• Know who in your organisation will fill in Part A, and which expert will sign Part B.

Recordings held by vendors

If a call centre or platform records calls for you, the files may never sit on your own systems, but the business that owns the customer relationship stays responsible for them. A Data Processor is a vendor that handles personal data on a business's behalf, such as a call centre or a voice-AI platform. Under the DPDP Act, the Data Fiduciary stays responsible for what its processors do, "irrespective of any agreement to the contrary" (section 8(1)).

RBI took the same line for recovery agents: the ultimate responsibility for outsourced activities "vests with" the lender (circular of 12 August 2022). That circular was withdrawn on 28 November 2025, when RBI moved its recovery rules into the 2025 Responsible Business Conduct Directions.

The rules also say where the files should end up. IRDAI's 2011 guidelines require an insurer's contract with a telemarketer to make it keep recordings until they reach the insurer (para 5(i)). Recordings of calls that end in a sale must reach the insurer within 30 days of the sale (para 10(vii)). For video KYC run on a cloud model, RBI requires all data, including the video, to move to servers the bank exclusively owns or leases right after the session, with the provider keeping no data (para 27(1)(i)).

These duties belong in the vendor contract. The DPDP Rules give an example: a fiduciary must make sure its cloud processor also keeps the data and logs for at least a year (rule 8(3), Case 2). The fiduciary must also make its processor erase data when the fiduciary has to (section 8(7)(b)). AI voice agent platforms, Sonex among them, keep call recordings and transcripts for their customers, so the same terms apply to both files, and the vendor questionnaire has questions to put to any provider. A good contract covers four points:

• Name who stores each recording, where, and for how long.
• Require the vendor to hand over or delete recordings on your instruction, with written confirmation.
• Check data location: V-CIP recordings must be in India; CERT-In's FAQ (Q35) lets logs sit abroad if they can be produced to CERT-In in reasonable time.
• Get access to recordings and hashes for disputes, audits and court certificates.

Turning the rules into a retention policy

A workable policy starts from call types rather than from regulators. List every kind of call you record, such as recovery, sales, service, video KYC and broking, and note the regulator and rule from the table that covers each. Then give each type one period, the longest that applies: six months for recovery calls, for example, and at least three years for broker phone orders.

Two controls make the periods real. A legal hold pauses deletion for accounts in dispute, open complaints and court cases, and is lifted only when the matter closes. Deletion then runs on schedule, including copies your vendors hold, with a log of what was deleted and when, so you can later show the rule was followed. Telling callers in the opening line that the call is recorded, and why, completes the picture; for insurance sales calls that line should also offer a voice copy.

Key dates