DPDP Rules 2025 and call recordings: what applies, and from when

How the DPDP Act and Rules are coming into force

Parliament passed the DPDP Act in August 2023, but it does not run on its own: it needs rules and a regulator, and the Rules bring its duties in over eighteen months. The DPDP Rules were published in the Gazette on 13 November 2025 (G.S.R. 846(E)). On that day only the definitions and the rules for setting up the Data Protection Board, the regulator that enforces the Act, took effect (rule 1(2)).

The duties that bind a business recording customer calls start eighteen months after publication, on 13 May 2027 (rule 1(4)). Until then, the Information Technology (IT) Act's rules on sensitive personal data still apply, including compensation under section 43A for failing to protect such data. Sector rules, such as RBI's and SEBI's recording requirements, apply on their own dates.

The Act's own sections follow the same pattern (G.S.R. 843(E), 13 November 2025). The sections on the Data Protection Board started on publication, and the consent-manager section, 6(9), starts after one year. The duties in sections 3 to 17 and most of the sections on the Board's powers, appeals and penalties (27 to 34) start after eighteen months. So does section 44(2), which deletes section 43A from the IT Act. Rule 1 of the Rules sets three start dates, and the table at the end of this section shows what each means for a business that records calls or runs a voice agent.

When a call recording counts as personal data

Once the duties start, the first question is whether they reach your recordings at all. A call recording is personal data under the DPDP Act if it can be linked to a person. A recorded call with a customer's voice, phone number or account details is digital personal data, and so is its transcript. The Act does not cover data a person keeps for purely personal or domestic purposes (section 3(c)(i)), but a business recording customer calls is not in that category. Whether recording is allowed at all is a separate question, answered in whether call recording is legal in India.

The Act calls the business that decides why and how calls are processed the Data Fiduciary, and it stays responsible for processing done on its behalf (section 8(1)). A voice-AI provider running calls for a bank would ordinarily be a Data Processor, a vendor that processes data for the fiduciary. A fiduciary may engage a processor only under a valid contract (section 8(2)).

The fiduciary also needs a lawful ground to record. The main one is consent, which must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and limited to the data needed for the stated purpose (section 6(1)). Section 7 also allows some "legitimate uses" without consent. Examples are data the customer gave voluntarily for a stated purpose and has not objected to (section 7(a)), and uses a law requires.

No text or ruling yet says whether recording an inbound service call can rest on section 7(a), or needs consent. A customer who rings a helpline has arguably volunteered their call for the purpose of getting help, but the Act does not say so, and an outbound sales call is harder to fit. Many businesses will give a notice and ask for consent anyway, which makes the notice the next thing to get right.

What a DPDP notice must say on a voice call or IVR

From 13 May 2027, every request for consent must come with, or after, a notice (section 5(1)). Rule 3 says what the notice must contain, and it is far more than a spoken line such as "this call may be recorded". The person must also be able to read or hear the notice in English or any of the 22 languages in the Eighth Schedule of the Constitution (section 5(3)).

On a call or IVR (automated phone menu), a common approach is a short spoken notice in the caller's language, followed by a link to the full written notice by SMS or WhatsApp. A line such as "This call is recorded for quality and to resolve disputes. We will send you a link with the full details and your choices" fits that pattern, and the recording-notice and AI disclosure scripts have versions in several languages. That approach is industry practice; the Rules do not spell it out.

Withdrawal has to be as easy as consent was. If consent was a key-press or a spoken "yes", withdrawing it should take no more effort, which rules out a notice that only offers withdrawal by post or email. Under rule 3, the full notice must cover:

• Stand-alone: it makes sense without the customer looking up other documents (rule 3(a)).
• Plain language: a fair account in clear words, enough for specific and informed consent (rule 3(b)).
• An itemised list of the data: for example voice recording, transcript, phone number, account or policy number (rule 3(b)(i)).
• The specific purpose and service: for example quality checks, dispute resolution, a regulator's recording rule or training a model (rule 3(b)(ii)).
• A link to your website or app, plus any other way to act (rule 3(c)).
• How to withdraw consent, as easily as it was given (rule 3(c)(i)). If consent was a key-press or a spoken "yes", withdrawal should be just as easy.
• How to exercise rights such as access, correction and erasure, and how to complain to the Data Protection Board (rule 3(c)(ii) and (iii)).

Security, breach reporting and how long to keep recordings

After the notice, the Rules turn to what happens to the recording while it is held.

When a child is on the call

The children's duties carry one of the higher fines, and a voice call makes them awkward to meet. Under the DPDP Act a child is anyone under 18 (section 2(f)). From 13 May 2027, a business must get verifiable consent from a parent before processing any of a child's personal data (section 9(1)). It must not track or behaviourally monitor children, or target advertising at them (section 9(3)).

Rule 10 explains how to check the parent. The business must confirm that the person giving consent is an identifiable adult. It can use identity and age details it already holds, details the person provides, or a virtual token from an authorised entity such as a DigiLocker service. A voice agent cannot verify a parent's age from their voice alone, so the check usually has to happen outside the call.

There are narrow exemptions in the Fourth Schedule. Clinical establishments (such as hospitals and clinics), mental health establishments and healthcare professionals are exempt from sections 9(1) and 9(3) in one case: processing a child's data only to provide health services, as far as needed to protect the child's health. The duty not to harm a child's well-being (section 9(2)) has no exemption. The guide to AI receptionists for Indian clinics and hospitals covers how this plays out at a front desk.

Penalties under the DPDP Act

Each of those duties carries its own maximum fine. The Data Protection Board can impose fines of up to ₹250 crore per breach, set out in the Schedule to the Act, and the penalty sections start on 13 May 2027.

The maximum is a ceiling, not a tariff. The Board decides the amount after an inquiry. It weighs the nature, gravity and duration of the breach, the type of data and whether the breach was repeated. It also weighs any gain made and what the business did to limit the damage (section 33(2)). The maximum fines are:

• Failing to take reasonable security safeguards (section 8(5)): ₹250 crore.
• Failing to tell the Board or affected people about a breach (section 8(6)): ₹200 crore.
• Breaking the extra duties for children (section 9): ₹200 crore.
• Breaking the extra duties of a Significant Data Fiduciary (section 10), a business the government designates because of the volume and sensitivity of the data it handles or similar risks: ₹150 crore.
• Breaking a voluntary undertaking accepted by the Board (section 32): up to the penalty for the original breach.
• Any other breach of the Act or Rules: ₹50 crore.
• A person breaking their own duties under section 15, such as filing a false complaint: ₹10,000.

Getting ready before 13 May 2027

The eighteen months are a planning window, and most of the work is mapping before writing. A business should know every place call recordings and transcripts are stored, which vendors touch them and who can access them, and whether each system holds audio, transcripts or only call metadata. Each call type then needs a lawful ground, consent or a section 7 legitimate use, with the reasoning written down, and a plan for verifiable parental consent outside the call where children may ring and no exemption applies.

The remaining pieces follow the order of a call. The rule 3 notice is written and translated, and the spoken line and SMS link are scripted. Recordings are encrypted, access is limited and logged for a year, and every vendor contract covers security, retention and erasure. Each call type gets a retention period checked against sector rules and rule 8(3), and the breach plan names who decides that a breach has happened, who tells customers, and how the 72-hour report reaches the Board.

Voice AI makes the vendor layer thicker, because one call can pass through telephony, speech recognition, a language model and storage. AI voice agent platforms, Sonex among them, keep both a call recording and a transcript, so both belong in the data map and the processor contract.

Key dates