DPDP Act and AI calling, in plain words.
What changes for your calls, and from when.

The short answer

• The Act covers AI calls. A phone number, a name, a voice recording and a transcript are all data about a person who can be identified. On an AI call they're digital, so they fall under the Act.
• The business running the calls is the data fiduciary. It decides who gets called, why, and what's kept. Kallix processes the call data on that business's instructions, as its data processor.
• Every call and recording needs a lawful basis. For most campaigns that's consent, given after a clear notice. People can withdraw it, and withdrawing has to be as easy as agreeing was.
• Collect only what the purpose needs, protect it, and delete it when the purpose is over. If there's a breach, tell the Data Protection Board and the people affected.
• The dates. The Rules were notified on 13 Nov 2025. Consent managers can register from about 13 Nov 2026. Notice, consent, security, breach reporting, people's rights and erasure apply from 13 May 2027.
• TRAI is a separate set of rules. DND checks, number series and the A2P declaration come from TRAI, and they apply already. TRAI rules for AI calls →

What personal data an AI call handles

The Act calls any data about an individual who can be identified by it, or in relation to it, personal data (section 2(t)). It applies to personal data held in digital form, including data first collected on paper and digitised later (section 3). On an AI call, that reaches well past the phone number.

Two points that are easy to miss:

• Outcomes are personal data too. A note that says a named borrower will pay on Friday is data about that borrower.
• The Act has no separate "sensitive" class. A voice recording gets the same protection as other personal data under the Act. Your sector regulator may set stricter rules for health or financial details, so check yours.

Data fiduciary and data processor: who does what

The Act gives the two sides of an AI calling campaign different roles.

• Data fiduciary. The person or company that settles the purpose and the means of processing personal data, alone or together with others (section 2(i)). In an AI calling campaign, that's your business: you choose who gets called, the reason, what the agent says and asks, and what you keep afterwards.
• Data processor. Anyone who processes personal data on a fiduciary's behalf (section 2(k)). For the call data in your workspace, that's Kallix. We place and answer the calls and store the results on your instructions.

What the split means in practice:

• You stay responsible. A fiduciary answers for processing done on its behalf, whatever a contract says (section 8(1)).
• A processor works under a contract. You may use one only under a valid contract (section 8(2)), and the Rules expect that contract to cover security safeguards (rule 6(1)(f)).
• Deletion flows down. When a person withdraws consent, or the purpose is over, you erase the data and have your processor erase it too (sections 6(6) and 8(7)).

Kallix is also a data fiduciary in its own right, for a smaller set of data: people who visit kallix.in, try a demo call or hold a Kallix account. Our privacy policy covers that data.

Agencies and BPOs. If you run calls for a client, the fiduciary is whoever decides the purpose and the means of the calls (section 2(i)). Settle in your contract which of you that is, and take advice before you rely on it.

Consent for AI calls in India: the notice comes first

The Act allows personal data to be processed for a lawful purpose on one of two grounds: the person's consent, or one of a short list of "legitimate uses" (section 4). For most outbound calling, plan around consent.

What counts as consent

The Act's test is that consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (section 6(1)). It covers a specified purpose, and only the data that purpose needs. A box the person ticks themselves, or a clear spoken yes, is an affirmative action. Not objecting isn't.

What the notice must say

A request for consent has to come with a notice, or after one (section 5). From 13 May 2027, rule 3 sets the minimum. The notice must:

• make sense on its own, apart from any other information you give;
• use clear and plain language;
• list the personal data item by item;
• state the purpose, and describe the goods, services or uses the processing makes possible;
• link to your website or app, and describe any other way the person can withdraw consent, use their rights, and take a complaint to the Data Protection Board.

People can ask to read the notice in English or in any language listed in the Eighth Schedule to the Constitution, Hindi among them (section 5(3)).

Where the notice goes on a call

For most campaigns, notice and consent come before the first call: on a website form, in your app, in a loan agreement or at checkout. The call's opening lines then remind the person who is calling, for which business and why, and tell them an AI agent is on the line and a recording is running.

The Rules ask a lot of a notice: the data item by item, the purpose, and a link for withdrawing consent and complaining to the Board. That's hard to fit into a call's first few seconds, so treat the opening lines as a reminder of a notice the person has already had. If you plan to rely on a spoken notice alone, ask your adviser first.

Customers who agreed before the duties started

If someone gave consent before the Act's duties applied, you may keep processing their data. You must still send them a notice as soon as reasonably practicable (section 5(2)). If you call an existing customer base, plan that notice before 13 May 2027.

Legitimate uses

Some processing needs no fresh consent. The case callers meet most is section 7(a): a person gave you their data voluntarily for a specified purpose and hasn't told you they object. A customer who shares a number so you can confirm her order may expect a call about that order. Using the same number for a different campaign falls outside it. Ask your adviser before you rely on a legitimate use.

Keep the proof

If consent is ever questioned, the fiduciary has to prove that it gave the notice and got the consent (section 6(10)). Keep a record for each contact: the notice they saw, when they agreed and where.

DPDP consent and TRAI consent are different

DPDP consent is about using a person's data. TRAI's rules decide whether you may place a promotional call to a number at all, through DND preferences and consent registered on the operators' DLT platform. A promotional AI call may need both. TRAI rules for AI calls →

Consent managers

People will be able to give, review and withdraw consent through a consent manager registered with the Board (section 6(7) to 6(9)). Registration opens about 13 Nov 2026, and consent managers must be Indian companies (PIB, 14 Nov 2025). You don't need one to run calls, but be ready to act on a withdrawal that reaches you through one.

Withdrawing consent: as easy as giving it

A person may withdraw consent at any time, and doing so must be about as easy as giving it was (section 6(4)). You then stop processing their data within a reasonable time, and have your processor stop too, unless a law requires or allows you to carry on (section 6(6)). Withdrawal doesn't make earlier processing unlawful (section 6(5)).

On a call, withdrawal usually sounds like "please stop calling me" or "ab call mat karna". Treat it as more than a do-not-call flag, because the person may also want their recording and details deleted. Make sure the outcome reaches your CRM and every other list you call from.

In Kallix, a "do not call" outcome leaves that contact out of every campaign in your workspace. If the person also wants their recording and details erased, ask Kallix support to delete them.

Call recording consent in India

The DPDP Act doesn't mention call recordings by name. A recording is personal data like the rest of the call, so the same rules apply: a lawful basis, a notice that says calls are recorded and transcribed and why, and a retention period tied to that reason.

• Say it twice. Put recording in your notice, and say "this call is recorded" in the opening lines, after the agent says it's an AI.
• Give the reason. For example, to keep a record of what was agreed, such as a promise to pay or a delivery slot, or to review call quality.
• Keep it while the reason lasts. Then delete it, unless a law makes you keep it longer.
• Check your sector. Some regulators set their own recording and retention rules.

Kallix records and transcribes every call, so write your notice on that basis. You choose how long Kallix keeps them:

• Recordings: 30 days, 90 days (the default) or one year.
• Transcripts and call analysis: 90 days, one year (the default), or until you delete them.
• Outcomes only: switch transcript storage off, and Kallix keeps the call's outcome without the transcript.

Insurers have a rule of their own. IRDAI's guidelines on distance marketing (2011) require telemarketing calls to be recorded and kept, and the customer told that the call is recorded. A Kallix agent's opening line can say so.

DPDP Act voice AI duties, from purpose to erasure

Purpose limitation and data minimisation

Consent covers a specified purpose and only the data that purpose needs (section 6(1)). With an AI agent, that becomes a scripting job.

• One purpose per campaign. Write it down and make the agent's objective match it.
• Ask only for what the purpose needs. A COD confirmation call needs the order and the delivery address. It doesn't need the customer's PAN.
• Don't reuse a list for a new purpose without a fresh basis. Numbers gathered for EMI reminders aren't a list for a credit card offer.
• Keep payment details off the call. Kallix agents never ask for card numbers, OTPs, PINs or passwords. A payment link on WhatsApp does that job, so the data never enters the recording.

Accuracy

If you use personal data to make a decision that affects someone, or pass it to another fiduciary, you must keep it complete, accurate and consistent (section 8(3)). An outcome such as "already paid" or "dispute" can decide the next step on an account, so check it against the transcript when it matters.

Retention and erasure

• Delete when the purpose is over. Erase personal data when the person withdraws consent, or once it's reasonable to assume the purpose is no longer served, whichever comes first, unless a law requires you to keep it (section 8(7)). People can also ask you to erase it (section 12(3)).
• Hold on to processing logs for a year. From 13 May 2027, a fiduciary keeps personal data, traffic data and logs of its processing, including processing done by its processor, for at least one year from the processing, for the purposes listed in the Rules' Seventh Schedule. After that it erases them, unless another law needs them kept (rule 8(3)). Security logs follow a one-year period too (rule 6(1)(e)).
• Large platforms have a fixed period. E-commerce platforms and social media intermediaries with two crore or more registered users in India, and online gaming intermediaries with 50 lakh or more, erase data three years after the person was last in touch, with 48 hours' warning first (rule 8(1) and 8(2), Third Schedule).
• Set a period for each kind of data: contact lists, recordings, transcripts, outcomes and logs. Say what it is in your notice. Kallix's choices for recordings and transcripts are listed under call recording consent, above.

Security safeguards

A fiduciary must protect the personal data it holds or controls with reasonable security safeguards, and that includes data its processor handles (section 8(5)). Rule 6 sets the minimum:

• encryption, obfuscation, masking or virtual tokens;
• control over who can reach the systems that hold the data;
• logs, monitoring and review, so unauthorised access can be found and investigated;
• backups, so processing can continue after data is lost or damaged;
• keeping those logs and data for one year, unless another law says otherwise;
• security terms in the contract with your processor;
• the technical and organisational measures to make all of it work.

On Kallix, we encrypt call data in transit and at rest, role-based access sets what each member of your team can reach, and phone numbers and ID numbers can be masked in transcripts for view-only members.

Failing to take reasonable safeguards carries the Act's highest penalty: up to ₹250 crore (Schedule, item 1).

Breach reporting

A personal data breach is any unauthorised processing, accidental disclosure or loss of access that compromises the confidentiality, integrity or availability of personal data (section 2(u)). When it happens, the fiduciary tells two parties (rule 7):

• Each person affected, without delay. In plain language: what happened and when, what it's likely to mean for them, what you're doing about it, what they can do to protect themselves, and who they can contact.
• The Data Protection Board, without delay. First a description of the breach and its likely impact. Then, within 72 hours, a fuller report: what led to it, what you've done to reduce the risk and stop a repeat, any findings about who caused it, and the notices you sent to people. The Board can allow more time if you ask in writing.

Failing to tell the Board or the people affected can cost up to ₹200 crore (Schedule, item 2).

If a breach affects call data Kallix holds for you, we tell you without undue delay, so you can tell the people affected and send the Board its report within 72 hours.

People's rights

People whose data you process can:

• Get a summary of their personal data and what you do with it, plus the other fiduciaries and processors you've shared it with (section 11).
• Correct, complete, update or erase their data (section 12).
• Raise a grievance with you first, then complain to the Board (section 13). You publish a response period, and it can't be more than 90 days (rule 14(3)).
• Nominate someone to use these rights for them if they die or can't act for themselves (section 14).

Publish how people can make a request (rule 14(1)), and the contact details of your Data Protection Officer, or of a person who can answer questions about the processing (section 8(9), rule 9).

Children

You need verifiable consent from a parent or lawful guardian before you process a child's data, and the Act counts anyone under 18 as a child (sections 2(f) and 9, rule 10). Keep children's numbers out of AI calling campaigns.

Data outside India

The Act doesn't require all personal data to stay in India. The government can restrict transfers to countries it notifies (section 16), and fiduciaries must meet any conditions it sets on making data available to a foreign state or its agencies (rule 15). Sector regulators may have data-location rules of their own.

DPDP Rules 2025 timeline

The Act's own sections follow the same schedule, under a separate notification of the same date. Its duties for fiduciaries, including consent, apply from 13 May 2027, and consent managers' registration after one year.

Why "about". The Gazette issue is dated 13 Nov 2025, but it went online on 14 Nov, and some advisers count from that day. The difference is one day. Plan for the earlier date.

Could the dates move? In early 2026, law firms reported that MeitY had discussed bringing the deadline forward, from 18 months to 12, at least for significant data fiduciaries. As of 23 Oct 2026 we found no amendment in the Gazette. If one is notified, we'll update this page.

What to do before then. The duties can't be enforced until May 2027, but a campaign you launch today builds the contact lists, recordings and habits you'll carry into 2027. Building in notice, consent and retention from the first campaign saves rework later.

How Kallix fits

Kallix is DPDP Act compliant, and call data is stored and processed in India. For the call data in your workspace, your business is the data fiduciary and Kallix is your data processor, acting on your instructions. Here's what the platform does on every call, and what stays with you as the fiduciary.

What Kallix does

• A data processing agreement. The processor contract the Act expects is available to every customer on request, and so is a list of our sub-processors. Write to privacy@kallix.in.
• Data stored and processed in India. Recordings, transcripts and outcomes are stored and processed in India. The Act doesn't require that; it's our choice. Security →
• Retention you choose. Recordings for 30 days, 90 days or one year. Transcripts for 90 days, one year or until you delete them. Or switch transcript storage off and keep only outcomes.
• Masking for view-only members. Phone numbers and ID numbers can be hidden in transcripts for team members who only view calls.
• Encryption and access control. We encrypt your call data in transit and at rest, and role-based access sets what each member of your team can see and do.
• Export and delete. Export all your workspace data, or delete the workspace, with the owner confirming by email. To erase one person's data, ask Kallix support. Workspace exports and deletions show in your workspace logs.
• Breach notice without undue delay. If a breach affects your call data, Kallix tells you without undue delay, so you can meet the Board's 72-hour report.
• AI disclosure in the first line. Every agent says it's an AI assistant as the call opens, and hands over to a person when asked. That's our policy, in line with RBI's FREE-AI recommendation, not wording taken from the Act.
• Your notice in the opening lines. You write the agent's first message, so it can say who's calling, for which business, why, and that the call is recorded. Agents speak Hindi, English, Hinglish and more, and switch when the caller does. Agent studio →
• Consent on the contact. Store each person's consent source and date when you upload a list or push contacts by API.
• Opt-outs honoured everywhere. If a person tells the agent to stop calling, it agrees and records "do not call" as the outcome, and the contact is left out of every campaign from then on.
• DND checks and calling windows. Numbers are checked against the DND register (NCPR) before a campaign dials, as TRAI's rules call for. Campaigns call only in the hours you set, in IST; for collection calls, set them to RBI's 8 am to 7 pm. Both keep calls to people who expect them. Campaigns →
• No payment details on the call. Agents never ask for card numbers, OTPs, PINs or passwords. They send a payment link on WhatsApp instead.
• A record of every call. Each call has a recording, a transcript and an outcome, so you can show what the agent said and what the person agreed to.
• Data you can hand back. Export results as CSV, or fetch calls and results through the REST API, when someone asks what you hold about them. Signed webhooks send outcomes, opt-outs included, to your CRM. Integrations →
• Tested before launch. Run test suites against an agent version before it goes live, to check that it gives the disclosure, stays on purpose and accepts "please stop calling me". Each version keeps a changelog. Testing →

What stays with you

• the lawful basis and the notice for every contact you upload;
• your consent records: they're yours, and each Kallix contact can hold its consent source and date;
• answering people's requests and grievances, and publishing a contact for them, including asking Kallix support to erase a person's data when they ask you;
• telling the Board and the people affected if there's a breach;
• deciding how long to keep each kind of data, using the retention settings above for what Kallix holds.

Related reading: AI calling compliance in India → · TRAI rules for AI calls → · Calling customers with AI in India: consent, DND and calling hours → · AI voice agents for banking and lending → · Payment reminder calls → · Acceptable use policy →

Your DPDP Act AI calling checklist

Work through it before your first campaign, and again before 13 May 2027.

Before you upload a list

1. Map the data. List every field you upload, every question the agent will ask and everything you keep after the call.
2. Name one purpose per campaign. Write it down, and match the agent's objective to it.
3. Check the basis for every contact. Consent, with its source and date, or a legitimate use your adviser has confirmed. Leave out anyone you can't account for, and any number you know belongs to a child.
4. Run the TRAI checks too. DND preferences, the right number series and the A2P declaration. TRAI checklist →

Before the first call

1. Update your notice. Standalone and in plain language: the data item by item, the purpose, and how to withdraw, use rights and complain to the Board. Mention AI calls and recording. Offer it in English and in the languages you call in.
2. Write the opening lines. The AI disclosure, your business name, the reason for the call, and that it's recorded.
3. Script the way out. The agent should accept "stop calling me" and "delete my data", end politely and record the outcome.
4. Sign a processor contract with your calling platform that covers security safeguards and erasure. Kallix offers one to every customer on request.
5. Test it. Make test calls for the disclosure, an opt-out, an off-topic question and a request for a person.

After the call

1. Set retention periods for recordings, transcripts, outcomes and logs. Keep logs for at least one year, then delete on schedule.
2. Sync opt-outs everywhere. Kallix leaves do-not-call contacts out of every campaign. Send those outcomes to your CRM and to every other list you call from.
3. Publish a contact and a rights process. Answer grievances within the period you publish, 90 days at most.
4. Write a breach plan. Name who tells the people affected without delay, and who reports to the Board within 72 hours.