How it works on Indian calls
The Digital Personal Data Protection Act, 2023 splits the work on personal data into two roles:
- Data fiduciary: decides the purpose and the means of processing (section 2(i)).
- Data processor: processes personal data on a fiduciary's behalf (section 2(k)).
Take an NBFC that runs EMI reminder calls with an AI agent. The NBFC picks the borrowers, the reason for the call, the script and what's kept, so it's the fiduciary. The calling platform dials, records and stores the results on its instructions, so it's the processor.
What the split means in practice:
- The fiduciary stays responsible for processing done on its behalf, whatever a contract says (section 8(1)).
- A processor works under a valid contract (section 8(2)), and the DPDP Rules, 2025 expect that contract to cover security safeguards.
- Deletion flows down. When consent is withdrawn or the purpose is over, the fiduciary erases the data and has its processor erase it too.
- Most duties start on 13 May 2027: notice, consent, security, breach reporting, people's rights and erasure, under the Rules notified on 13 November 2025.
If an agency or BPO runs calls for a client, the fiduciary is whoever decides the purpose and the means. Settle that in your contract, and take advice.
How Kallix handles it
For the call data in your workspace, your business is the data fiduciary and Kallix is your data processor, acting on your instructions. A data processing agreement is available to every customer on request, and so is a list of sub-processors. Call data is stored and processed in India, and Kallix is DPDP Act compliant. Kallix is a fiduciary in its own right only for its own data, such as kallix.in visitors and account holders.