Skip to content
Glossary

DPDP Act

The DPDP Act is the Digital Personal Data Protection Act, 2023, India's law on how organisations collect, use, keep and delete personal data held in digital form. On an AI call that includes the phone number, the person's voice, the recording and the transcript. Most of its duties for businesses apply from 13 May 2027.

How it works on Indian calls

The Act (No. 22 of 2023) became law on 11 August 2023. The DPDP Rules, 2025 (G.S.R. 846(E)), dated 13 November 2025, phase its duties in over 18 months:

WhatFrom
Data Protection Board provisions13 November 2025
Registration of consent managersAbout 13 November 2026
Notice, consent, security safeguards, breach reporting, people's rights, retention and erasure13 May 2027

For a business that calls customers with AI, the Act asks for:

  • A lawful basis, usually consent, to call people and to record and process their calls. Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (section 6(1)).
  • A clear notice of what you collect and why, available in English or any language in the Eighth Schedule to the Constitution (section 5(3)).
  • Easy withdrawal. Withdrawing consent must be about as easy as giving it.
  • Safeguards and breach reporting. Tell the people affected and the Data Protection Board without delay, then send the Board a fuller report within 72 hours (rule 7).

The Act's highest penalty, up to ₹250 crore, is for not taking reasonable security safeguards. Not reporting a breach can cost up to ₹200 crore.

Two points that are often misread: the Act doesn't require data to be stored in India, and it has no separate "biometric" class for voice recordings.

How Kallix handles it

Kallix is DPDP Act compliant. For the call data in your workspace, your business is the data fiduciary and Kallix is your data processor, with a data processing agreement on request. Call data is stored and processed in India, which is our choice rather than a legal requirement, and you choose how long recordings and transcripts are kept. Security →

The DPDP Act and AI calls

Common questions.

More on the FAQ page, or write to us.

Yes. Phone numbers, names, recordings and transcripts are personal data, and an AI call handles them in digital form. The duties are the same whether a person or an AI agent makes the call, and most apply from 13 May 2027.

Not as a general rule. The government can restrict transfers to countries it notifies, and sector regulators may have their own data-location rules. Kallix stores and processes call data in India either way, as our choice.

The government notified the Rules on 13 November 2025. Notice, consent, security, breach reporting, people's rights and erasure apply from 13 May 2027. A reported plan to shorten that timeline had not been notified as of 23 October 2026.

Put an agent on the line.
Hear it call you today.

Hear a live callBook a demo

₹500 in free credits when you sign up. ₹4.80 a minute after that.