Blog · Rules explained

The DPDP Act for call recordings and WhatsApp chats: a business checklist

Every call recording, AI transcript and WhatsApp chat with a customer is personal data under India’s Digital Personal Data Protection Act, 2023. The DPDP Rules, notified on 13 November 2025, bring most of the day-to-day duties into force on 13 May 2027. In short: tell people what you record and why, collect only what you need, keep it safe, delete it when you are done, and be ready to report a breach. Here is what that means for a phone desk and a WhatsApp number. It complements our AI receptionist in India guide.

By Vocora team · Published 15 October 2026 · Rules as of 15 October 2026

Who is responsible for what?

Data Principal: the caller or the person messaging you.
Data Fiduciary: your business, because you decide why calls are recorded and what happens to chats.
Data Processor: anyone processing on your behalf, such as your cloud telephony provider, your WhatsApp solution provider, or an AI receptionist vendor.

The Act keeps the duty with the Fiduciary even when a processor does the work, and Rule 6 asks for security obligations to be written into your contract with each processor. Using a vendor does not move the responsibility off your desk.

When do the obligations start?

Date	What comes into force
13 November 2025	Rules notified. Rules 1, 2 and 17–21 (Data Protection Board) in force on publication.
13 November 2026	Rule 4 (registration and obligations of Consent Managers) in force, one year after publication.
13 May 2027	Rules 3 and 5–16, 22 and 23 in force: notice, security safeguards, breach intimation, retention, contact details, children’s data, rights and more.

Dates follow Rule 1, counted from publication in the Gazette on 13 November 2025. PIB describes this as an 18-month phased timeline. The Government can amend the Rules, so check MeitY’s site for any change before relying on a date.

Can you record calls, and on what basis?

The Act gives two routes for processing personal data:

Consent (section 6), which must be free, specific, informed, unconditional and unambiguous, and as easy to withdraw as to give.
Certain legitimate uses (section 7), including a specified purpose for which the person voluntarily gave you their data and has not objected. The Act’s own illustration is a pharmacy customer who shares her number to receive a payment receipt.

A caller who rings your clinic to book an appointment is giving you their details for that booking. Recording the call to get the booking right, and to check quality, sits close to that purpose. Using the same recording to train a sales team or to build a marketing list does not. When in doubt, ask.

A simple opening line covers most desks:

“This call is recorded so we can get your booking right. You can ask us to delete it any time.”
“Yeh call aapki booking sahi note karne ke liye record ho rahi hai. Aap kabhi bhi ise delete karne ko keh sakte hain.”

If the voice is an AI, say so too; our call scripts include a disclosure line.

What must the notice say?

Rule 3 says a notice must stand on its own, use clear and plain language, and at minimum give:

an itemised description of the personal data (for example: name, number, recording, booking details);
the specific purpose, and the goods or services it enables;
a link to your website or app and how to withdraw consent as easily as it was given;
how to exercise rights under the Act and how to complain to the Data Protection Board.

On a call you can give the short version and point to the full notice: “Our privacy notice is on our website and on WhatsApp.” On WhatsApp, send the link in the first reply or the opt-in confirmation.

How should you secure recordings, transcripts and chats?

Rule 6 lists minimum “reasonable security safeguards”. Translated for a phone desk:

Encrypt or mask. Recordings and transcripts encrypted at rest; mask numbers in exports.
Control access. Only the people who need recordings can play them. No shared logins.
Log access. Keep logs of who accessed what, so unauthorised access can be detected and investigated.
Back up. Be able to keep working if a system fails or data is lost.
Keep the logs. Rule 6 asks for those logs and the related data to be retained for one year for investigation, unless another law says otherwise.
Put it in the contract. Your agreement with each processor should include their security obligations.

Never collect what you cannot protect. WhatsApp’s policy already forbids asking people to share full card numbers, financial account numbers or ID numbers in chat; the same rule is sensible on calls. No OTPs, no full Aadhaar, no passwords.

How long can you keep a recording?

Section 8(7) requires erasure once consent is withdrawn or the purpose is no longer being served, unless another law requires you to keep it. Rule 8(3) separately asks every Fiduciary to retain personal data, traffic data and processing logs for at least one year from the processing, for the purposes in the Seventh Schedule, and then erase them unless a law requires longer.

For most small businesses that suggests a written retention rule, for example: keep booking-call recordings and transcripts for a defined period of at least one year, then delete; keep longer only where a sector law requires it. Write the rule down, configure it in your systems, and apply it to your vendors too.

What about breaches, rights requests and children?

Breach: under Rule 7, tell affected people without delay, in plain language, what happened and what they can do; tell the Board without delay and send a detailed report within 72 hours.
Contact person: Rule 9 asks you to publish on your website or app the contact of a person who can answer questions about your processing.
Rights: people can ask to access, correct, update or erase their data. PIB says Fiduciaries must respond within a maximum of 90 days.
Children: processing a child’s data needs verifiable parental consent, with limited exemptions such as for healthcare and education. Schools, coaching centres and paediatric clinics should design for parents as the contact.

DPDP consent flow for call recordings: give a clear notice before recording (Rule 3), get consent or rely on a legitimate use, use the recording only for that purpose, protect it and keep access logs for one year (Rule 6), report breaches with a detailed Board report within 72 hours (Rule 7), and erase when consent is withdrawn or the purpose ends (Section 8(7)) — The DPDP lifecycle of a call recording, summarised from the sections above. Most duties apply from 13 May 2027.

A checklist for your phone desk and WhatsApp number

List every place recordings, transcripts and chats are stored, including vendors.
Write one plain-language notice; add the short version to your call greeting and WhatsApp opt-in.
Decide the purpose of recording, and stop any use beyond it.
Remove questions that collect data you don’t need.
Turn on encryption, role-based access and access logs.
Set and configure a retention period; delete on request where no law requires otherwise.
Name a contact for privacy questions and publish it on your website.
Write a one-page breach plan with who calls whom within 72 hours.
Check each vendor contract for security and deletion obligations.

WhatsApp-specific opt-in rules are in our WhatsApp Business API guide; outbound calling consent under TRAI is in DLT and the 1600 series.

How Vocora handles call and chat data

When Vocora Voice AI or WhatsApp AI runs your desk, the script collects only the fields you approve, the AI discloses that it is a virtual assistant, and it never asks for OTPs, card numbers or Aadhaar. Recording, retention and access settings are agreed with you during setup. Read our privacy policy for how we handle data on this website.

Book a free demo Contact us · +91 98041 82483

FAQ

Does the DPDP Act apply to business call recordings?

Yes. A recording or transcript of a call with an identifiable person is digital personal data, so the business that decides why and how it is processed is a Data Fiduciary under the DPDP Act, 2023. The vendor that records or transcribes for you is a Data Processor acting on your behalf.

Do I need consent to record customer calls?

The Act allows processing either with consent or for certain legitimate uses, including a purpose for which the person voluntarily gave you their data. Either way, tell callers at the start that the call is recorded and why, use the recording only for that purpose, and keep it only as long as you need it. For uses beyond the call itself, such as marketing, get clear consent.

When do the DPDP Rules start applying to small businesses?

Most day-to-day duties in the Rules, including notice, security safeguards, breach intimation and retention, come into force on 13 May 2027, eighteen months after the Rules were published on 13 November 2025. The Data Protection Board provisions applied immediately.

DPDP Act mein call recording ke liye kya karna hoga?

Call ke shuru mein batayiye ki call record ho rahi hai aur kis kaam ke liye. Sirf zaroori jaankari lijiye, recording ko surakshit rakhiye, access limited rakhiye, aur kaam poora hone ke baad zaroorat na ho toh delete kar dijiye. Customer ko apni jaankari dekhne, sudharne ya hatane ka tareeka bhi dijiye.

Are WhatsApp chats covered too?

Yes. Chat messages, voice notes and documents customers send on WhatsApp are personal data. WhatsApp’s policy separately requires you to keep a published privacy policy, secure the permissions you need, and never ask people to share full card numbers, financial account numbers or ID numbers.

What if there is a data breach?

Under Rule 7, once in force, you must tell affected people without delay in plain language, and tell the Data Protection Board without delay, with a detailed report within 72 hours of becoming aware, unless the Board allows longer.

Sources

This article summarises public law for general information and is not legal advice. Sector rules (health, finance, telecom) may add to these duties. Check the latest MeitY notifications and take advice for your situation.

Glossary · AI receptionist guide · CNAP explained · Voice AI · Contact