Every call centre in India holds personal data: phone numbers, names, call recordings, CRM notes and WhatsApp chats. The Digital Personal Data Protection Act, 2023 (DPDP Act) sets the rules for how businesses collect, use, keep and protect that data. This guide explains what the DPDP Act means for call recording and contact centre data, in plain language, with practical steps for your team.
This article is general information, not legal advice. Talk to your lawyer about how the Act and its rules apply to your business.
The DPDP Act in brief
The DPDP Act applies to digital personal data processed in India, and to data collected offline and later digitised. A few terms matter for call centres:
- Data Principal: the person the data is about, such as a caller, patient, parent or borrower.
- Data Fiduciary: the business that decides why and how the data is processed. If you run a call centre for your own customers, that is you.
- Data Processor: a company that processes data on your behalf, such as an outsourced call centre or a cloud provider.
The DPDP Rules were notified in November 2025 and most duties apply after a phase-in period. Check the current dates with your legal adviser, but start preparing now: changing recording practices, CRM access and retention takes time.
What it means for call recording
A recorded call contains the caller’s voice, number and often far more: health details, account numbers, addresses. Under the DPDP Act, recording is processing personal data, so the core duties apply.
Notice and consent
Personal data should be processed for a lawful purpose, with consent or under one of the “legitimate uses” the Act allows. Consent must be free, specific, informed and given by a clear action. Before or when you ask for consent, you must give a notice that explains what data you collect and why.
For calls, that usually means:
- A short announcement at the start of the call, such as “This call may be recorded for quality and training purposes”, in the caller’s language.
- A link to your privacy notice on your website and in WhatsApp templates, explaining recordings, retention and how to contact you.
- A way for the person to withdraw consent, which must be as easy as giving it.
Purpose limits
Use recordings for the purposes you stated, such as quality monitoring, training and dispute resolution. Do not quietly reuse them for unrelated marketing.
Retention
Do not keep personal data longer than the purpose needs. Once the purpose is served, or consent is withdrawn, the data should be erased unless another law requires you to keep it. Banks, insurers and healthcare providers often have sector rules that set their own retention periods, so agree a written retention period for each queue with your compliance team.
Rights of the caller
Data Principals can ask for a summary of their data, ask for corrections or erasure, and must have a way to raise grievances. Your team needs a simple process: who receives the request, how you find the person’s records and recordings, and how fast you respond.
Protecting data: access control and security
The Act requires reasonable security safeguards to prevent a personal data breach, and failing to take them can attract penalties of up to ₹250 crore. In a contact centre, safeguards are mostly about who can see and hear what.
| Area | Good practice |
|---|---|
| Recordings | Only supervisors and QA staff who need them can play or download |
| CRM data | Agents see the records for their queue, not the whole database |
| Admin changes | Every login and settings change is logged |
| Network | Calls and logins are encrypted where possible |
| Backups | Encrypted, stored in known locations, with restore tested |
| Exports | Report downloads limited to named people |
| Leavers | Accounts disabled the day an employee leaves |
Breach handling
If a breach happens, the Act requires you to inform the Data Protection Board of India and each affected person. Prepare a short plan now: who decides it is a breach, who investigates, who writes to the Board and to customers, and how you stop it happening again.
CRM data and WhatsApp chats
The same principles apply beyond phone calls:
- CRM: collect only fields you use. A lead form with twenty fields for a simple enquiry collects data you then have to protect.
- WhatsApp: get opt-in before messaging first, and keep chats in a shared inbox with named agent logins, not on staff personal phones. See WhatsApp quality rating and opt-in.
- Outsourced teams: if a partner runs your call centre, you remain responsible. Put data protection terms in the contract.
Why on-premise helps you stay in control
With an on-premise phone system, recordings and call logs stay on servers you own, in your building or data centre. You decide where data lives, who can reach it and when it is deleted, and you can show auditors exactly where it is. For hospitals, banks, government departments and others with strict data rules, this is often the simplest way to answer “where is our call data?”. See cloud vs on-premise contact centre for the full comparison.
How Voxdial supports DPDP-ready practices
Voxdial Contact Center and the Voxdial IP PBX can run on-premise, on your own servers. Features that help:
- Recording only where needed: recording can be set per extension and per route, so you can record a support queue without recording every internal call.
- Recording access control: in call reports, the play and download option appears only for users with recording access. User groups are built from individual permissions, so each role sees only what it needs.
- Activity log: sign-ins, additions, edits and deletions in the admin panel are logged with the time, user and IP address.
- Announcements: play a recorded notice at the start of calls through announcements or the IVR, in the languages your callers use.
- Encryption options: TLS and SRTP for SIP calls.
- Backups you control: scheduled backups to local storage, SFTP, FTP, Amazon S3 and other destinations you choose.
For more on recording itself, read call recording system for business.
Want to review your call recording set-up against the DPDP Act? Talk to BitVoice.
FAQs
Is call recording legal under the DPDP Act?
The DPDP Act does not ban call recording. It requires that personal data, including recordings, is processed for a lawful purpose with a clear notice and consent (or a permitted legitimate use), kept only as long as needed and protected with reasonable security.
Do I need to tell callers that the call is recorded?
Giving notice is the safe practice under the DPDP Act. A short announcement at the start of the call and a link to your privacy notice are common ways to do it. Ask your lawyer about your specific case.
How long can a call centre keep call recordings?
Only as long as the stated purpose needs, unless another law requires longer retention. Set a written retention period per queue with your compliance team.
Does on-premise call recording help with DPDP compliance?
It helps you control where recordings are stored, who can access them and when they are deleted. You still need notice, consent, retention rules and security practices in place.
