How does the DPDP Act affect AI calling?
The DPDP Act 2023 governs the personal data an AI calling programme uses and creates: phone numbers, names, recordings, transcripts and anything callers share. The business needs a lawful basis (usually consent), a clear notice, purpose limits, security safeguards and deletion when the purpose ends. The DPDP Rules 2025 are being phased in, so check which obligations already apply to you.
Who is who under the Act
Under the Digital Personal Data Protection Act 2023, the business running the calls is the data fiduciary: it decides why and how personal data is processed. The AI calling platform is typically a data processor acting on the business's instructions under a contract. Responsibility for consent and notice sits mainly with the fiduciary.
Obligations that touch every call
- —Notice (Section 5): tell people what data you collect and why, in clear language, with the option of English or a language in the Eighth Schedule.
- —Consent (Section 6): free, specific, informed, unconditional and unambiguous, and withdrawing it must be as easy as giving it.
- —Legitimate uses (Section 7): a narrow list of situations where consent is not needed; most marketing calls do not fit.
- —Safeguards and erasure (Section 8): protect the data, report breaches, and erase it once the purpose is served.
- —Children (Section 9): verifiable parental consent before processing data of anyone under 18.
What this means for a calling programme
A lead form needs consent wording that names calls as a purpose. A bulk list needs a traceable source. Recordings and transcripts need a retention period. A caller who says 'do not call me again' has withdrawn consent, and that must flow back into every list you use.
Timelines and penalties
The DPDP Rules 2025 were notified in November 2025, with most obligations on data fiduciaries phased in over the following 18 months. The Data Protection Board of India can impose penalties of up to ₹250 crore for the most serious breaches, such as failing to take reasonable security safeguards.
How Outpero fits
Outpero processes call data on your instructions, keeps recordings and transcripts in your dashboard and lets you export them or route them by webhook. Your consent wording, retention policy and opt-out list stay under your control.
Different parts of the Act and Rules come into force on different dates. Confirm the current status with counsel before finalising your consent and retention set-up.
Want to hear an AI voice agent handle this on a real call?
Follow-up questions
Does the DPDP Act stop businesses from cold calling?
+
It does not ban cold calling outright, but it makes careless list-building risky. Using personal data for marketing needs a lawful basis, and consent is the usual one. A list of people who never agreed to hear from your business is hard to defend under the Act, quite apart from TRAI's DND rules for promotional calls.