DPDP Consent for AI Calls and Call Recordings: What Changes on 13 November 2026

DPDP AI calling consent reaches an important milestone on 13 November 2026, but this is not when every AI calling privacy obligation takes effect. The statutory Consent Manager framework becomes operational under the scheduled provisions, while the core consent, notice and processing obligations are scheduled for 13 May 2027.

For admissions offices, BPOs, contact centres and sales teams, the distinction matters. Permission to make a call does not automatically authorise recording, transcribing, storing or reusing the personal data collected.

This guide explains the implementation timeline, lawful processing grounds, call-recording safeguards and practical compliance preparation.

What Does the DPDP Act Mean for AI Calling?

India's Digital Personal Data Protection Act, 2023 regulates specified processing of digital personal data.

AI voice systems may process:

• Recordings: Audio containing identifiable personal information.
• Transcripts: Names, phone numbers and enquiry details.
• CRM records: Customer histories, preferences and follow-ups.
• AI summaries: Information extracted or inferred from conversations.

These records can qualify as personal data when they relate to identifiable individuals and meet the Act's application conditions.

The organisation determining the purpose and means of processing is the Data Fiduciary. A vendor processing information on its behalf may be a Data Processor.

Businesses exploring DPDP compliance for AI voice agents in India should distinguish lawful communication from lawful personal-data processing.

DPDP AI calling consent is only one part of that wider responsibility.

What Changes on 13 November 2026?

The MeitY Gazette commencement notification and DPDP Rules, 2025 establish a phased implementation schedule.

A statutory Consent Manager is a Board-registered entity through which individuals can give, manage, review and withdraw consent.

It is not simply a checkbox inside a CRM.

Key takeaway: November 2026 primarily concerns the statutory Consent Manager framework, not a universal AI-call recording deadline.

Businesses should prepare their DPDP AI calling consent processes before May 2027 without ignoring existing telecommunications obligations.

TRAI vs DPDP: Why Are Both Relevant?

The Telecom Regulatory Authority of India regulates commercial communications through the Telecom Commercial Communications Customer Preference Regulations (TCCCPR) and subsequent amendments.

The DPDP framework addresses how digital personal data is processed.

For example, a university admissions office might be permitted to contact someone about an enquiry. That permission does not automatically extend to unrelated profiling or AI model training.

The TRAI regulations register also lists a Third Amendment dated 18 September 2026. Businesses should review the applicable final provisions for their calling category.

DPDP AI calling consent and telecom permissions must therefore be evaluated separately.

When Is DPDP AI Calling Consent Required?

Sections 4, 6 and 7 of the DPDP Act recognise processing based on consent or specifically enumerated certain legitimate uses.

When another permitted ground may apply

Section 7(a) may permit processing for a specified purpose when an individual voluntarily provides personal information and the statutory conditions are satisfied.

For example, an applicant sharing their phone number to request university counselling may permit processing connected to responding to that request.

However, unrelated marketing or model training requires a separate lawful-ground assessment.

When consent is required

Section 6 describes consent as free, specific, informed, unconditional and unambiguous, demonstrated through clear affirmative action.

Businesses should:

1. Define the purpose of collecting personal information.
2. Identify the applicable legal ground.
3. Provide the required notice where applicable.
4. Capture affirmative agreement when consent is necessary.
5. Maintain evidence supporting the processing decision.

DPDP AI calling consent should be purpose-specific, not a universal verbal approval imposed on every call regardless of circumstances.

Is “This Call May Be Recorded” Sufficient?

Not automatically.

A generic announcement discloses possible recording. It does not necessarily explain the purposes of processing or establish valid consent.

For call recording consent India DPDP readiness, distinguish these activities:

• Recording: Capturing customer audio.
• Transcription: Converting speech into written information.
• Operational analysis: Using information for the identified service purpose.
• Secondary processing: Reusing information for marketing, profiling or model training.

Each intended use requires an appropriate lawful basis.

Rule 3 of the DPDP Rules prescribes notice information, including personal-data descriptions, processing purposes and applicable rights mechanisms.

Effective DPDP AI calling consent requires more than a recording disclaimer when consent is the processing ground.

How Should Businesses Manage AI Recordings and Transcripts?

Strong AI call recording privacy India practices require controls throughout the data lifecycle.

Collection and purpose controls

• Collect information needed for the defined purpose.
• Distinguish operational recording from secondary data uses.
• Avoid unnecessary disclosure of sensitive information.

Security and storage controls

• Restrict access to authorised personnel.
• Apply appropriate technical safeguards.
• Monitor access and maintain relevant security records.
• Review storage locations and third-party transfers.

Retention and deletion controls

• Define retention schedules for each data category.
• Identify applicable statutory preservation duties.
• Implement deletion across connected systems where required.

Rule 6 and Rule 8 of the DPDP Rules address security safeguards and specified retention requirements.

Rule 8(3) includes minimum one-year preservation requirements for specified processing data and logs for Seventh Schedule purposes, subject to its conditions. This is not a universal 12-month maximum for call recordings.

For related technical and privacy considerations, explore Sicada.ai's privacy and compliance guide for voice and document AI.

What Happens When Someone Withdraws Consent?

Under Section 6, withdrawal must be comparably easy to giving consent.

Where processing depends on withdrawn consent, the Data Fiduciary must cease the affected processing within a reasonable time and cause relevant processors to stop, unless continued processing is otherwise authorised or required by law.

Businesses should also prepare processes for applicable Data Principal rights:

• Access to processing information.
• Correction and erasure requests.
• Grievance redressal.
• Withdrawal and downstream updates.

DPDP AI calling consent records should connect the individual, authorised purposes, withdrawal status and affected systems.

This makes DPDP consent management an operational requirement rather than simply a disclosure exercise once the relevant provisions apply.

Who Is Responsible for AI Calling Data?

Under Section 8, a Data Fiduciary retains statutory responsibilities for processing undertaken on its behalf.

Actual roles depend on the arrangement, not just contractual labels.

Sicada.ai's Privacy Policy discusses customer content, recording responsibilities and data handling. Its Terms and Conditions address telephony-related responsibilities.

Organisations should verify contractual arrangements, vendor controls and actual platform settings before deployment.

DPDP AI calling consent does not automatically become valid simply because an AI technology provider manages the conversation.

Illustrative AI Calling Consent Script

Illustrative wording only. Assumes consent is the applicable legal basis and requires legal review.

“Hello, I am an AI assistant calling on behalf of ABC Admissions regarding your course enquiry.

With your permission, we would like to record and transcribe this conversation to document your enquiry and support your counselling request.

Our privacy notice is available at Sicada website.

Do you agree to recording and transcription for these purposes?”

If consent is refused, processing that depends on that consent should not proceed. A non-recorded alternative or human assistance may be offered where feasible.

The system must also handle the initial consent exchange lawfully.

DPDP AI Calling Readiness Checklist

Preparing DPDP AI calling consent requires coordination across departments.

These controls are especially relevant for Indian BPOs using AI voice agents, admissions teams and outbound sales departments.

FAQs

Does every AI call require explicit consent?

No. The DPDP Act recognises consent and certain specified legitimate uses. The applicable ground depends on the processing purpose and statutory conditions.

Can AI call transcripts be used for model training?

Only where an applicable lawful ground covers that processing and other requirements are satisfied. Permission to answer an enquiry does not automatically authorise unrelated training.

Must all recordings remain in India?

The Act does not impose a universal India-only storage rule. Section 16 and Rule 15 establish a conditional cross-border transfer framework, subject to applicable restrictions.

Is 13 November 2026 the final compliance deadline?

No. It primarily concerns statutory Consent Managers. The wider processing framework is scheduled for 13 May 2027.

Conclusion

DPDP AI calling consent involves more than asking permission to record a conversation. Organisations need to establish lawful processing purposes, appropriate disclosures, recording safeguards, retention rules and practical withdrawal procedures.

The November 2026 milestone concerns statutory Consent Managers, while the broader DPDP processing obligations are scheduled for May 2027.

Admissions departments, BPOs and sales teams should evaluate both calling permissions and subsequent data handling.

A compliant workflow depends on the full lifecycle of customer information, not one statement at the beginning of a call.

Review Your AI Calling and Data-Handling Workflow

Assess your consent procedures, AI calling configurations, recording controls and vendor responsibilities before expanding automated communications.