Customer-Service Call Recording Under DPDP: Notice, Retention and Access-Control Checklist
By Ravi Sisodia · Reviewed by CA Divyanshu Sengar · Updated 5 October 2026
2-minute summary
- Call recording is personal-data processing when an individual can be identified from the audio or associated metadata.
- The October 2026 legal position requires careful staging: most DPDP notice/consent and Data Principal rights provisions have not yet commenced, but businesses should build the future-state control now.
- A defensible recording program specifies why calls are recorded, who can access them, how long they are retained and how recordings are searched or deleted.
Current position
Control and evidence map
| # | Control / evidence requirement | |
|---|---|---|
| 1 | Map call categories: service, complaint, sales, quality, fraud and regulated advice should not be lumped together. | |
| 2 | Script a concise recording notice and document the operational purpose for each call type. | |
| 3 | Restrict playback/export privileges and log privileged access to recordings. | |
| 4 | Set retention by use case rather than keeping every recording indefinitely. | |
| 5 | Build retrieval and deletion workflows keyed to customer/account/call identifiers. | |
Worked example
A bank-outsourcing vendor records all support calls and stores them for seven years “for quality”. A better design separates complaint evidence from routine service calls, documents the reason for each retention period, limits supervisor downloads and makes recordings searchable by customer reference. That architecture will be easier to align when the core DPDP obligations commence.
Common mistakes
- Assuming voice data is outside DPDP because it is not a form field.
- Keeping recordings forever because storage is cheap.
- Letting agents download audio locally.
- Using a single notice for service calls and outbound marketing without analysing different purposes.
Frequently asked questions
Is a call recording personal data?
It can be when linked or linkable to an individual.
Are full DPDP notice duties live today?
Not yet as of 5 October 2026; commencement is staggered.
Can recordings be retained for litigation?
Retention should be tied to a lawful and documented need and other applicable law.
What is the key control?
Purpose-specific retention plus access logging and a clear customer-facing notice design.
Official sources
- Ministry of Electronics and Information Technology - Digital Personal Data Protection Act, 2023 (Act 22 of 2023; 2023-08-11)
- Ministry of Electronics and Information Technology - Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E); 2025-11-13)
- Ministry of Electronics and Information Technology - DPDP Act commencement notification (G.S.R. 843(E); 2025-11-13)
Disclaimer
Educational and professional reference only; confirm the current law, rates and the facts of your case before relying on this page.