DPDP Act and AI Voice Agents: What Indian Businesses Must Know
Most writing about the DPDP Act for AI focuses on chatbots, analytics and model training. Voice agents raise a more immediate question. Every AI phone call creates personal data within seconds: a phone number, a voice recording, a transcript and often details like a name, an appointment or an account number. If your organisation runs AI voice agents in India, the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 apply to all of it.
This post explains the parts of the law that matter most for voice AI, what they mean in day-to-day practice, and the specific points hospitals and banks should look at.
Note: this is general information, not legal advice. Talk to your legal counsel about your own obligations.
The DPDP Act 2023 in brief
The DPDP Act 2023 governs how organisations process digital personal data of individuals in India. The organisation that decides why and how data is processed is the data fiduciary; the individual is the data principal; and a company processing data on the fiduciary’s behalf is a data processor.
The Government notified the DPDP Rules 2025 on 14 November 2025. According to the government’s summary, the Rules provide an eighteen-month period for phased compliance, require a clear and separate consent notice explaining the specific purpose of processing, require affected individuals to be informed of a personal data breach without delay, and require organisations to respond to requests to access, correct, update or erase data within ninety days (PIB summary of the DPDP Rules 2025). Check the official timeline for when each obligation applies to you.
Why voice AI deserves special attention
A voice agent touches personal data at more points than most systems:
- Call metadata: caller number, time, duration, the number dialled.
- Audio: recordings of the whole call, and audio streamed to speech recognition.
- Transcripts: everything the caller said, as searchable text.
- Context passed to the AI: names, dates, amounts or medical details from your systems, included in prompts.
- Outcomes: what the bot recorded, booked or flagged, sent to your CRM or webhooks.
- Logs and caches: debug logs and cached audio that quietly hold copies of the above.
Each of these needs a purpose, a storage location, an access policy and a retention period.
Key DPDP obligations and what they mean for voice agents
| Obligation | What it means on an AI call |
|---|---|
| Lawful basis and notice | Tell callers what is collected and why. A short spoken notice at the start, with a fuller notice on your website or by SMS. |
| Purpose limitation | Use call data for the purpose you stated. A reminder call’s transcript should not quietly feed a marketing campaign. |
| Data minimisation | Pass the AI only what the call needs. A reminder bot does not need a diagnosis. |
| Accuracy | Confirm key details back to the caller before acting on them. |
| Reasonable security safeguards | Encrypt, restrict access to recordings and transcripts, lock down telephony and APIs. |
| Erasure when the purpose is served | Set retention periods for recordings, transcripts and logs, and delete on schedule. |
| Breach notification | Know how you would detect a leak of call data, and how you would notify the Data Protection Board and affected callers. |
| Rights of data principals | Be able to find, export, correct or delete a caller’s data across recordings, transcripts and CRM entries. |
The stakes are significant. The Schedule to the Act sets penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for failing to notify a breach as required.
Your AI providers are part of your data flow
In a typical AI call, audio goes to a speech-to-text provider, text goes to an LLM provider, and replies go to a text-to-speech provider. Each of them processes personal data on your behalf. Under the Act, you as the data fiduciary remain responsible, and you may engage a processor only under a valid contract.
Practical steps:
- Map every provider that touches call audio or text, including the voice platform itself.
- Check where each processes and stores data, and whether they retain or use it for training.
- Put contracts in place that cover security, retention and deletion.
- Reduce the number of providers that see raw data. Self-hosting speech recognition, for example, keeps audio inside your network so only text leaves it.
On cross-border transfers, the Act takes a negative-list approach: transfers are permitted except to countries the Government restricts. It also preserves sector laws that offer a higher degree of protection, which matters if your regulator has stricter localisation rules.
Consent and notice on a phone call
A phone call is not a web form, so notice has to be short and spoken. A practical pattern many organisations use:
- A one-sentence opening: who is calling, that it is an automated assistant, that the call is recorded, and why.
- A pointer to the full notice: “Our privacy notice is on our website, and we will send it to you by SMS.”
- An easy way to decline or reach a person.
- A record of what notice was given on each call, kept with the call log.
Whether consent is the right legal basis, or whether another ground applies, depends on your use case. That is a question for your legal team.
Notes for hospitals
Hospitals process some of the most sensitive information there is. For AI voice agents in healthcare:
- Keep the agent’s scope administrative: bookings, reminders, timings. Avoid discussing clinical details on calls.
- For calls about children, remember that the Act requires verifiable parental consent for processing a child’s personal data.
- Restrict who can access call recordings and transcripts, and log that access.
- Consider keeping recordings and transcripts on hospital infrastructure.
Our guide to AI voice agents for healthcare covers the operational side.
Notes for banks and financial services
Banks and NBFCs work under the DPDP Act plus their sector regulator’s rules. For voice AI:
- Check your regulator’s requirements on outsourcing, data storage and customer communication alongside DPDP.
- Use the 1600 number series for service and transaction calls, as TRAI requires for BFSI entities.
- Never let the bot ask for or repeat OTPs, PINs or full card numbers.
- Keep an auditable record of what the bot said on each call, especially for collections and payment reminders.
The customer service side of this is covered in our post on AI voice bots for customer service.
A DPDP readiness checklist for AI voice agents
- Map the data: what each call collects, where it flows, where it is stored.
- Write the spoken notice and the full notice.
- Minimise what the bot receives from your systems.
- Review every AI provider’s processing location, retention and contract.
- Set retention periods and automate deletion.
- Lock down access to recordings, transcripts and logs.
- Prepare a breach response plan that covers call data.
- Make sure you can find and delete one caller’s data on request.
How VEXYL fits
VEXYL is designed so Indian organisations can keep call data under their own control. The VEXYL platform runs self-hosted on your servers, so recordings, transcripts, conversation logs and cost records stay in your network. You bring your own AI provider keys, so you choose which providers see data and can switch them. With the open-source VEXYL-STT and VEXYL-TTS, speech can be processed on your own servers too. Our guide to self-hosted AI voice agents explains the options, and self-hosted vs cloud voice AI compares the trade-offs. If you prefer a managed service, VEXYL Cloud is available, and the same data mapping questions apply.
Software does not make you compliant on its own. It gives you the control to implement the policies your legal team sets.
FAQ
Does the DPDP Act apply to AI voice agents?
Yes. Voice agents process digital personal data, such as phone numbers, recordings and transcripts, so the Act and Rules apply to how you collect, use, store and share that data.
Is a call recording personal data under the DPDP Act?
A recording of an identifiable person, or one linked to their phone number, is generally treated as personal data. Confirm how it applies to your case with legal counsel.
Are AI providers like STT and LLM vendors data processors?
When they process personal data on your behalf, they typically act as data processors. You remain responsible as the data fiduciary and should have contracts in place with each.
Do I need to store AI call data in India?
The Act allows transfers except to countries the Government restricts, but sector regulators may require stricter localisation. Many organisations keep call data on Indian or on-premise infrastructure to simplify compliance.
What are the penalties under the DPDP Act?
The Schedule sets maximum penalties by type of breach, up to ₹250 crore for failing to take reasonable security safeguards. The Data Protection Board decides penalties case by case.
Need AI voice agents that keep call data on your own servers? Talk to the VEXYL team about a self-hosted deployment.