Call recording and consent for Indian businesses

Two separate questions

People collapse these into one and then get confused. Recording a call and keeping what is in it are governed differently.

The first is about interception, and the circumstances in which a conversation may be recorded at all. The second is about personal data: once you hold a recording of somebody talking, you are holding personal data about them, and that brings obligations regardless of how lawfully you captured it.

A business can be entirely fine on the first question and exposed on the second, which is the more common failure.

What the DPDP Act 2023 changed

India’s Digital Personal Data Protection Act 2023 moved the second question onto a clearer footing. It is built around consent that is free, specific, informed and unambiguous, given for a stated purpose, with a notice explaining what you are collecting and why.

For call recording the practical consequences are fairly direct. The caller should be told before the recording starts, told what it is for, and able to reach somebody about it afterwards. You should keep it only as long as the stated purpose requires. And you must be able to act on a request to see it or delete it, which in practice means knowing where all of it is.

The Act also requires a published privacy notice and a named grievance officer as the point of contact for complaints. A business recording calls with neither is not in a defensible position.

• Disclose before recording, not afterwards.
• State the purpose, in terms a caller would recognise.
• Keep recordings only as long as that purpose needs.
• Be able to find and delete one caller’s data on request.
• Publish a privacy notice and a named contact for complaints.

Why disclosure is the practical standard

Whatever the precise legal threshold, an audible disclosure at the start of the call is the sensible default, and it is what serious operators do.

It gives the caller the information before anything is captured, it demonstrates the consent was informed rather than assumed, and it removes the argument about whether the caller knew. It also costs about three seconds.

The alternative — recording quietly and relying on a policy nobody reads — is technically arguable and reputationally indefensible. The question is not whether you could win that argument. It is whether you want to have it with a customer.

Where this is genuinely unsettled

Enforcement practice under the DPDP Act is still developing, and rules made under it continue to fill in detail. Anyone telling you the position is entirely settled is overstating it.

Two areas are worth watching in particular: how consent obtained through a spoken disclosure at the start of a call is treated in practice, and what retention periods are considered proportionate for recordings kept for quality or training. Both are the kind of thing clarified by guidance or by the first enforcement action rather than by reading the statute.

This is background for a business owner deciding how to run their phone line. It is not legal advice, and if you are recording at scale or handling anything sensitive, it is worth an hour of a lawyer’s time.