DPDP Act and call recordings: what compliance heads need to do now

Last week’s issue ended on the silences — the gaps on a collections call that tell your QA programme more than the words do. There is a harder conversation sitting right behind that one. The recordings that capture those silences: does your operation still have the right to keep them?

The Digital Personal Data Protection Act changed the answer. Most collections and lending floors have not caught up.

What DPDP says about your recordings

The DPDP Act was enacted in August 2023; the Rules were notified by MeitY on 13 November 2025. The result is a phased schedule most operations have treated as a future problem — though the clock has been running for more than three years.

Four provisions in the Act and Rules bear directly on call recordings.

Purpose limitation. The purpose must be specified before collection, and the data processed only for that purpose. A recording taken for loan servicing cannot later train a speech model, surface in a different borrower’s dispute, or sit in storage “just in case.”

Consent. Consent must be free, specific, informed, unambiguous, and in plain language — and it must cover both the recording itself and what the recording will be used for. It must be obtained before processing begins.

Retention. The Act sets no fixed period. It says personal data may not be kept beyond what the purpose requires. An inherited “seven years” that nobody revisited when DPDP passed is not a retention policy your floor can defend.

Data subject rights. A borrower is now a Data Principal, with rights to access, correction and erasure. Erasure is the one that bites: it requires a workflow that can find the recording, test whether a legal retention obligation overrides the request, and respond within the prescribed timeline.

The obligations arrive in stages. Phase 2 — the consent-manager framework — lands 13 November 2026, just over eight weeks from today. Phase 3 — full data-fiduciary obligations — lands 13 May 2027. From that date the four provisions above are not aspirational compliance; they are the operating standard.

Three gaps most floors carry

These are structural patterns, not measured figures. If your floor has been running more than two or three years, you are likely carrying at least two of the three.

Gap one: retention schedules inherited from before DPDP. Most floors run a period borrowed from RBI loan-documentation guidance, or no formal policy at all. DPDP does not abolish sector-specific retention rules — an RBI, IRDAI or SEBI obligation can still override an erasure request. But the override has to be documented and specific. A blanket seven years applied to every call regardless of content is not an override; it is an undifferentiated policy.

Gap two: consent that arrives after the recording starts. On most older deployments the “this call may be recorded” notice plays after the agent is connected — sometimes after identity verification is already done. That sequence is backwards: consent must precede collection. If recording begins before the caller has had any opportunity to object, the consent architecture is non-compliant on its face.

Gap three: no deletion workflow. The erasure right comes with a response obligation. Few floors can link an inbound request to a borrower’s recordings across on-premise, cloud archive and backup, then respond in time. The gap is not theoretical — it is the absence of a process the Act requires to exist.

What enforcement looks like

The Act prescribes penalties of up to ₹250 crore per violation. That figure is stated in the Schedule to the Act.

The body that would impose it is not yet in a position to. The Data Protection Board was established in law on 13 November 2025 but still has no appointed Chairperson and no Members; MeitY invited applications on 6 May 2026, and selection sits with a committee chaired by the Cabinet Secretary. Until those appointments are made, the Board cannot convene, hear a party, or sign an order.

That is not breathing room. The adjudicator is not yet seated; the obligations arrive on a fixed schedule regardless. Floors that read the gap as a deadline extension will meet Phase 3 with the architecture they have today.

The second enforcement mechanism is already live, and it is contractual. The lender is the data fiduciary; the outsourced floor is the data processor, a term the Act explicitly recognises. A fiduciary’s obligations do not stop at its own wall — they flow downstream to every processor it instructs. Lenders that have updated their vendor frameworks already require DPDP representations — consent architecture, retention policy, deletion workflow — as a condition of continued engagement. This is Issue 13’s outsourcing economics applied to data protection: the cost of non-compliance is borne first by the lender, and the lender is watching.

Six-point DPDP readiness checklist for call recordings

Checks to run on your own operation. No vendor involvement required.

1. Purpose statement. Is the purpose written down, specific, and communicated before recording begins? If it covers only “quality monitoring,” check whether training, dispute resolution or analytics are happening without a separate consent basis.

2. Consent sequencing. Map the IVR tree. Confirm the notice precedes both the agent connection and any data collection. If it plays after the agent joins, the sequence needs redesign.

3. Retention schedule audit. For each period in your current policy, document the regulatory or business basis. Where that basis is a general lending-documentation rule, confirm it applies to audio specifically and not only to loan account documents.

4. Erasure request intake. Is there a documented process, and has it been tested end-to-end — intake, record identification, retention-override assessment, response? If not, this is the build priority before Phase 3.

5. Processor-to-fiduciary disclosures. Review your lender contracts. Identify which now require DPDP representations, and whether your consent architecture, retention policy and deletion workflow can support them honestly.

6. Data Principal rights log. Start logging access, correction and erasure requests now, even informal ones. When the Board is seated, a log with imperfect entries is a far better position than no log at all.

---

One disclosure, same as always: The Heartbeat audits collections calls and advises on compliance operations, which means DPDP readiness is the kind of work this argument points toward. The checklist above is designed so you can complete it yourself. If the gaps it surfaces are structural enough that outside support makes sense, you know where to find us.