DPDP Act 2023: Consent Rules Every Voice AI Deployment Must Follow
Every recorded outbound call your voice AI places processes personal data, so India's Digital Personal Data Protection Act, 2023 applies in full. Consent must be free, specific, informed, unconditional and unambiguous, backed by an itemised notice, purpose limitation, and an easy right to withdraw — with the DPDP Rules, 2025 now setting the operational detail.
This is an explainer, not legal advice. For obligations specific to your deployment, consult a qualified advisor and the official text.
The Digital Personal Data Protection Act, 2023 (DPDP Act) was enacted by Parliament on 11 August 2023, and the Digital Personal Data Protection Rules, 2025 (DPDP Rules) were notified on 14 November 2025, marking full operationalisation of the framework (PIB, 2025). For any Banking, Financial Services and Insurance (BFSI) team running a recorded outbound calling deployment — reminders, collections, onboarding — every call captures a phone number, a voice recording and often account context. That is personal data, so DPDP consent rules apply directly.
Who Does the DPDP Act Make Responsible?
The Act defines two roles that decide every obligation (DPDP Act, 2023).
- Data Principal — the individual the data is about. For a lender or insurer, that is the customer, borrower or guarantor being called.
- Data Fiduciary — the entity that decides the purpose and means of processing. That is your organisation. A voice AI vendor typically acts as a data processor under your instructions.
Why does this matter for a voice AI deployment? Because the Data Fiduciary carries the legal accountability — you cannot contract it away to a vendor. Your organisation remains answerable for consent, notice, security and breach reporting, across all seven principles the Act sets: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards, and accountability (PIB, 2025).
What Does "Valid Consent" Actually Mean Under Section 6?
Section 6(1) of the DPDP Act sets the bar precisely: "The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action" (DPDP Act, 2023). Consent is also limited to the personal data necessary for the specified purpose.
For a recorded calling deployment, that translates into concrete design choices:
- Free — consent cannot be bundled or coerced; a customer must be able to decline calls without losing an unrelated service.
- Specific — consent to be called for loan servicing is not consent to cross-sell a new product.
- Informed — it must follow a clear notice (see below).
- Clear affirmative action — a pre-ticked box or silence is not consent.
How Should the Notice Work Before You Call?
Section 5 requires a notice before or alongside seeking consent, describing the personal data to be collected and the purpose of processing, and telling the individual how to exercise their rights and how to complain to the Data Protection Board. The DPDP Rules add that Data Fiduciaries must issue standalone, clear and simple consent notices in plain language that transparently explain the specific purpose (PIB, 2025).
A compliant opening on a recorded call makes the notice audible, for example:
"Namaste. Yeh call [Company] ki taraf se hai. Aapki loan EMI ke reminder ke liye hum aapko call kar rahe hain, aur yeh call record ho raha hai. Kya aap aage badhna chahenge?"
Consent Must Be As Easy to Withdraw As to Give
The Act gives the Data Principal the right to withdraw consent at any time, with the ease of withdrawing comparable to the ease with which consent was given (DPDP Act, 2023). In practice, your calling stack needs a working opt-out — a keypress or spoken instruction — that immediately updates the do-not-call state and stops further processing. Our guide on ensuring voice AI compliance with RBI guidelines shows where these checkpoints sit in a calling workflow.
The Voice AI Consent Checklist
Use this table as a working map from DPDP requirement to a control in your deployment.
DPDP requirement | What your voice AI deployment must do |
|---|---|
Notice (Section 5) | Play a plain-language notice stating who is calling, what data is used, the purpose, and that the call is recorded |
Valid consent (Section 6) | Capture free, specific, informed, unconditional, unambiguous consent through a clear affirmative action |
Purpose limitation | Use the number and recording only for the stated purpose; never silently repurpose for marketing |
Data minimisation | Collect only fields the call needs; avoid capturing surplus personal data |
Right to withdraw | Provide an opt-out at least as easy as the original consent, and honour it immediately |
Storage limitation | Erase recordings and transcripts once the purpose is served and no legal retention applies |
Security safeguards | Encrypt recordings, restrict access, and log who can hear them |
Breach reporting | Inform affected individuals and the Data Protection Board in the prescribed manner |
When Can You Call Without Separate Consent?
Section 7 recognises certain legitimate uses, where personal data may be processed without a fresh, separate consent — including data an individual has voluntarily provided for a specified purpose. If a borrower shared their number specifically for loan servicing, servicing calls may fall within that purpose. But the boundary is narrow: the moment a call drifts into promotion, the legitimate-use basis no longer covers it — so refer to the official text for your exact scenario. Promotional calling is also governed separately by telecom rules, as our explainer on ensuring AI compliance and ethics in India sets out.
What Extra Rules Apply to Children and Sensitive Cohorts?
Section 9 requires verifiable consent of a parent or lawful guardian before processing the personal data of a child (an individual below eighteen), and prohibits processing likely to cause a detrimental effect on the well-being of a child, along with tracking, behavioural monitoring and targeted advertising directed at children (DPDP Act, 2023). The DPDP Rules confirm verifiable consent for children, with limited exemptions for essential purposes such as healthcare and education (PIB, 2025). For most BFSI calling this means age-gating and routing minors out of automated flows.
Consent Managers — entities that help individuals give, manage, review and withdraw consent — must be Indian companies under the DPDP Rules, which also set an 18-month phased compliance timeline and require Data Fiduciaries to answer access, correction and erasure requests within a maximum of 90 days (PIB, 2025).
What Happens If You Get Consent Wrong?
The Act's Schedule provides monetary penalties, including up to ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach (DPDP Act, 2023). Penalties are decided by the Data Protection Board, which the Rules establish as a digital-first institution. Building consent into the call flow is far cheaper than remediating later.
How AI Helps Voice Deployments Stay Consent-Ready
A well-designed voice AI platform makes consent auditable rather than assumed. YuVoice plays a scripted notice at the start of each call, records the customer's affirmative consent and any opt-out, and stamps every recording with the purpose it was collected for — so purpose limitation is enforced by the system, not an agent's memory. Withdrawal instructions update the do-not-call state instantly, encrypted recordings carry retention timers, and every interaction is logged. That makes consent, notice and withdrawal demonstrable on demand — exactly what a Data Fiduciary needs to evidence. See our guide on achieving 100% call compliance in BFSI with AI.
FAQ
Does the DPDP Act apply to a voice bot that only makes reminder calls? Yes. A reminder call still processes a phone number, a voice recording and usually account context — all personal data. The Act applies whenever personal data is processed by automated means, so notice, a lawful basis (consent or a legitimate use) and security safeguards all apply.
Is recording a call allowed under the DPDP Act? The Act does not ban recording, but the recording is personal data. You must give notice that the call is recorded, have a lawful basis, use it only for the stated purpose, secure it, and delete it once the purpose is served. Refer to the official text for your use case.
Can we rely on consent collected at onboarding for later calls? Only if that consent was specific to the purpose of the later calls and followed a clear notice. Consent for loan servicing does not automatically extend to marketing calls. When in doubt, seek fresh, purpose-specific consent.
When do the DPDP Rules 2025 take full effect? The Rules were notified on 14 November 2025 and provide an 18-month phased compliance timeline (PIB, 2025). Obligations are being operationalised over that window, so track the official notifications.
What must happen when a customer withdraws consent mid-call? It must be honoured immediately and be as easy as giving consent was. Your system should stop processing for that purpose, update the preference, and prevent further calls of that type unless a separate lawful basis exists.
Who is liable if our voice AI vendor mishandles data — us or the vendor? As the Data Fiduciary, your organisation carries the primary accountability. The vendor is typically a data processor acting on your instructions. Strong contracts and controls matter, but they do not transfer the legal obligation away from you.
Conclusion
DPDP consent is not a checkbox — for voice AI it is a design principle running through the notice you play, the affirmative consent you capture, the purpose you lock recordings to, and the opt-out you honour on the spot. Teams that build these controls into the call flow now will move through the Rules' phased timeline with far less friction than those retrofitting later.
Build a consent-ready voice AI deployment. Talk to the YuVerse team to see how YuVoice makes consent and notice demonstrable on every call.
References
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) — https://www.indiacode.nic.in/bitstream/123456789/22037/1/a2023-22.pdf
- PIB — Government notifies DPDP Rules to empower citizens and protect privacy (14 Nov 2025) — https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014
