DPDP Compliance Checklist 2027 for Call Centers, Telecalling, WhatsApp & SMS Teams

Under the Digital Personal Data Protection Act 2023 (DPDP Act), any business that collects leads and calls, messages or records customers must give a clear notice, take valid consent (or rely on a legal “legitimate use”), protect the data, report breaches and honour customer rights. The main duties apply from 13 May 2027. Consent Manager rules start on 13 November 2026. Penalties go up to ₹250 crore per breach category.

Key takeaways

• The DPDP Rules 2025 were notified on 13 November 2025, and most business duties apply from 13 May 2027.
• If your team stores names, phone numbers, call recordings or lead-form data, the DPDP Act applies to you.
• Your telephony, CRM and dialer vendors usually act as Data Processors. You need a written contract with each of them.
• DPDP does not replace TRAI rules. Marketing calls and SMS must still follow DLT, number-series and consent rules.
• The highest penalty, up to ₹250 crore, is for failing to take reasonable security safeguards that leads to a data breach.

Key dates

Milestone	Date	What it means for sales and support teams
DPDP Act passed	August 2023	The law exists, but most duties need the Rules to start
DPDP Rules 2025 notified (G.S.R. 846(E))	13 November 2025	Data Protection Board of India set up; the 18-month countdown begins
Consent Manager rules (Rule 4) apply	13 November 2026	Registered Consent Managers can start operating; customers may manage consent through them
Main obligations apply (Rules 3, 5–16, 22, 23)	13 May 2027	Notice, consent, security, breach reporting, retention and rights requests become enforceable

As of 30 October 2026. The 13 May 2027 date is 18 months after notification; please confirm against the Gazette.

What is the DPDP Act?

DPDP stands for Digital Personal Data Protection. The DPDP Act 2023 is India’s law on how organisations collect, use, store and delete digital personal data. The Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules 2025 on 13 November 2025 to put the Act into practice. The Data Protection Board of India enforces it.

In short:

• It applies to personal data in digital form, and to paper data that is later digitised.
• It gives people (Data Principals) rights over their data.
• It puts duties and penalties on businesses (Data Fiduciaries) that decide why and how data is used.

Does the DPDP Act apply to your call center or sales team?

Yes, if your team collects or uses personal data of customers or leads in digital form. For almost every Indian call centre, telecalling team or WhatsApp/SMS team, this means the DPDP Act applies from 13 May 2027.

The Act applies to you if your team:

• collects leads through website forms, Facebook or Google ads, IVR or missed-call numbers,
• stores names, mobile numbers, emails, addresses or enquiry details in a CRM or dialer,
• records calls, transcribes them or scores them with AI,
• sends WhatsApp messages or SMS to customers,
• buys or rents calling lists from vendors.

The Act does not cover personal data used by an individual for purely personal or domestic purposes. It also does not cover personal data that a person has made publicly available themselves. The government can exempt certain classes of businesses, such as startups, through a notification. Do not assume an exemption applies to you unless it is notified.

Example: A Noida real-estate firm runs Facebook lead ads, pushes the leads into a CRM and has 12 telecallers calling them. Every step, from form to call recording, is covered.

DPDP terms explained for calling teams

The DPDP Act uses a few legal terms. Here is what they mean for a typical sales or support team.

Term	Plain meaning	Call-centre example
Data Principal	The person whose data it is	The lead who filled your enquiry form
Data Fiduciary	The business that decides why and how data is used	Your company running the campaign
Data Processor	A vendor that processes data on your behalf	Your cloud telephony, CRM, dialer or WhatsApp API provider
Consent	A clear “yes” from the person for a specific purpose	The lead ticks “I agree to receive calls about this property”
Consent Manager	A registered Indian company that lets people give, review and withdraw consent on one platform	A future dashboard where a customer withdraws consent for your marketing calls
Significant Data Fiduciary (SDF)	A business notified by the government because of the volume or sensitivity of the data it handles	A large lender or insurer handling crores of records
Personal data breach	Any unauthorised access, sharing, loss or destruction of personal data	A telecaller exports the full lead list to a personal Gmail account

The DPDP compliance checklist for call centres and telecalling teams

This checklist turns the DPDP Act and Rules into actions for teams that collect leads and call, message or record customers. Each item has a suggested owner. Aim to complete it before 13 May 2027.

Lead collection and privacy notices

1. ☐ Map every lead source: website forms, landing pages, ads, IVR, missed-call numbers and walk-ins. (Marketing head). You cannot protect data you have not listed.
2. ☐ Show a short notice at every lead form listing what data you collect and why. (Marketing). Rule 3 requires an itemised, plain-language notice.
3. ☐ Add a link to your full privacy notice on forms, IVR menus and WhatsApp greetings. (Marketing + Legal). The notice must explain how to withdraw consent and how to complain.
4. ☐ Collect only what you need for the enquiry. (Sales head). Do not ask for date of birth or income if you only need a call-back.
5. ☐ Tell missed-call and IVR callers how their number will be used, through an SMS or WhatsApp follow-up with the notice link. (Ops head). A missed call is not consent for marketing.
6. ☐ Publish a contact person for privacy queries (a DPO, if applicable). (Legal). Rule 9 requires business contact details to be published.

Consent for calls, WhatsApp and SMS

1. ☐ Use separate, unticked checkboxes for calls, WhatsApp and SMS. (Marketing). Consent must be specific and given by a clear action, not by a pre-ticked box.
2. ☐ Write consent text in simple language, and in the lead’s language where possible. (Marketing). Consent must be informed and easy to understand.
3. ☐ Store a consent record for every lead: source, time, text shown and channel. (CRM admin). You must be able to prove consent if challenged.
4. ☐ Make withdrawal as easy as giving consent: an opt-out keyword, IVR option or link. (Ops head). The Act requires withdrawal to be comparably easy.
5. ☐ Stop calls and messages quickly after withdrawal and sync opt-outs across CRM, dialer and messaging tools. (CRM admin). An opt-out in one tool must reach all of them.
6. ☐ Identify where you rely on “legitimate uses” instead of consent, such as service calls for a product the customer bought. (Legal). Use this ground only where the Act allows it.
7. ☐ Send notices to existing leads and customers whose data you collected before the Act. (Marketing + Legal). Pre-existing consent needs a fresh notice.

Call recordings and transcripts

1. ☐ Treat recordings, transcripts and AI call scores as personal data. (Ops head). They identify the caller.
2. ☐ Follow your recording notice and retention rules. (Ops head). See our detailed guide on DPDP rules and call recording consent.

Calling lists, purchased data and data brokers

1. ☐ Stop using lists you cannot prove consent for. (Sales head). Bought or scraped lists usually have no valid consent for your business.
2. ☐ Ask list vendors for written proof of how consent was collected and for which purpose. (Procurement). You remain responsible as the Data Fiduciary.
3. ☐ Scrub every list against your opt-out list before each campaign. (CRM admin). It stops repeat calls to people who said no.
4. ☐ Check TRAI DND preferences (National Customer Preference Register) for promotional calls. (Ops head). TRAI rules apply alongside DPDP.

CRM, dialer and vendor contracts

1. ☐ List every vendor that touches lead data: telephony, CRM, dialer, WhatsApp API, SMS, AI transcription and BPO partners. (IT head).
2. ☐ Sign a data processing contract with each vendor. (Legal). The Act lets you engage a Data Processor only under a valid contract.
3. ☐ Confirm each vendor’s security safeguards and breach-reporting timelines. (IT head). You must report breaches even if they happen at the vendor.
4. ☐ Ensure vendors delete data when the contract ends or the purpose is over. (Legal).

Agent access control, security safeguards and audit logs

1. ☐ Give agents role-based access to only the leads they handle. (IT head). Least access reduces the impact of misuse.
2. ☐ Use number masking so agents do not see full customer numbers where they do not need to. (Ops head).
3. ☐ Block bulk export and personal-device downloads of lead data. (IT head).
4. ☐ Turn on encryption, access logs and backups. (IT head). Rule 6 names encryption, access control, log monitoring and backups as reasonable safeguards.
5. ☐ Remove access the same day an agent leaves. (HR + IT).
6. ☐ Train telecallers on what they can and cannot do with customer data. (Team leads).

Data retention and deletion

1. ☐ Set a retention period for leads, recordings and chats, based on purpose. (Legal + Ops). Keep data only as long as the purpose needs.
2. ☐ Keep processing logs for at least one year. (IT head). Rule 8 requires personal data, traffic data and logs to be retained for a minimum of one year for specified purposes.
3. ☐ Automate deletion of old, cold leads and expired recordings. (CRM admin).

Breach response plan

1. ☐ Write a breach response plan with named owners and phone numbers. (IT head + Legal).
2. ☐ Inform affected customers without delay after a breach. (Legal). Rule 7 requires intimation to each affected Data Principal.
3. ☐ Inform the Data Protection Board without delay, and send a detailed report within 72 hours of becoming aware of the breach (or longer if the Board allows). (Legal).
4. ☐ Run a mock breach drill once before May 2027. (IT head).

Customer rights requests

1. ☐ Set up one channel (email, form or WhatsApp) for access, correction, erasure and grievance requests. (Support head).
2. ☐ Resolve grievances within 90 days at most. (Support head). Rule 14 sets a period not exceeding 90 days.
3. ☐ Verify the requester’s identity before sharing or deleting data. (Support head).
4. ☐ Allow customers to nominate someone to exercise their rights. (Legal).

Children’s data (education and edtech)

1. ☐ Get verifiable parental consent before processing data of anyone under 18. (Admissions head). Rule 10 requires due diligence to confirm the parent is an adult.
2. ☐ Do not track or target children with behavioural advertising. (Marketing).

DPDP and TRAI: what changes for marketing calls, SMS and WhatsApp

DPDP and TRAI rules apply together. DPDP governs how you collect and protect personal data. TRAI’s Telecom Commercial Communications Customer Preference Regulations (TCCCPR) govern how you send commercial calls and SMS. WhatsApp also follows Meta’s own opt-in rules. You need to meet all three.

Channel	DPDP requirement	TRAI / DLT / Meta requirement	Practical step
Promotional calls	Notice + specific consent; easy withdrawal	Use the 140 series; respect DND; explicit consent valid for seven days unless TRAI directs otherwise	Keep consent records and call only from registered 140 numbers
Service / transactional calls	Notice; consent or legitimate use	Use the 1600 series	Separate service calls from sales calls in your dialer
Automated, AI or IVR outbound calls	Same as above; tell people when AI is used	Declare A2P (automated) calls and numbers to your telecom provider under the 2026 Third Amendment	Declare before you launch any robocall or AI-voice campaign
SMS	Notice + consent for promotional SMS	Register headers and templates on DLT; misused headers can be suspended within six hours	Audit DLT templates and remove unused headers
WhatsApp	Notice + consent; easy opt-out	Meta requires opt-in before you message customers	Capture WhatsApp opt-in separately on your forms

Read more: TRAI’s 2026 anti-spam rules, A2P calls explained, DLT registration in India and why business numbers get marked as spam.

Note on consent records: TRAI’s 2026 amendment recognises older (legacy) consent only if it was collected in a verifiable way and registered on the telecom provider’s platform. TRAI and the Reserve Bank of India are also piloting a Digital Consent Acquisition system with banks. An old Excel sheet of numbers is not proof of consent.

DPDP Act penalties

The Data Protection Board of India can impose penalties of up to ₹250 crore, depending on the breach. These limits come from the Schedule to the DPDP Act 2023.

Breach	Maximum penalty
Failure to take reasonable security safeguards to prevent a personal data breach	₹250 crore
Failure to inform the Board or affected people about a personal data breach	₹200 crore
Breach of additional obligations for children’s data	₹200 crore
Breach of additional obligations of a Significant Data Fiduciary	₹150 crore
Breach of any other provision of the Act or Rules	₹50 crore
Breach of a voluntary undertaking accepted by the Board	Up to the penalty for the original breach
Breach of duties by a Data Principal	₹10,000

90-day action plan before 13 May 2027

A 90-day plan gives a telecalling team enough time to fix forms, consent, vendors and security before 13 May 2027. Start no later than early February 2027. Starting now is safer.

Weeks	Actions	Owner
1–2	Map lead sources, data fields, tools and vendors; name a privacy owner	Ops head + IT head
3–6	Rewrite notices and consent checkboxes; set up consent records and opt-out sync; stop non-consented lists	Marketing + CRM admin
7–10	Sign vendor contracts; enable role-based access, masking, logs and export blocks; set retention and deletion rules	Legal + IT head
11–13	Launch a rights-request channel; write and test the breach plan; train all telecallers; run a final audit	Support head + Legal + Team leads

How CallerDesk supports DPDP-ready calling

We help sales and support teams run calls and messages in a more controlled way. CallerDesk offers role- and hierarchy-based login access [CONFIRM], IP-based login restriction [CONFIRM], number masking [CONFIRM], call recording controls [CONFIRM] and call logs and reports [CONFIRM]. We can also share our data processing terms for your vendor file [CONFIRM].

No tool makes you compliant on its own. Your notices, consent and processes matter just as much. To get started, download the printable DPDP checklist or book a compliance walkthrough with CallerDesk. Also see our guide on privacy-first compliance recording.

Frequently asked questions

What is the full form of DPDP?

DPDP stands for Digital Personal Data Protection. The Digital Personal Data Protection Act 2023 is India’s law on how businesses collect, use, store and delete digital personal data. The DPDP Rules 2025, notified on 13 November 2025, explain how the Act works in practice.

When does the DPDP Act come into force?

The DPDP Act comes into force in phases. The Rules were notified on 13 November 2025, when the Data Protection Board was set up. Consent Manager rules apply from 13 November 2026. The main business obligations, including notice, consent, security and breach reporting, apply from 13 May 2027.

Is the DPDP Act in force now?

Partly. As of 30 October 2026, the Data Protection Board and some foundational provisions are in force. Consent Manager rules start on 13 November 2026. Most duties for businesses, such as notice, consent and breach reporting, become enforceable on 13 May 2027.

Does the DPDP Act apply to small businesses?

Yes. The DPDP Act applies to any business that processes digital personal data, whatever its size. The government can exempt certain classes, such as startups, through a notification, but no business should assume an exemption unless it is officially notified for its category.

Do I need consent to call a lead under the DPDP Act?

In most cases, yes. For sales and marketing calls, you need specific, informed consent given by a clear action, plus a notice explaining why you will call. Some calls may rely on a “legitimate use” under the Act, and TRAI’s consent and DND rules also apply to promotional calls.

Is call recording allowed under the DPDP Act?

Yes, call recording is allowed if you have a valid legal ground, give proper notice and protect the recordings. Recordings and transcripts are personal data, so retention, access control and deletion rules apply. Our detailed guide on DPDP and call recording consent explains the steps.

Can I use purchased calling data after the DPDP Act?

Only if you can prove that valid consent was collected for your specific purpose. Most purchased or scraped calling lists cannot show this. As the Data Fiduciary, your business is responsible, so ask vendors for written proof or stop using such lists.

What is a Consent Manager under the DPDP Act?

A Consent Manager is a registered Indian company that offers a single, interoperable platform where people can give, manage, review and withdraw consent. Consent Manager rules apply from 13 November 2026. Businesses should be ready to receive consent and withdrawals through them.

Who is a Data Fiduciary and who is a Data Processor?

A Data Fiduciary is the business that decides why and how personal data is used, such as your company. A Data Processor processes data on your behalf, such as your telephony, CRM or dialer vendor. The Data Fiduciary stays responsible and needs a valid contract with each processor.

What is the penalty for violating the DPDP Act?

Penalties go up to ₹250 crore for failing to take reasonable security safeguards. Failing to report a breach can attract up to ₹200 crore. Most other breaches of the Act or Rules can attract up to ₹50 crore, as set out in the Schedule to the Act.

How is the DPDP Act different from TRAI DND/DLT rules?

The DPDP Act governs how you collect, use and protect personal data. TRAI’s rules govern how you send commercial calls and SMS, including DND preferences, DLT registration and the 140 and 1600 number series. Calling teams must follow both sets of rules at the same time.

DPDP Act vs GDPR: what is different for Indian call centers?

Both laws are built on notice, consent and individual rights. The DPDP Act covers only digital personal data, has fewer legal grounds than the GDPR, uses fixed penalty limits of up to ₹250 crore, and works alongside TRAI’s calling rules, which Indian call centres must also follow.