If your business records customer calls, you may have seen posts saying that all DPDP requirements begin on 13 November 2026. That is not quite right.
The November date is mainly about Consent Managers. The main DPDP duties for businesses that handle personal data, including call recordings, are scheduled to begin on 13 May 2027.
In simple terms, 13 November 2026 is not a deadline for every business to stop recording calls or change its phone system. This guide explains what DPDP call recording consent means, what changes on each date, and how your team can prepare.
DPDP Rules timeline: the key dates
The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 will take effect in stages.
| Date | What starts | What it means for businesses |
| 13 November 2025 | Foundational provisions, including definitions and parts of the Data Protection Board framework | The DPDP framework has started, but most duties for businesses that record calls are scheduled for a later phase. |
| 13 November 2026 | Rule 4 on Consent Managers and related provisions of the Act | Individuals can use registered Consent Managers to manage consent. This is not a new call-recording deadline for every business. |
| 13 May 2027 | Main duties covering processing, notice, consent, security, data breaches, retention and individual rights | This is the main date for businesses that store or use identifiable call recordings and transcripts. |
The government’s explainer on the DPDP Rules, 2025 describes this 18-month phased timeline.
What changes on 13 November 2026?
Rule 4 sets out how eligible organisations can register as Consent Managers. A Consent Manager gives people a way to give, review or withdraw consent through one service.
If your company simply records customer calls, you do not need to register as a Consent Manager. The November date also does not mean you must switch off call recording or add a new announcement that day.
The DPDP Act does not ban business call recording. However, other laws, telecom requirements, contracts or sector-specific rules may already apply to your business. The DPDP transition period does not pause those requirements.
How does DPDP apply to call recordings?
1. A call recording can contain personal data
A digital recording may include information about an identifiable caller, such as their voice, name, phone number, account details or what they say. A transcript, summary or AI-generated call score may also be personal data if it can be linked to that person.
Recording, saving, listening to, transcribing, analysing or sharing a call with a service provider are all forms of data processing. Your business is generally the Data Fiduciary because it decides why and how the recording is used. A telephony, CRM or AI provider may be a Data Processor when it handles the recording for you.
Call recordings can support service reviews, staff coaching and dispute handling. Each use should match the purpose explained to the caller. Read more about how businesses use call recordings.
2. Consent is not the only possible legal ground
The Act allows personal data to be processed for a lawful purpose based on consent or certain legitimate uses listed in the Act. One listed use covers data that a person voluntarily provides for a specific purpose, if they have not said they do not agree.
This does not mean every customer call automatically qualifies. The right ground depends on why the caller shared the information and how your business plans to use the recording. Do not assume that staying on the line means the caller has agreed to every use.
3. If you rely on consent, capture a clear choice
The Act says consent must be free, specific, informed and clear. It must include a clear affirmative action. A message that only says “tell us if you object” may not show that the caller actively agreed.
Explain what you record and why. If you rely on consent, give callers a clear way to agree and explain what option is available if they decline. Make it easy to withdraw consent later.
A short IVR message can tell callers that recording is taking place. It may not include all the information required in the full notice, so consider also sharing a clear privacy notice through an accessible channel.
4. What about recordings collected before May 2027?
The Act has a transition provision for personal data that a person consented to share before the main provisions begin. In that case, the business should provide the required notice as soon as reasonably practical. It may continue processing the data until the person withdraws consent.
This does not mean businesses can keep every old recording forever. Keep recordings only for as long as they are needed for their purpose or must be kept under another law. Review whether your current notices and consent records match how you use the recordings.
7 steps to prepare your call recordings before May 2027
1. List where recordings and transcripts are stored
Make a list of every place that stores call audio, transcripts, summaries or call analytics. Include your phone system, CRM, quality-monitoring tools, AI services and agents’ devices. A transcript may need the same care as the recording if it identifies the caller. See what a voicemail transcript is.
2. Write down why each team records calls
Note the purpose for each team. For example, a support team may record calls to resolve customer issues, while a quality team may use recordings for coaching and quality monitoring. Check the legal ground for each purpose. Avoid using a broad phrase such as “business purposes” for unrelated uses.
3. Review your notice and caller choices
Tell callers what is recorded and why. If consent is your legal ground, design a clear way for callers to agree. Also decide what happens if they decline, where your service can support an alternative.
If you use AI to transcribe or analyse calls, explain what the tool does and why. Review a separate use, such as training an AI model, on its own with your legal adviser.
4. Record only calls you need
Turn off recording for teams or call types that do not need it. Here is how call recording settings work on a cloud phone system. Consider pausing recording when callers share payment details or other information that is not needed for the stated purpose.
5. Set a retention and deletion period
The DPDP framework does not set one fixed retention period for every business call. Decide how long each type of recording is needed, check any other legal retention requirements, and delete recordings when they are no longer needed. Automate deletion where possible and document any legal holds.
6. Limit access and secure recordings
Give access only to staff who need recordings for their work. Use access controls, audit logs and secure storage, and follow these security measures for cloud telephony systems. Review how recordings are accessed through softphones and other devices. These softphone security tips can help reduce avoidable exposure.
7. Check vendors and prepare for customer requests
Review your agreements with phone, CRM and AI providers. Confirm who can access recordings, where they are stored, how they are protected, and how they can be returned or deleted.
Also decide how your team will find a caller’s data, handle a request to withdraw consent or erase data, and report a data breach when required.
Sample call-recording message
Before connecting the caller, you could say:
“We’d like to record this call to help improve our service. If you’re okay with that, press 1. If you’d prefer not to be recorded, press 2 to [explain what happens next].”
If you use AI to make a transcript, add:
“We may also use an automated tool to turn this call into text for [specific purpose].”
Replace the bracketed text with the option your business actually offers. Share your full privacy notice through an accessible channel too. Have a legal adviser review the final wording, and make sure the caller’s choice is recorded.
How CallerDesk can help
CallerDesk lets businesses add announcements to an IVR, choose which teams record calls, and control who can access recordings. These features can help teams organise recording settings and review call activity.
CallerDesk does not decide your legal ground or guarantee DPDP compliance. Your business still needs to decide why it records calls, share the right notice, manage consent or other lawful ground, set retention periods and review vendor arrangements.
Review your business calling process with CallerDesk. Book a CallerDesk demo.
Conclusion
The 13 November 2026 date is mainly about Consent Managers. For most businesses that record calls, the main DPDP duties are scheduled to begin on 13 May 2027. Use the time before then to list your recordings, confirm why you use them, improve notices and consent choices, set deletion periods, limit access and review vendors. Consent is not the only ground in the Act, but a caller’s silence should not be treated as consent. Start with a clear review of your current process, then ask a legal adviser to check the final approach. CallerDesk can help manage IVR announcements, recording settings and access.
