{"id":6227,"date":"2026-10-30T12:40:40","date_gmt":"2026-10-30T07:10:40","guid":{"rendered":"https:\/\/callerdesk.io\/blog\/?p=6227"},"modified":"2026-10-30T12:40:43","modified_gmt":"2026-10-30T07:10:43","slug":"dpdp-compliance-checklist-2027","status":"publish","type":"post","link":"https:\/\/callerdesk.io\/blog\/dpdp-compliance-checklist-2027\/","title":{"rendered":"DPDP Compliance Checklist 2027 for Call Centers, Telecalling, WhatsApp &amp; SMS Teams"},"content":{"rendered":"\n<p>Under the Digital Personal Data Protection Act 2023 (DPDP Act), any business that collects leads and calls, messages or records customers must give a clear notice, take valid consent (or rely on a legal &#8220;legitimate use&#8221;), protect the data, report breaches and honour customer rights. The main duties apply from 13 May 2027. Consent Manager rules start on 13 November 2026. Penalties go up to \u20b9250 crore per breach category.<\/p>\n\n\n\n<p>Key takeaways<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The DPDP Rules 2025 were notified on 13 November 2025, and most business duties apply from 13 May 2027.<\/li>\n\n\n\n<li>If your team stores names, phone numbers, call recordings or lead-form data, the DPDP Act applies to you.<\/li>\n\n\n\n<li>Your telephony, CRM and dialer vendors usually act as Data Processors. You need a written contract with each of them.<\/li>\n\n\n\n<li>DPDP does not replace TRAI rules. Marketing calls and SMS must still follow DLT, number-series and consent rules.<\/li>\n\n\n\n<li>The highest penalty, up to \u20b9250 crore, is for failing to take reasonable security safeguards that leads to a data breach.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Key dates<\/strong><\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>Milestone<\/td><td>Date<\/td><td>What it means for sales and support teams<\/td><\/tr><tr><td>DPDP Act passed<\/td><td>August 2023<\/td><td>The law exists, but most duties need the Rules to start<\/td><\/tr><tr><td>DPDP Rules 2025 notified (G.S.R. 846(E))<\/td><td>13 November 2025<\/td><td>Data Protection Board of India set up; the 18-month countdown begins<\/td><\/tr><tr><td>Consent Manager rules (Rule 4) apply<\/td><td>13 November 2026<\/td><td>Registered Consent Managers can start operating; customers may manage consent through them<\/td><\/tr><tr><td>Main obligations apply (Rules 3, 5\u201316, 22, 23)<\/td><td>13 May 2027<\/td><td>Notice, consent, security, breach reporting, retention and rights requests become enforceable<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><em>As of 30 October 2026. The 13 May 2027 date is 18 months after notification; please confirm against the Gazette.<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What is the DPDP Act?<\/strong><\/h2>\n\n\n\n<p>DPDP stands for Digital Personal Data Protection. The DPDP Act 2023 is India&#8217;s law on how organisations collect, use, store and delete digital personal data. The Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules 2025 on 13 November 2025 to put the Act into practice. The Data Protection Board of India enforces it.<\/p>\n\n\n\n<p>In short:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>It applies to personal data in digital form, and to paper data that is later digitised.<\/li>\n\n\n\n<li>It gives people (Data Principals) rights over their data.<\/li>\n\n\n\n<li>It puts duties and penalties on businesses (Data Fiduciaries) that decide why and how data is used.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Does the DPDP Act apply to your call center or sales team?<\/strong><\/h2>\n\n\n\n<p>Yes, if your team collects or uses personal data of customers or leads in digital form. For almost every Indian call centre, telecalling team or WhatsApp\/SMS team, this means the DPDP Act applies from 13 May 2027.<\/p>\n\n\n\n<p>The Act applies to you if your team:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>collects leads through website forms, Facebook or Google ads, IVR or missed-call numbers,<\/li>\n\n\n\n<li>stores names, mobile numbers, emails, addresses or enquiry details in a CRM or dialer,<\/li>\n\n\n\n<li>records calls, transcribes them or scores them with AI,<\/li>\n\n\n\n<li>sends WhatsApp messages or SMS to customers,<\/li>\n\n\n\n<li>buys or rents calling lists from vendors.<\/li>\n<\/ul>\n\n\n\n<p>The Act does not cover personal data used by an individual for purely personal or domestic purposes. It also does not cover personal data that a person has made publicly available themselves. The government can exempt certain classes of businesses, such as startups, through a notification. Do not assume an exemption applies to you unless it is notified.<\/p>\n\n\n\n<p>Example: A Noida real-estate firm runs Facebook lead ads, pushes the leads into a CRM and has 12 telecallers calling them. Every step, from form to call recording, is covered.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>DPDP terms explained for calling teams<\/strong><\/h2>\n\n\n\n<p>The DPDP Act uses a few legal terms. Here is what they mean for a typical sales or support team.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>Term<\/td><td>Plain meaning<\/td><td>Call-centre example<\/td><\/tr><tr><td>Data Principal<\/td><td>The person whose data it is<\/td><td>The lead who filled your enquiry form<\/td><\/tr><tr><td>Data Fiduciary<\/td><td>The business that decides why and how data is used<\/td><td>Your company running the campaign<\/td><\/tr><tr><td>Data Processor<\/td><td>A vendor that processes data on your behalf<\/td><td>Your cloud telephony, CRM, dialer or WhatsApp API provider<\/td><\/tr><tr><td>Consent<\/td><td>A clear &#8220;yes&#8221; from the person for a specific purpose<\/td><td>The lead ticks &#8220;I agree to receive calls about this property&#8221;<\/td><\/tr><tr><td>Consent Manager<\/td><td>A registered Indian company that lets people give, review and withdraw consent on one platform<\/td><td>A future dashboard where a customer withdraws consent for your marketing calls<\/td><\/tr><tr><td>Significant Data Fiduciary (SDF)<\/td><td>A business notified by the government because of the volume or sensitivity of the data it handles<\/td><td>A large lender or insurer handling crores of records<\/td><\/tr><tr><td>Personal data breach<\/td><td>Any unauthorised access, sharing, loss or destruction of personal data<\/td><td>A telecaller exports the full lead list to a personal Gmail account<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>The DPDP compliance checklist for call centres and telecalling teams<\/strong><\/h2>\n\n\n\n<p>This checklist turns the DPDP Act and Rules into actions for teams that collect leads and call, message or record customers. Each item has a suggested owner. Aim to complete it before 13 May 2027.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Lead collection and privacy notices<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u2610 Map every lead source: website forms, landing pages, ads, IVR, missed-call numbers and walk-ins. (Marketing head). You cannot protect data you have not listed.<\/li>\n\n\n\n<li>\u2610 Show a short notice at every lead form listing what data you collect and why. (Marketing). Rule 3 requires an itemised, plain-language notice.<\/li>\n\n\n\n<li>\u2610 Add a link to your full privacy notice on forms, IVR menus and WhatsApp greetings. (Marketing + Legal). The notice must explain how to withdraw consent and how to complain.<\/li>\n\n\n\n<li>\u2610 Collect only what you need for the enquiry. (Sales head). Do not ask for date of birth or income if you only need a call-back.<\/li>\n\n\n\n<li>\u2610 Tell missed-call and IVR callers how their number will be used, through an SMS or WhatsApp follow-up with the notice link. (Ops head). A missed call is not consent for marketing.<\/li>\n\n\n\n<li>\u2610 Publish a contact person for privacy queries (a DPO, if applicable). (Legal). Rule 9 requires business contact details to be published.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Consent for calls, WhatsApp and SMS<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u2610 Use separate, unticked checkboxes for calls, WhatsApp and SMS. (Marketing). Consent must be specific and given by a clear action, not by a pre-ticked box.<\/li>\n\n\n\n<li>\u2610 Write consent text in simple language, and in the lead&#8217;s language where possible. (Marketing). Consent must be informed and easy to understand.<\/li>\n\n\n\n<li>\u2610 Store a consent record for every lead: source, time, text shown and channel. (CRM admin). You must be able to prove consent if challenged.<\/li>\n\n\n\n<li>\u2610 Make withdrawal as easy as giving consent: an opt-out keyword, IVR option or link. (Ops head). The Act requires withdrawal to be comparably easy.<\/li>\n\n\n\n<li>\u2610 Stop calls and messages quickly after withdrawal and sync opt-outs across CRM, dialer and messaging tools. (CRM admin). An opt-out in one tool must reach all of them.<\/li>\n\n\n\n<li>\u2610 Identify where you rely on &#8220;legitimate uses&#8221; instead of consent, such as service calls for a product the customer bought. (Legal). Use this ground only where the Act allows it.<\/li>\n\n\n\n<li>\u2610 Send notices to existing leads and customers whose data you collected before the Act. (Marketing + Legal). Pre-existing consent needs a fresh notice.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Call recordings and transcripts<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u2610 Treat recordings, transcripts and AI call scores as personal data. (Ops head). They identify the caller.<\/li>\n\n\n\n<li>\u2610 Follow your recording notice and retention rules. (Ops head). See our detailed guide on<a href=\"https:\/\/callerdesk.io\/blog\/dpdp-rules-call-recording-consent\/\"> DPDP rules and call recording consent<\/a>.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Calling lists, purchased data and data brokers<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u2610 Stop using lists you cannot prove consent for. (Sales head). Bought or scraped lists usually have no valid consent for your business.<\/li>\n\n\n\n<li>\u2610 Ask list vendors for written proof of how consent was collected and for which purpose. (Procurement). You remain responsible as the Data Fiduciary.<\/li>\n\n\n\n<li>\u2610 Scrub every list against your opt-out list before each campaign. (CRM admin). It stops repeat calls to people who said no.<\/li>\n\n\n\n<li>\u2610 Check TRAI DND preferences (National Customer Preference Register) for promotional calls. (Ops head). TRAI rules apply alongside DPDP.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>CRM, dialer and vendor contracts<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u2610 List every vendor that touches lead data: telephony, CRM, dialer, WhatsApp API, SMS, AI transcription and BPO partners. (IT head).<\/li>\n\n\n\n<li>\u2610 Sign a data processing contract with each vendor. (Legal). The Act lets you engage a Data Processor only under a valid contract.<\/li>\n\n\n\n<li>\u2610 Confirm each vendor&#8217;s security safeguards and breach-reporting timelines. (IT head). You must report breaches even if they happen at the vendor.<\/li>\n\n\n\n<li>\u2610 Ensure vendors delete data when the contract ends or the purpose is over. (Legal).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Agent access control, security safeguards and audit logs<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u2610 Give agents role-based access to only the leads they handle. (IT head). Least access reduces the impact of misuse.<\/li>\n\n\n\n<li>\u2610 Use number masking so agents do not see full customer numbers where they do not need to. (Ops head).<\/li>\n\n\n\n<li>\u2610 Block bulk export and personal-device downloads of lead data. (IT head).<\/li>\n\n\n\n<li>\u2610 Turn on encryption, access logs and backups. (IT head). Rule 6 names encryption, access control, log monitoring and backups as reasonable safeguards.<\/li>\n\n\n\n<li>\u2610 Remove access the same day an agent leaves. (HR + IT).<\/li>\n\n\n\n<li>\u2610 Train telecallers on what they can and cannot do with customer data. (Team leads).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Data retention and deletion<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u2610 Set a retention period for leads, recordings and chats, based on purpose. (Legal + Ops). Keep data only as long as the purpose needs.<\/li>\n\n\n\n<li>\u2610 Keep processing logs for at least one year. (IT head). Rule 8 requires personal data, traffic data and logs to be retained for a minimum of one year for specified purposes.<\/li>\n\n\n\n<li>\u2610 Automate deletion of old, cold leads and expired recordings. (CRM admin).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Breach response plan<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u2610 Write a breach response plan with named owners and phone numbers. (IT head + Legal).<\/li>\n\n\n\n<li>\u2610 Inform affected customers without delay after a breach. (Legal). Rule 7 requires intimation to each affected Data Principal.<\/li>\n\n\n\n<li>\u2610 Inform the Data Protection Board without delay, and send a detailed report within 72 hours of becoming aware of the breach (or longer if the Board allows). (Legal).<\/li>\n\n\n\n<li>\u2610 Run a mock breach drill once before May 2027. (IT head).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Customer rights requests<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u2610 Set up one channel (email, form or WhatsApp) for access, correction, erasure and grievance requests. (Support head).<\/li>\n\n\n\n<li>\u2610 Resolve grievances within 90 days at most. (Support head). Rule 14 sets a period not exceeding 90 days.<\/li>\n\n\n\n<li>\u2610 Verify the requester&#8217;s identity before sharing or deleting data. (Support head).<\/li>\n\n\n\n<li>\u2610 Allow customers to nominate someone to exercise their rights. (Legal).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Children&#8217;s data (education and edtech)<\/strong><\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u2610 Get verifiable parental consent before processing data of anyone under 18. (Admissions head). Rule 10 requires due diligence to confirm the parent is an adult.<\/li>\n\n\n\n<li>\u2610 Do not track or target children with behavioural advertising. (Marketing).<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>DPDP and TRAI: what changes for marketing calls, SMS and WhatsApp<\/strong><\/h2>\n\n\n\n<p>DPDP and TRAI rules apply together. DPDP governs how you collect and protect personal data. TRAI&#8217;s Telecom Commercial Communications Customer Preference Regulations (TCCCPR) govern how you send commercial calls and SMS. WhatsApp also follows Meta&#8217;s own opt-in rules. You need to meet all three.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>Channel<\/td><td>DPDP requirement<\/td><td>TRAI \/ DLT \/ Meta requirement<\/td><td>Practical step<\/td><\/tr><tr><td>Promotional calls<\/td><td>Notice + specific consent; easy withdrawal<\/td><td>Use the 140 series; respect DND; explicit consent valid for seven days unless TRAI directs otherwise<\/td><td>Keep consent records and call only from registered 140 numbers<\/td><\/tr><tr><td>Service \/ transactional calls<\/td><td>Notice; consent or legitimate use<\/td><td>Use the 1600 series<\/td><td>Separate service calls from sales calls in your dialer<\/td><\/tr><tr><td>Automated, AI or IVR outbound calls<\/td><td>Same as above; tell people when AI is used<\/td><td>Declare A2P (automated) calls and numbers to your telecom provider under the 2026 Third Amendment<\/td><td>Declare before you launch any robocall or AI-voice campaign<\/td><\/tr><tr><td>SMS<\/td><td>Notice + consent for promotional SMS<\/td><td>Register headers and templates on DLT; misused headers can be suspended within six hours<\/td><td>Audit DLT templates and remove unused headers<\/td><\/tr><tr><td>WhatsApp<\/td><td>Notice + consent; easy opt-out<\/td><td>Meta requires opt-in before you message customers<\/td><td>Capture WhatsApp opt-in separately on your forms<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Read more: <a href=\"https:\/\/callerdesk.io\/blog\/trai-spam-rules-2026\/\">TRAI&#8217;s 2026 anti-spam rules<\/a>, <a href=\"https:\/\/callerdesk.io\/blog\/what-are-a2p-calls-trai-2026-rules-explained\/\">A2P calls explained<\/a>, <a href=\"https:\/\/callerdesk.io\/blog\/dlt-registration-in-india\/\">DLT registration in India<\/a> and <a href=\"https:\/\/callerdesk.io\/blog\/why-business-number-marked-as-spam\/\">why business numbers get marked as spam<\/a>.<\/p>\n\n\n\n<p>Note on consent records: TRAI&#8217;s 2026 amendment recognises older (legacy) consent only if it was collected in a verifiable way and registered on the telecom provider&#8217;s platform. TRAI and the Reserve Bank of India are also piloting a Digital Consent Acquisition system with banks. An old Excel sheet of numbers is not proof of consent.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>DPDP Act penalties<\/strong><\/h2>\n\n\n\n<p>The Data Protection Board of India can impose penalties of up to \u20b9250 crore, depending on the breach. These limits come from the Schedule to the DPDP Act 2023.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>Breach<\/td><td>Maximum penalty<\/td><\/tr><tr><td>Failure to take reasonable security safeguards to prevent a personal data breach<\/td><td>\u20b9250 crore<\/td><\/tr><tr><td>Failure to inform the Board or affected people about a personal data breach<\/td><td>\u20b9200 crore<\/td><\/tr><tr><td>Breach of additional obligations for children&#8217;s data<\/td><td>\u20b9200 crore<\/td><\/tr><tr><td>Breach of additional obligations of a Significant Data Fiduciary<\/td><td>\u20b9150 crore<\/td><\/tr><tr><td>Breach of any other provision of the Act or Rules<\/td><td>\u20b950 crore<\/td><\/tr><tr><td>Breach of a voluntary undertaking accepted by the Board<\/td><td>Up to the penalty for the original breach<\/td><\/tr><tr><td>Breach of duties by a Data Principal<\/td><td>\u20b910,000<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>90-day action plan before 13 May 2027<\/strong><\/h2>\n\n\n\n<p>A 90-day plan gives a telecalling team enough time to fix forms, consent, vendors and security before 13 May 2027. Start no later than early February 2027. Starting now is safer.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>Weeks<\/td><td>Actions<\/td><td>Owner<\/td><\/tr><tr><td>1\u20132<\/td><td>Map lead sources, data fields, tools and vendors; name a privacy owner<\/td><td>Ops head + IT head<\/td><\/tr><tr><td>3\u20136<\/td><td>Rewrite notices and consent checkboxes; set up consent records and opt-out sync; stop non-consented lists<\/td><td>Marketing + CRM admin<\/td><\/tr><tr><td>7\u201310<\/td><td>Sign vendor contracts; enable role-based access, masking, logs and export blocks; set retention and deletion rules<\/td><td>Legal + IT head<\/td><\/tr><tr><td>11\u201313<\/td><td>Launch a rights-request channel; write and test the breach plan; train all telecallers; run a final audit<\/td><td>Support head + Legal + Team leads<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How CallerDesk supports DPDP-ready calling<\/strong><\/h2>\n\n\n\n<p>We help sales and support teams run calls and messages in a more controlled way. CallerDesk offers role- and hierarchy-based login access [CONFIRM], IP-based login restriction [CONFIRM], number masking [CONFIRM], call recording controls [CONFIRM] and call logs and reports [CONFIRM]. We can also share our data processing terms for your vendor file [CONFIRM].<\/p>\n\n\n\n<p>No tool makes you compliant on its own. Your notices, consent and processes matter just as much. To get started, download the printable DPDP checklist or book a compliance walkthrough with CallerDesk. Also see our guide on <a href=\"https:\/\/callerdesk.io\/blog\/compliance-recording-privacy-first-powerful\/\">privacy-first compliance recording<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Frequently asked questions<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>What is the full form of DPDP?<\/strong><\/h3>\n\n\n\n<p>DPDP stands for Digital Personal Data Protection. The Digital Personal Data Protection Act 2023 is India&#8217;s law on how businesses collect, use, store and delete digital personal data. The DPDP Rules 2025, notified on 13 November 2025, explain how the Act works in practice.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>When does the DPDP Act come into force?<\/strong><\/h3>\n\n\n\n<p>The DPDP Act comes into force in phases. The Rules were notified on 13 November 2025, when the Data Protection Board was set up. Consent Manager rules apply from 13 November 2026. The main business obligations, including notice, consent, security and breach reporting, apply from 13 May 2027.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Is the DPDP Act in force now?<\/strong><\/h3>\n\n\n\n<p>Partly. As of 30 October 2026, the Data Protection Board and some foundational provisions are in force. Consent Manager rules start on 13 November 2026. Most duties for businesses, such as notice, consent and breach reporting, become enforceable on 13 May 2027.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Does the DPDP Act apply to small businesses?<\/strong><\/h3>\n\n\n\n<p>Yes. The DPDP Act applies to any business that processes digital personal data, whatever its size. The government can exempt certain classes, such as startups, through a notification, but no business should assume an exemption unless it is officially notified for its category.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Do I need consent to call a lead under the DPDP Act?<\/strong><\/h3>\n\n\n\n<p>In most cases, yes. For sales and marketing calls, you need specific, informed consent given by a clear action, plus a notice explaining why you will call. Some calls may rely on a &#8220;legitimate use&#8221; under the Act, and TRAI&#8217;s consent and DND rules also apply to promotional calls.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Is call recording allowed under the DPDP Act?<\/strong><\/h3>\n\n\n\n<p>Yes, call recording is allowed if you have a valid legal ground, give proper notice and protect the recordings. Recordings and transcripts are personal data, so retention, access control and deletion rules apply. Our detailed guide on DPDP and call recording consent explains the steps.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Can I use purchased calling data after the DPDP Act?<\/strong><\/h3>\n\n\n\n<p>Only if you can prove that valid consent was collected for your specific purpose. Most purchased or scraped calling lists cannot show this. As the Data Fiduciary, your business is responsible, so ask vendors for written proof or stop using such lists.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>What is a Consent Manager under the DPDP Act?<\/strong><\/h3>\n\n\n\n<p>A Consent Manager is a registered Indian company that offers a single, interoperable platform where people can give, manage, review and withdraw consent. Consent Manager rules apply from 13 November 2026. Businesses should be ready to receive consent and withdrawals through them.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Who is a Data Fiduciary and who is a Data Processor?<\/strong><\/h3>\n\n\n\n<p>A Data Fiduciary is the business that decides why and how personal data is used, such as your company. A Data Processor processes data on your behalf, such as your telephony, CRM or dialer vendor. The Data Fiduciary stays responsible and needs a valid contract with each processor.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>What is the penalty for violating the DPDP Act?<\/strong><\/h3>\n\n\n\n<p>Penalties go up to \u20b9250 crore for failing to take reasonable security safeguards. Failing to report a breach can attract up to \u20b9200 crore. Most other breaches of the Act or Rules can attract up to \u20b950 crore, as set out in the Schedule to the Act.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>How is the DPDP Act different from TRAI DND\/DLT rules?<\/strong><\/h3>\n\n\n\n<p>The DPDP Act governs how you collect, use and protect personal data. TRAI&#8217;s rules govern how you send commercial calls and SMS, including DND preferences, DLT registration and the 140 and 1600 number series. Calling teams must follow both sets of rules at the same time.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>DPDP Act vs GDPR: what is different for Indian call centers?<\/strong><\/h3>\n\n\n\n<p>Both laws are built on notice, consent and individual rights. The DPDP Act covers only digital personal data, has fewer legal grounds than the GDPR, uses fixed penalty limits of up to \u20b9250 crore, and works alongside TRAI&#8217;s calling rules, which Indian call centres must also follow.<\/p>\n","protected":false},"excerpt":{"rendered":"Under the Digital Personal Data Protection Act 2023 (DPDP Act), any business that collects leads and calls, messages&hellip;","protected":false},"author":2,"featured_media":6228,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[261],"tags":[],"class_list":{"0":"post-6227","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-latest-update","8":"cs-entry"},"_links":{"self":[{"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/posts\/6227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/comments?post=6227"}],"version-history":[{"count":1,"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/posts\/6227\/revisions"}],"predecessor-version":[{"id":6229,"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/posts\/6227\/revisions\/6229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/media\/6228"}],"wp:attachment":[{"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/media?parent=6227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/categories?post=6227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/callerdesk.io\/blog\/wp-json\/wp\/v2\/tags?post=6227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}