Voice AI compliance in India: consent, recording and DPDP

Compliance is not the reason to avoid voice AI; it is the specification for building it properly. Every rule that applies to a human calling on your behalf applies to an agent, and a well-designed agent enforces them more reliably than a call centre can. This guide maps the Indian requirements, the DPDP Act, TRAI's commercial-communication rules, RBI expectations for lenders, and sector rules for healthcare, onto concrete design decisions. It is engineering guidance, not legal advice; your counsel signs off the final design.

The four regimes

Primary sources: MeitY for the DPDP Act, TRAI for calling rules, and the RBI for lender conduct.

Consent and notice

Inbound callers are told at the start that they are speaking with an automated assistant and that the call is recorded, with the purpose stated. Outbound calls go only to numbers with consent or an existing relationship for service calls, identify the caller and purpose in the first sentence, and honour opt-out instantly. Consent status lives in your system of record and is read on every call by the wrapper, never assumed. The DPDP Act's notice and consent requirements are met by the script plus the record of consent, not by a line in a privacy policy.

Recording, storage and retention

• Recordings and transcripts stored encrypted, in India for regulated sectors, with access limited by role
• Retention set per purpose and sector, then automatic deletion; collections and healthcare often differ from booking
• Speech processing by engines under contracts that prohibit training on your data; residency stated in the DPA
• Deletion requests honoured across recordings, transcripts, logs and backups within the retention schedule
• Audit log of who accessed which recording

Identity before information

No account, order, health or loan detail is read until identity is confirmed: the calling number plus a second factor such as date of birth, last four digits of an ID or an OTP. This protects against the wrong person receiving data and is the control regulators look for first. It is enforced by the wrapper, so the agent cannot skip it under pressure from a caller.

Conduct rules as guardrails

Permitted hours, identification, opt-out, no threats, no discussion with third parties, options only within policy: each is encoded as a rule the system enforces rather than an instruction the model follows. The agent cannot dial outside hours, cannot offer an unapproved settlement and cannot continue after "stop". Tone is evaluated on real recordings with your compliance team before launch and after any script change. This is how collections agents stay inside RBI expectations.

Healthcare specifics

Automated systems do not give clinical advice, full stop. Emergency phrases in every supported language trigger immediate transfer. Health details are never spoken before identity is confirmed, and clinical data stays in the provider's environment; a booking agent needs availability and demographics, not the record. See AI voice agent for appointment booking and the healthcare page.

Grievance and audit readiness

The DPDP Act expects a grievance officer and a process; regulators expect an audit trail. Every call therefore produces a record: recording, transcript, actions taken, model and engine versions, consent status at the time, and outcome, in an append-only store queryable by compliance. A monthly compliance report (calls by type, opt-outs, complaints, hours compliance, retention deletions) is part of the Care Plan for regulated clients.

Cross-border and residency

Where callers or data are outside India, GDPR or other regimes add lawful-basis, transfer and DPIA requirements. For Indian regulated sectors, keep processing and storage in India and use engines that can commit to residency. Lenders and insurers often choose a private deployment so speech, models and storage all sit inside their perimeter; see Self-hosted LLMs for BFSI.

A compliance design checklist

• Disclosure and recording notice in every supported language
• Consent and preference fields read from the system of record on every call
• Identity confirmation enforced before any personal detail
• Calling hours and retry limits by configuration
• Options matrix approved by compliance; nothing outside it possible
• Encrypted storage in India with role-based access and retention schedules
• Append-only audit store; monthly compliance report
• Grievance contact published; deletion process tested
• Speech and model providers under DPAs with no-training and residency terms

Team and timeline

Compliance design is the first two weeks of any regulated voice build, run with your compliance owner and counsel: scripts, matrices, hours, retention and the audit design. It is included in the voice agent scope; costs are on the pricing page. Our own practices are described on the Security and Privacy pages.

International callers and providers

If any callers are in the EU or UK, GDPR applies to their data even when the business is Indian: lawful basis, notice, DPIA for automated decision-making, and transfer safeguards for any processing outside the region. If speech or model providers are outside India, the DPA must state residency and no-training terms, and regulated sectors should prefer providers who can process in India. The simplest architecture for a mixed caller base is region-aware routing: EU calls processed in the EU, Indian calls in India, with the same agent logic and separate storage.

Documenting the design

Regulators and auditors ask for documents, not demos: the data-flow diagram, the consent and notice scripts per language, the retention schedule, the options matrix with approvals, the provider DPAs, the access-control model and the incident procedure. We produce these as part of the compliance design phase and keep them current under the Care Plan. A voice agent with that pack is easier to audit than a human call centre, which is a point worth making to the board.

Glossary

• Data fiduciary / processor: DPDP terms for the party deciding purpose and the party processing on instruction
• Consent record: the stored evidence of consent, read on every call
• Retention schedule: per-purpose rule for how long recordings and transcripts are kept
• Grievance officer: the named contact the DPDP Act requires
• Right-party verification: identity before any personal detail
• DPA: data-processing agreement with speech and model providers

Mistakes we see

Compliance failures are rarely dramatic; they are omissions: no disclosure in a regional language, consent assumed from a marketing list, recordings in a foreign region by default, no retention deletion, and provider contracts that allow training on your audio. Each is a configuration or contract decision that belongs in week one.

Questions clients ask

• Do inbound calls need consent? Notice and disclosure at the start; consent for processing follows from the caller's purpose, recorded with the call.
• Can we store recordings abroad? Not for regulated sectors; keep them in India with residency terms from every provider.
• How long should we keep transcripts? Per purpose and sector, then delete automatically; the schedule is documented and tested.
• Who is accountable for the agent's conduct? You are, as the lender or provider; the design and logs are how you demonstrate control.
• Is disclosure required by law? Regulators expect it and customers reward it; we treat it as mandatory.

What good looks like after 90 days

A ninety-day compliance review covers hours compliance, opt-outs honoured, complaints (target zero), retention deletions executed, access-log review and any script changes approved by compliance. The report is the evidence pack for auditors and the board.

Related reading

Outbound AI calling, AI voice agents for Indian languages and What is an AI voice agent?.

Treat compliance as the specification: encode the rules, log everything, keep data in the right place, and the agent becomes the most consistent caller you have.

For decision-makers: the compliance design pack is a two-week deliverable that makes the rest of the project safe, and it is the first thing a regulator, an auditor or an enterprise customer will ask to see. Commission it before the first line of dialogue is written.