You've built a voice agent that books appointments or qualifies leads. Then someone on your team asks the question that stalls the launch: "Are we allowed to record this? Do we have to say it's a bot?" This post doesn't answer that as law. It's a map of where the answers live, what to write down before launch, and what to ask a professional. It is not legal advice.
On 2026-10-09 I downloaded and read the primary texts for three things: the Digital Personal Data Protection Rules, 2025 (Gazette notification G.S.R. 846(E), 13 November 2025, from meity.gov.in), TRAI's Telecom Commercial Communications Customer Preference (Third Amendment) Regulations, 2026 (dated 18 September 2026, from trai.gov.in; the PDF is a scan with rough text extraction, so check numbers against the file) and ElevenLabs' use policy. I still could not open the DPDP Act itself, the Telecommunications Act, or any sector rule, and I found no rule on private call recording in what I read. Those are marked as not read. Where I say "check", I mean it: open the Gazette or the regulator's page, don't trust a blog, including this one.
What is the short answer for builders?
Three habits cover most of the risk while you wait for legal advice:
- Say it's automated in the first turn. It costs nothing and removes a class of complaints.
- Say if the call is recorded, and why, before recording starts.
- Collect as little as you can and delete on a schedule you chose in advance.
None of these are a legal opinion. They're good practice that sits comfortably under most reasonable readings of the rules, and they are cheap to build into the opening script.
Which laws and rules should you look up?
Think in layers. Each layer has a primary source you should open yourself.
| Layer | What it governs | Where to read it | My status on 2026-10-09 |
|---|---|---|---|
| Digital Personal Data Protection Act, 2023 | Processing of digital personal data: notice, consent, purpose, duties of the organisation | MeitY and India Code | Act not read (PDF blocked); the Rules below were |
| DPDP Rules, 2025 | Operating detail, phased start dates | Gazette of India, MeitY | Read (Gazette PDF, 2026-10-09) |
| TRAI Telecom Commercial Communications Customer Preference Regulations, 2018, as amended (2025 second and 2026 third amendments) | Commercial calls and messages, registration of senders, preferences, DND, and now declaring A2P calls | TRAI website, Regulations page | Both amendments downloaded and read; the 2018 principal text not opened |
| Telecommunications Act, 2023 and its rules | Telecom services; government interception procedures | India Code, Department of Telecommunications | Not read |
| Sector rules | Banks, insurers, health, securities | The relevant regulator's site | Not researched |
| Your vendors' terms | What ElevenLabs, your telephony provider and your LLM provider allow | Their legal pages | ElevenLabs read; others not |
Note the last row. A lot of "can I do this" questions are answered first by a vendor's acceptable use policy, which can be stricter than the law.
What do the primary texts say?
Treat this section as a reading list, not legal advice or a conclusion; I'm a builder summarising what I read.
DPDP Rules, 2025 (read in the Gazette). The notification is dated 13 November 2025. Rule 1 says rules 1, 2 and 17 to 21 apply from publication, Rule 4 (consent managers) one year after, and rules 3, 5 to 16, 22 and 23 eighteen months after publication. Counting from 13 November 2025, that puts the main organisational duties around mid-May 2027; work out the exact date yourself or ask counsel. Rule 3 is the notice rule: the notice must be understandable on its own, in clear and plain language, give an itemised description of the personal data and the specific purposes, and say how to withdraw consent with ease comparable to giving it, how to exercise rights and how to complain to the Board. Rule 8(3) says a data fiduciary must retain personal data, associated traffic data and logs of processing for a minimum of one year for the purposes in the Seventh Schedule, unless other law requires otherwise. That sits awkwardly with a "delete after 30 days" call-recording policy, so ask counsel how it applies to you. I did not work out how these rules interact with the Act itself, which I could not open.
Why this matters for a voice agent: a recording of someone's voice, plus a transcript with their name and what they asked for, is the kind of data these rules are about. The questions to put to counsel are which lawful ground you rely on (consent or something else), what your notice must say, how a person withdraws consent, and how long you must or may keep data.
TRAI (read the 2025 and 2026 amendments). The 2018 regulations are the framework for unsolicited commercial communication: sender and template registration, customer preferences and the Do Not Disturb registry. The Third Amendment Regulations, 2026, dated 18 September 2026, matter directly to AI calling. They insert a definition of an "Application-to-Person" (A2P) call: a voice call initiated by an application, software system or automated platform without direct human dialling, including autodialling, robo-calls and pre-recorded or artificial voice technologies. They replace regulation 4 so that every Sender must declare A2P calling in advance to its Originating Access Provider, with the CLI ranges to be used, recorded on the DLT platform. A call made without prior declaration is to be treated as unsolicited commercial communication. By the regulations' own commencement clause this provision starts 60 days after publication in the Gazette, which would be around mid-November 2026 if publication was on 18 September; I did not see the Gazette publication date. TRAI's explanatory memorandum, in the same file, says the declaration applies to all A2P calls, not only commercial ones. The regulations do not say "AI agent" anywhere I could find, so whether your voice agent's calls count as A2P, and what you must declare, is a question for your telephony provider and counsel. The same amendment also lets terminating operators charge up to Rs 0.05 per minute for A2P calls (with exemptions for certain number series); that is an operator-to-operator charge and I do not know whether or how it reaches you. The Second Amendment of February 2025 had already required senders to notify their operator in advance about auto dialers and robo-calls.
Recording a call. I found no source I could open that sets out a rule on recording private calls. A search summary offered a general understanding with an explicit caveat that it was not confirmed by its sources. I won't repeat that understanding as fact here. What I can say is that the answer depends on who records, why, who the parties are, what is done with the recording, and which of the layers above applies. This is exactly the kind of question where "ask a professional" is the correct answer rather than a dodge.
What does the vendor policy say about disclosure?
This one I verified on the page itself. ElevenLabs' use policy, last updated 17 August 2026 and downloaded on 2026-10-09, says organisations using its services, including its agent product, must clearly and prominently disclose to their users that they are interacting with AI rather than a human. The same policy prohibits replicating another person's voice in a way intended to deceive others about whether it was AI-generated, and prohibits "unauthorized robocalling", defined as automated dialing or artificial or pre-recorded voice calls without direct human intervention. The policy does not define "unauthorized" in that sentence, so read what applies to outbound campaigns before you dial. If you build on that stack, disclosure is a contract term and not just an etiquette choice. The same document covers replicating other people's voices; see the voice cloning consent checklist. Other voice platforms have their own policies; open each one you use.
If you want to try ElevenLabs for the voice layer, my referral link is below. Some links on this page are affiliate links; they cost you nothing and I only link tools I'd mention anyway. The disclosure rule above applies whether or not you use it, and alternatives exist for every layer of a voice stack.
Disclosure and recording wording you can adapt
These are untested templates, not legal text. Have counsel review them before use, and translate them well if you call in Hindi or another language (see the translation quality checklist).
Inbound, with recording:
Thanks for calling [BUSINESS]. I'm an automated assistant. This call is recorded so we can book your appointment correctly and check our service quality. If you'd rather not be recorded, say "no recording" and I'll connect you to a person. What can I help you with?
Outbound reminder, with recording:
Hello, this is an automated assistant calling from [BUSINESS] about your appointment. This call is recorded for quality checks. Is this a good time for a short call?
Two design points. First, an opt-out that only works if the human option exists is a promise; make sure there is a person or a callback to hand. Second, the line "for quality checks" has to be true. If you also train models on recordings, your notice must say that, and that purpose needs separate advice.
A pre-launch worksheet to complete before you record anything
Answer these in writing. Your lawyer will ask for them anyway, and a team that can answer them has usually already removed half the risk.
| Question | Your answer |
|---|---|
| What exactly is recorded: audio, transcript, both? | |
| What is the purpose of each? (service, QA, training, disputes) | |
| What do you tell callers, in which language, at which moment? | |
| How does a caller refuse, and what happens then? | |
| Who can listen to or read recordings? | |
| Where are they stored, and in which country? | |
| How long do you keep them, and who deletes them? | |
| Which vendors process them (telephony, STT, LLM, TTS)? What do their terms say about retention and training? | |
| Do outbound calls promote anything? Which registrations apply? | |
| What happens if someone asks to see or delete their data? | |
| Who is responsible if there is a breach? |
The vendor row is the one teams skip. Your STT or LLM provider may keep audio or transcripts for a period, and your agent platform may too. The same discipline in what not to paste into ChatGPT applies at larger scale: know where each piece of personal data goes. Also consider minimising what the agent hears. If the agent only needs a name, a date and a phone number, don't let it ask for anything more, and mask sensitive values in transcripts before storing them.
What should you ask a professional?
Bring the worksheet and ask these directly:
- Under the data protection rules that apply to us, what is our lawful ground for recording and transcribing these calls, and what must the notice contain?
- Does our first-turn script satisfy notice and consent, in every language we use?
- For outbound calls, which TRAI-related registrations, consent records and calling restrictions apply to our category of call?
- Do sector rules (banking, insurance, health) add anything for us?
- Is our retention period defensible, and what do we do on a deletion request?
- Are our vendor contracts adequate for the data they handle?
Look for a lawyer who has handled Indian data protection or telecom compliance work, not a generalist. And re-check the dates: these rules were still phasing in when I wrote this, and the open questions will shift.
What I would do this week
- Ship the first-turn disclosure and recording line, with a real human or callback fallback.
- Fill in the worksheet and book an hour with counsel.
- Open the primary pages listed in the table and note the date you read them.
- Pick a retention period (checking it against DPDP Rule 8(3)'s one-year minimum for logs) and set up automatic deletion before you store any real calls.
- If you dial out, ask your telephony provider how they handle the TRAI A2P declaration and which number series to use.
- For script design once the legal wording is settled, use the appointment booking call scripts and the calling agents with n8n guide.
