Call recording for lenders under RBI and DPDP: a practical guide
Consent capture, data residency, retention and audit — what to get right when AI starts handling recovery and tele-sales calls.
The compliance picture in 2026
Three regimes shape how lenders handle customer calls in India today:
- RBI / NHB guidelines on fair-practices and recovery
- DPDP Act 2023 for personal data handling
- Sector-specific rules (e.g., outsourcing, KYC) that overlap with the above
This guide focuses on the operational decisions you need to make before AI voice or chat agents touch a single customer.
Consent at the call start
DPDP makes consent explicit. For recorded calls, the practical pattern is:
- Disclosure at the start of every recorded call ("This call is being recorded for quality and training")
- Explicit consent prompts when special-category data is involved (e.g., health data, biometrics)
- Timestamped log of disclosure + consent, retained at least as long as the recording
OZOO.ai Voice AI handles all three by configuration. The same approach applies to chat: a single consent line in the first message, persisted in the conversation log.
Data residency
For Indian customers, default to the India AWS region. For global deployments, residency is configurable — but make the choice explicit per tenant, not per call.
Practical implications:
- Recordings live in India-region S3
- Transcripts in India-region DynamoDB
- Analytics in India-region Athena / QuickSight
- Cross-region access is logged
PII redaction before persistence
DPDP's data-minimisation principle is the friend of every architect. Mask:
- Card numbers (16 digits)
- Aadhaar (12 digits)
- PAN (alphanumeric, 10 chars)
- Account IDs per your patterns
- Mobile numbers when not strictly needed
Redact before the audio leaves the transcription stage, before transcripts hit storage, and before analytics consumes them. OZOO.ai Post-Call Analytics ships these masks on by default; tune them per portfolio.
Retention windows
RBI fair-practices guidance, sector retention rules and DPDP all interact. The pragmatic approach:
- Recordings: 1–3 years depending on product (longer for collections evidence)
- Transcripts: tied to recording window
- Analytics aggregates: longer (years), since they're not personal data
- Right-to-erasure: programmatic, honoured across S3, DynamoDB and Athena within SLA
Audit trail
Every supervisor action — replay, transcript export, score override — must be loggable and exportable. For AI-handled calls, you also want the prompt version, model version and guardrail version that produced each turn. This is your defence when a regulator asks "why did the bot say that."
What OZOO.ai gives you out of the box
- Consent prompts and disclosure configurable per campaign
- PII redaction at every persistence layer
- India-region by default with configurable residency
- Audit logs across every human and machine action
- Sub-processor list maintained publicly; 30-day notice on changes
- DPA available on request
See the Security page for the full breakdown.