The DPDP Act Deadlines Every Business Using AI Voice Agents Needs to Know (2026-27)

India's data protection law is no longer a "someday" compliance item. The DPDP Act's rules are notified, the enforcement clock is running, and the deadlines that matter land through 2026 and into mid-2027. If your business runs an AI voice agent that talks to customers, records calls, or stores their information, this is worth reading before your next vendor renewal, not after a notice arrives.

The Timeline You Can't Ignore

• June-August 2026: The Consent Manager ecosystem starts operationalizing, and businesses need systems that are compatible with it.
• 13-14 November 2026: One year since the DPDP Rules were notified. This is widely read as the point "soft enforcement" ends, businesses need valid, demonstrable consent even for data collected before the rules existed.
• Q1 2027: The first mandatory audit cycle opens for Significant Data Fiduciaries, including formal Data Protection Impact Assessments.
• 13-14 May 2027: Full enforcement begins. The transition period ends and the Data Protection Board gets complete adjudicatory power, including penalties reported as high as ₹250 crore (roughly $26 million) for major violations.

Are You a "Significant Data Fiduciary"? It Matters More Than You'd Think

The Act places extra obligations, an India-based Data Protection Officer, independent audits, and mandatory Data Protection Impact Assessments, on entities that qualify as Significant Data Fiduciaries. The thresholds include processing data for 5 million or more residents, annual turnover above ₹2.5 billion, or processing sensitive health or financial data using AI for profiling.

Read that last one again. A bank, insurer, hospital chain, or NBFC running an AI voice agent across a large call volume can cross that threshold well before anyone in the business has thought about it in DPDP terms.

What This Actually Means For an AI Voice Agent

Strip away the legal language and a few concrete requirements apply directly to any business running voice AI on customer calls:

• Consent has to be real, not assumed. Informed, transparent processing means the customer has to actually agree, an affirmative spoken "yes" or DTMF input, with clear disclosure that they're talking to an automated system at the start of the call. Silence, or a pre-recorded script nobody responds to, does not count as consent.
• Recording and storage need a documented reason. Before a voice agent goes live, someone needs to have reviewed how call recordings are notified, stored, accessed, and eventually deleted, not worked it out after a customer asks.
• Data minimization is not optional. Voice data, biometrics, or voice clones should not sit in storage without a specific purpose, a consent trail, and an actual erasure workflow when that purpose ends.
• Vendor accountability is now your problem. If your voice AI vendor cannot tell you where the audio and transcripts are stored, whether that is India-resident, and whether they can produce a deletion certificate on request, that gap is now sitting inside your compliance obligation, not theirs alone.

Questions To Ask Your Voice AI Vendor Right Now

• Where is call audio and transcript data stored, and is it India-resident?
• Does the agent disclose that it's AI, out loud, at the start of every call, not buried in a terms page?
• Can you get a deletion certificate when a customer asks their data to be erased?
• If you're a Significant Data Fiduciary, can this vendor's setup support your Data Protection Impact Assessment and an India-based DPO's reporting needs?
• What's the actual retention period for recordings and transcripts, and who decided it?

If a vendor hesitates on more than one of these, that hesitation is the answer.

Where Zencia Fits

We built Echo around the assumption that these questions were coming, because they were always going to. Every call discloses that the customer is speaking with an AI agent at the start of the conversation. Call data and transcripts are handled with documented retention and deletion practices rather than indefinite storage by default. And because Echo is one product we operate end to end, there's a single, direct answer to "where does the data live and who can delete it," instead of a chain of subcontractors nobody can fully account for.

The Bottom Line

DPDP compliance used to be a legal team's problem to solve quietly in the background. With enforcement now on a real calendar, running through late 2026 and hitting full force in May 2027, it has become a vendor-selection criterion. The businesses that get ahead of this will be the ones auditing their voice AI setup now, not the ones waiting for the Data Protection Board to ask first.

Want to see how Echo handles consent, disclosure, and data retention by design? Talk to us at zencia.ai.