Compliance and collections leaders worry about DPDPA rules. Most treat DPDPA compliance for BFSI collections calls as a checkbox they audit once and move on. That’s backward.
In our conversations with NBFC and fintech lenders, the compliant ones move faster, not slower. They pass audits with fewer flags. They win RFPs that compliance laggards lose.
Here we break down what DPDPA requires for collections calls, also covering where DPDPA conflicts with RBI rules. Getting this right is a business advantage, not just a legal one.
Is DPDPA Compliance For BFSI Collections Calls Optional?
The short answer is no. DPDPA 2023 applies to every BFSI entity that processes personal data. That includes NBFCs, fintechs, and MFIs running collections calls right now. Full enforcement begins around May 2027. That’s eighteen months after the DPDP Rules 2025 were announced.
Treating DPDPA as optional until an audit notice arrives is the checkbox trap this piece argues against. Most compliance teams haven’t run a DPDPA regulatory audit notice checklist against their call flows yet.
Every NBFC, fintech, and MFI becomes a Data Fiduciary* under DPDPA. That happens the moment it collects a customer’s phone number or KYC detail.
*Data Fiduciary: an entity that decides why and how personal data gets processed.
Many mid-market NBFCs are likely to cross the Significant Data Fiduciary threshold once it’s finalized. The exact cutoff hasn’t been officially notified yet. Only indicative volume-based estimates exist so far. Crossing it will add extra audit and DPO obligations, not fewer.
We hear this framed as a compliance cost. It’s really a scope question. Which of your calls, recordings, and vendor contracts fall under DPDPA today? Most compliance teams haven’t mapped this yet. Waiting for a regulatory notice to find out is the expensive way to learn it. A quick mapping exercise now is cheaper than a rushed one during an audit.
TL;DR: DPDPA already applies to your collections calls, whether you’ve mapped it yet.
How Long Must BFSI Businesses Store Call Recordings?
This is the DPDPA call recording retention question we get asked most. The short answer is that DPDPA itself sets no fixed number. Section 8(7) makes retention purpose-based. You keep data only as long as the purpose needs it, unless another law requires longer. For BFSI collections calls, that other law is RBI. RBI sets two different floors depending on what you’re retaining.
Here’s the comparison, sourced directly to RBI rather than a compliance blog.
The practice these rules imply are simple. A call recording follows the six-month floor. The KYC and transaction data behind that account follow the five-year floor. Don’t apply one number to both record types.
TL;DR: RBI, not DPDPA, sets the retention clock here. Six months for recovery call recordings, five years for KYC and transaction records.
Do Collections Calls Need Separate DPDPA Consent?
Yes, they do. TRAI consent covers your right to call a number. DPDPA consent covers your right to record, store, and process what happens on that call. A collections call needs a purpose-specific DPDPA consent. That consent must be separate from the general loan consent captured at onboarding. Bundling the two into one blanket consent form is a common shortcut. It doesn’t hold up under DPDPA.
Most lending consent forms bundle everything into a single checkbox at onboarding. Loan terms, KYC, and communication consent all get lumped together.
Consent Manager: a DPDP Rules 2025 mechanism for managing granular, purpose-specific consent. It isn’t operational yet as of this writing.
DPDPA doesn’t allow that kind of bundling across distinct purposes. A collections call, especially one that gets recorded and analyzed, counts as its own processing purpose. That means your consent language, audit trail, and withdrawal process all need to point back to that purpose. They can’t just point to the original loan agreement. In practice, this shows up as a short, itemized consent line at the start of the call itself. It plays before the recording starts. Skipping this step is one of the most common gaps we see. It happens when NBFCs treat DPDPA as a one-time paperwork exercise instead of an ongoing call-flow requirement.
TL;DR: Collections calls need their own DPDPA consent. General loan consent doesn’t cover it.
Does DPDPA Compliance Win BFSI Vendor RFPs?
Increasingly, yes. We’ve seen AI-readiness and compliance-readiness show up as explicit line items in BPO and BFSI vendor RFPs. A lender with a clean DPDPA posture skips the slow legal back-and-forth. That back-and-forth is what stalls less-prepared vendors. In our own deals, this shows up most often as RBI and DPDPA compliance questions inside the RFP itself. It’s not a separate legal review bolted afterward.
We’re not citing a market-wide statistic here, because we haven’t found one specific to BFSI RFPs. This is Acefone’s own operational observation from BFSI and BPO deals we’ve worked on. A regulatory audit notice is one of the highest urgency triggers we see. It often pushes a compliance or collections leader to evaluate a new vendor.
RFP-readiness: being able to answer a procurement team’s compliance questions without a multi-week legal review cycle.
That urgency cuts both ways. It rewards vendors who already have documented DPDPA posture. It penalizes vendors who need weeks to pull one together. Faster legal sign-off isn’t a side benefit of good compliance. It’s often the deciding factor in which vendor gets shortlisted first, well before pricing enters the conversation. We’ve watched procurement teams shortlist on compliance readiness alone, then negotiate price with whoever clears that bar first.
TL;DR: Compliance-readiness increasingly decides which BFSI vendors get shortlisted first, not just which ones pass audits.
Can a Vendor Claim RBI Compliance?
No, not in the way many vendors phrase it. RBI licenses and regulates banks and NBFCs. It doesn’t regulate technology vendors. This holds whether you’re evaluating a manual dialer or DPDPA voice AI compliance for an automated bot. A vendor can be DPDPA-compliant and DoT-licensed. It can also help its BFSI customers meet their own RBI obligations. It cannot itself be “RBI compliant.”
This distinction matters more than it sounds. We’ve seen at least one competitor market itself as fully DPDPA and RBI compliant. That claim doesn’t hold up once you check what RBI actually regulates.
Here’s what Acefone can state plainly, because it’s documented. We are a DoT-licensed Virtual Network Operator. We are DPDPA 2023 compliant, with India-based data residency. We hold ISO 27001:2013 and SOC 2 Type 2 certification, and we’re CERT-IN VAPT tested.
Our infrastructure gives BFSI customers what they need to meet critical obligations themselves. That means India data residency, audit trails, and a documented consent flow. That’s a narrower claim than some vendors make. It’s also the one we can actually defend if a customer’s legal team asks us to prove it.
What Should Your DPDPA Readiness Checklist Cover?
A collections-specific DPDPA checklist covers five things: consent, audit trails, retention, withdrawal, and vendor liability. Getting each one right up front is what makes an audit go quickly instead of dragging for weeks.
- Purpose-specific consent captured at the start of every collections call, not bundled with loan consent.
- A tamper-proof audit trail linking each recording to its consent record.
- Retention aligned to the correct RBI floor per record type, six months for call recordings, five years for KYC and transaction data.
- A documented process for handling consent withdrawal and its effect on future contact.
- Vendor contracts that explicitly assign deletion and breach-notification liability.
None of these five items is exotic. Most NBFCs already have pieces of this in place somewhere. The gap we typically see is that they live in different systems. Different teams own different pieces, with no single audit trail connecting them. That fragmentation is what turns a routine audit into a multi-week scramble. A single owner for all five items closes most of that gap on its own.
Your Takeaway
DPDPA compliance for BFSI collections calls isn’t a box to tick once and forget. It’s an operating discipline that touches every collections call you make. Three things matter most.
First, DPDPA already applies to your collections calls today, regardless of when full enforcement begins. Second, RBI sets the retention clock here, not DPDPA. Six months for the call recording, five years for the KYC data behind it. Third, compliance-readiness increasingly decides which vendors win BFSI RFPs and which ones stall in legal review.
