{"id":27402,"date":"2026-08-21T13:42:40","date_gmt":"2026-08-21T13:42:40","guid":{"rendered":"https:\/\/www.acefone.com\/blog\/?p=27402"},"modified":"2026-08-21T13:43:50","modified_gmt":"2026-08-21T13:43:50","slug":"dpdpa-compliance-bfsi-collections-calls","status":"publish","type":"post","link":"https:\/\/www.acefone.com\/blog\/dpdpa-compliance-bfsi-collections-calls\/","title":{"rendered":"Why DPDPA Compliance For BFSI Collections Calls Wins"},"content":{"rendered":"

Compliance and collections leaders worry about DPDPA rules. Most treat DPDPA compliance for BFSI collections calls as a checkbox they audit once and move on.\u00a0That’s\u00a0backward.\u00a0<\/span>\u00a0<\/span><\/p>\n

In our conversations with NBFC and\u00a0fintech\u00a0lenders, the compliant ones move faster, not slower. They pass audits with fewer flags. They win RFPs that compliance laggards lose.\u00a0<\/span>\u00a0<\/span><\/p>\n

Here we\u00a0break down what DPDPA\u00a0requires\u00a0for\u00a0collections\u00a0calls,\u00a0also covering\u00a0where DPDPA conflicts with RBI rules. Getting this right is a business advantage, not just a legal one.<\/span>\u00a0<\/span><\/p>\n

Is DPDPA Compliance\u00a0For\u00a0BFSI Collections Calls Optional?<\/span><\/b>\u00a0<\/span><\/h2>\n

The short answer is no. DPDPA 2023 applies to every BFSI entity that processes personal data. That includes NBFCs, fintechs, and MFIs running\u00a0collections\u00a0calls right now.\u00a0Full enforcement begins around May 2027.\u00a0That’s\u00a0eighteen months after\u00a0the\u00a0<\/span>DPDP Rules 2025<\/span><\/a>\u00a0were\u00a0announced.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

Treating DPDPA as optional until an audit notice arrives is the checkbox trap this piece argues against. Most compliance teams\u00a0haven’t\u00a0run a DPDPA regulatory audit notice checklist against their call flows yet.<\/span>\u00a0<\/span><\/p>\n

Every NBFC, fintech, and MFI becomes a Data Fiduciary*\u00a0under DPDPA. That\u00a0happens\u00a0the moment it collects a customer’s phone number or KYC detail.<\/span>\u00a0<\/span><\/p>\n

*Data Fiduciary:<\/span><\/b>\u00a0an entity that decides why and how personal data gets processed.<\/span>\u00a0<\/span><\/p>\n

Many mid-market NBFCs are likely to cross the\u00a0<\/span>Significant Data Fiduciary<\/span><\/a>\u00a0threshold once\u00a0it’s\u00a0finalized. The exact cutoff\u00a0hasn’t\u00a0been officially notified\u00a0yet.\u00a0Only indicative volume-based estimates\u00a0exist\u00a0so far. Crossing it will add extra audit and DPO obligations, not fewer.<\/span>\u00a0<\/span><\/p>\n

We hear this framed as a compliance cost.\u00a0It’s\u00a0really a scope question. Which of your calls, recordings, and vendor contracts fall under DPDPA today? Most compliance teams\u00a0haven’t\u00a0mapped\u00a0this yet. Waiting for a regulatory notice to find out is\u00a0the\u00a0expensive way to learn it. A quick mapping exercise now is cheaper than a rushed one during an audit.<\/span>\u00a0<\/span><\/p>\n

TL;DR:<\/span><\/b>\u00a0DPDPA already applies to your\u00a0collections\u00a0calls,\u00a0whether\u00a0you’ve\u00a0mapped it yet.<\/span>\u00a0<\/span><\/p>\n

How Long Must BFSI\u00a0Businesses Store\u00a0Call Recordings?<\/span><\/b>\u00a0<\/span><\/h2>\n

This is the DPDPA call recording retention question we get asked most. The short answer is that DPDPA itself sets no fixed number.\u00a0<\/span>Section 8(7)<\/span><\/a>\u00a0makes retention\u00a0purpose-based.\u00a0You keep data only as long as the purpose needs it, unless another law requires longer.\u00a0For BFSI\u00a0collections\u00a0calls, that other law is RBI. RBI sets two different floors depending on what\u00a0you’re\u00a0retaining.<\/span>\u00a0<\/span><\/p>\n

Here’s\u00a0the comparison, sourced directly to RBI rather than a compliance blog.<\/span>\u00a0<\/span><\/p>\n

\"DPDPA<\/p>\n

The practice these rules\u00a0imply\u00a0are\u00a0simple. A call recording follows the six-month floor. The KYC and transaction data behind that account\u00a0follow\u00a0the five-year floor.\u00a0Don’t\u00a0apply one number to both record types.<\/span>\u00a0<\/span><\/p>\n

TL;DR:<\/span><\/b>\u00a0RBI, not DPDPA, sets the retention clock here. Six months for recovery call recordings, five years for\u00a0KYC\u00a0and transaction records.<\/span>\u00a0<\/span><\/p>\n

Do Collections Calls Need Separate DPDPA Consent?<\/span><\/b>\u00a0<\/span><\/h2>\n

Yes, they do. TRAI consent covers your right to call a number. DPDPA consent covers your right to record, store, and process what happens on that call. A\u00a0collections\u00a0call needs a purpose-specific DPDPA consent. That consent\u00a0must\u00a0be separate from the general loan consent captured at onboarding. Bundling the two into one blanket consent form is a common shortcut. It\u00a0doesn’t\u00a0hold up under\u00a0DPDPA.<\/span>\u00a0<\/span><\/p>\n

Most lending consent forms bundle everything into a single checkbox at onboarding. Loan terms, KYC, and communication consent all get lumped together.<\/span>\u00a0<\/span><\/p>\n

Consent Manager:<\/span><\/b>\u00a0a DPDP Rules 2025 mechanism for managing granular, purpose-specific consent. It\u00a0isn’t\u00a0operational yet as of this writing.<\/span>\u00a0<\/span><\/p>\n

DPDPA\u00a0doesn’t\u00a0allow that kind of bundling across distinct purposes. A\u00a0collections\u00a0call, especially one that gets recorded and analyzed, counts as its own processing purpose. That means your\u00a0consent\u00a0language, audit trail, and withdrawal process all need to point back to that purpose. They\u00a0can’t\u00a0just point to the original loan agreement. In practice, this shows up as a short, itemized consent line at the start of the call itself. It plays before the recording starts. Skipping this step is one of the most common gaps we see. It happens when NBFCs treat DPDPA as a one-time paperwork exercise instead of an ongoing call-flow requirement.<\/span>\u00a0<\/span><\/p>\n

TL;DR:<\/span><\/b>\u00a0Collections calls need their own DPDPA consent. General loan consent\u00a0doesn’t\u00a0cover it.<\/span>\u00a0<\/span><\/p>\n

Does DPDPA Compliance Win BFSI Vendor RFPs?<\/span><\/b>\u00a0<\/span><\/h2>\n

Increasingly, yes.\u00a0We’ve\u00a0seen AI-readiness and compliance-readiness show up as explicit line items in BPO and BFSI vendor RFPs. A lender with a clean DPDPA posture skips the slow legal back-and-forth. That back-and-forth is what stalls less-prepared vendors. In our own deals, this shows up most often as RBI and DPDPA compliance questions inside the RFP itself.\u00a0It’s\u00a0not a separate legal\u00a0review\u00a0bolted\u00a0afterward.<\/span>\u00a0<\/span><\/p>\n

We’re\u00a0not citing a market-wide statistic here, because we\u00a0haven’t\u00a0found one specific to BFSI RFPs. This is Acefone’s own operational observation from BFSI and BPO deals\u00a0we’ve\u00a0worked on. A regulatory audit notice is one of the\u00a0highest\u00a0urgency\u00a0triggers we see. It often pushes a compliance or collections leader to evaluate a new vendor.<\/span>\u00a0<\/span><\/p>\n

RFP-readiness:<\/span><\/b>\u00a0being able to answer a procurement team’s compliance questions without a multi-week legal review cycle.<\/span>\u00a0<\/span><\/p>\n

That urgency cuts both ways. It rewards vendors who\u00a0already have\u00a0documented DPDPA posture. It penalizes vendors who need weeks to pull one together. Faster legal sign-off\u00a0isn’t\u00a0a side benefit of good compliance.\u00a0It’s\u00a0often the deciding factor in which vendor gets shortlisted first, well before pricing enters the conversation.\u00a0We’ve\u00a0watched procurement teams shortlist on compliance readiness alone, then negotiate price with whoever clears that bar first.<\/span>\u00a0<\/span><\/p>\n

TL;DR:<\/span><\/b>\u00a0Compliance-readiness increasingly decides which BFSI vendors get shortlisted first, not just which ones pass audits.<\/span>\u00a0<\/span><\/p>\n

Can a Vendor Claim RBI Compliance?<\/span><\/b>\u00a0<\/span><\/h2>\n

No, not in the way many vendors phrase it. RBI licenses and regulates banks and NBFCs. It\u00a0doesn’t\u00a0regulate technology vendors. This holds whether\u00a0you’re\u00a0evaluating a manual dialer or DPDPA voice AI compliance for an automated bot. A vendor can be DPDPA-compliant and DoT-licensed. It can also help its BFSI customers meet their own RBI obligations. It cannot itself be “RBI compliant.”<\/span>\u00a0<\/span><\/p>\n

This distinction matters more than it sounds.\u00a0We’ve\u00a0seen at least one competitor\u00a0market itself\u00a0as fully DPDPA and RBI compliant.\u00a0That claim doesn’t hold up once you check what RBI actually regulates.<\/span>\u00a0<\/span><\/p>\n

Here’s\u00a0what\u00a0<\/span>Acefone<\/span><\/a>\u00a0can\u00a0state\u00a0plainly, because\u00a0it’s\u00a0documented. We are a DoT-licensed Virtual Network Operator. We are DPDPA 2023 compliant, with India-based data residency. We hold ISO 27001:2013 and SOC 2 Type 2 certification, and\u00a0we’re\u00a0CERT-IN VAPT tested.<\/span>\u00a0<\/span><\/p>\n

Our infrastructure gives\u00a0BFSI customers what they need to meet\u00a0critical\u00a0obligations themselves. That means India data residency, audit trails, and a documented consent flow.\u00a0That’s\u00a0a narrower claim than some vendors make.\u00a0It’s also the one we can actually defend if a customer’s legal team asks us to prove it.<\/span>\u00a0<\/span><\/p>\n

What Should Your DPDPA Readiness Checklist Cover?<\/span><\/b>\u00a0<\/span><\/h2>\n

A collections-specific DPDPA checklist covers five things: consent, audit trails, retention, withdrawal, and vendor liability. Getting each one right up front is what makes an audit go quickly instead of dragging for weeks.<\/span>\u00a0<\/span><\/p>\n

    \n
  1. Purpose-specific consent captured at the start of every\u00a0collections\u00a0call, not bundled with loan consent.<\/span>\u00a0<\/span><\/li>\n
  2. A tamper-proof audit trail linking each recording to its consent record.<\/span>\u00a0<\/span><\/li>\n
  3. Retention aligned to the correct RBI floor per record type, six months for call recordings, five years for\u00a0KYC\u00a0and transaction data.<\/span>\u00a0<\/span><\/li>\n
  4. A documented process for handling consent withdrawal and its effect on future contact.<\/span>\u00a0<\/span><\/li>\n
  5. Vendor contracts that explicitly assign deletion and breach-notification\u00a0liability.<\/span>\u00a0<\/span><\/li>\n<\/ol>\n

    None of these five items is exotic. Most NBFCs already have pieces of this in place somewhere. The gap we typically see is that they live in different systems. Different teams own different pieces, with no single audit trail connecting them.<\/span>\u00a0<\/span>That fragmentation is what turns a routine audit into a multi-week scramble. A single owner for all five items closes most of that gap on its own.<\/span>\u00a0<\/span><\/p>\n

    Your Takeaway<\/span><\/b>\u00a0<\/span><\/h2>\n

    DPDPA compliance for BFSI collections calls\u00a0isn’t\u00a0a box to tick once and forget.\u00a0It’s\u00a0an operating discipline that touches\u00a0every\u00a0collections\u00a0call you make. Three things matter most.<\/span>\u00a0<\/span><\/p>\n

    First, DPDPA already applies to your\u00a0collections\u00a0calls today, regardless of when full enforcement begins. Second, RBI sets the retention clock here, not\u00a0DPDPA. Six months for the call recording, five years for the KYC data behind it. Third, compliance-readiness increasingly decides which vendors win BFSI RFPs and which\u00a0ones\u00a0stall in legal review.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    Compliance and collections leaders worry about DPDPA rules. Most treat DPDPA compliance for BFSI collections calls as a checkbox they audit once and move on.\u00a0That’s\u00a0backward.\u00a0\u00a0 In our conversations with NBFC and\u00a0fintech\u00a0lenders, the compliant ones move faster, not slower. They pass audits with fewer flags. They win RFPs that compliance laggards lose.\u00a0\u00a0 Here we\u00a0break down what […]<\/p>\n","protected":false},"author":42,"featured_media":27403,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[289],"tags":[],"class_list":{"0":"post-27402","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-communication-ai"},"_links":{"self":[{"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/posts\/27402","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/users\/42"}],"replies":[{"embeddable":true,"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/comments?post=27402"}],"version-history":[{"count":3,"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/posts\/27402\/revisions"}],"predecessor-version":[{"id":27407,"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/posts\/27402\/revisions\/27407"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/media\/27403"}],"wp:attachment":[{"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/media?parent=27402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/categories?post=27402"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.acefone.com\/blog\/wp-json\/wp\/v2\/tags?post=27402"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}