Call Center Compliance in India: TRAI, RBI and DPDP Rules

• Promotional calls must come from the 140 number series and service calls from 1600. Ordinary 10-digit numbers are out for telemarketing.
  
• Five spam complaints in ten days, or just three if the operator's AI system has also flagged the number, can trigger a 15-day bar on outgoing calls.
  
• A customer's enquiry now allows commercial calls for only 7 days, and you must keep the enquiry in written or digital form.
  
• From 1 January 2027, banks and NBFCs can make recovery calls only between 8 am and 7 pm, and must record them and keep the recordings for six months.
  
• The DPDP Act's main duties start on 13 May 2027, including consent, data security and breach reports within 72 hours.
  
• Agents working from home are covered by every one of these rules.

If you manage a telecalling or collections team in India, the regulations you follow have changed drastically since 2025, and they are still getting stricter.

You now need special number series for promotional and service calls. TRAI has tightened how and when businesses can contact customers. The RBI now requires lenders to record recovery calls and keep the recordings for six months. There is also a data protection law, whose main duties take effect from May 2027.

Every business, small or large, has to follow these rules, and they apply to remote and work-from-home telecallers just as much as to office teams.

This guide explains the call center compliance requirements in India in very simple terms and ends with a checklist you can use to see how compliant your team is.

What is call center compliance in India?

For an Indian call center, compliance means following the rules of three regulators.

• TRAI controls outbound calling: which numbers you call from, whether the customer agreed to it, and when complaints get your numbers barred.
• The RBI controls how banks, NBFCs and their agents chase overdue loans, including calling hours and call recording.
• The DPDP Act controls customer data: what you collect, who sees it, how long you keep it, and what happens if it leaks.

Each one expects proof: consent and opt-out records for TRAI, a log and recording of every recovery call for the RBI, and a record of who accessed customer data under the DPDP Act. When agents call from their own phones, that proof is scattered across dozens of handsets. The usual fix is call monitoring, which brings call logs and recordings from every agent’s phone into one place.

Indian call center regulations at a glance

The sections below explain what each rule asks for.

What are the TRAI regulations for call centers in India?

TRAI's rules sit in the Telecom Commercial Communications Customer Preference Regulations (TCCCPR), 2018. TRAI amended them on 12 February 2025 and again on 18 September 2026, and both rounds hit outbound calling teams directly. The February 2025 details below come from TRAI's press release on the amendment.

Which number series must call centers use?

Commercial calls can no longer go out from ordinary 10-digit numbers.

Promotional calls use the 140 series.
Service and transactional calls use the 1600 and 1601 series.

The idea is that a customer can tell what kind of call it is from the number alone. Since September 2026, operators' AI systems won't automatically flag these series as spam, and caller-ID apps can't blanket-tag them either.

How long does customer consent last?

Shorter than most teams assume.

• Consent given to complete an ongoing transaction is valid for 7 days only.
• Since September 2026, a customer's enquiry about a product allows commercial calls for 7 days only. The enquiry must be in writing or through a digital channel, and you must keep a verifiable record of it.
• Implied consent for service calls lasts only as long as the customer's contract with you. After that, you need fresh, explicit consent.
• If a customer opts out, you cannot ask them for consent again for 90 days. They can opt back in on their own at any time.
• If you use auto-diallers, robocalls or AI voice calls, you must declare them, and the numbers you'll use, to your telecom operator in advance. Undeclared automated calls are treated as spam.

Promotional calls still need to be checked against the National Customer Preference Register (the DND list) before dialling.

What happens if customers complain?

Complaints are now much easier to file.

A customer can report a spam call within 7 days, without first registering on DND.

Action against a sender is triggered by 5 complaints in 10 days. Since September 2026, just 3 complaints in 10 days are enough if the operator's AI system has also flagged the number. Customers can also appeal a complaint decision within 15 days.

For the sender, the penalty is loss of telecom access. The first violation bars all outgoing services on all your numbers for 15 days. Repeat violations disconnect every telecom resource you hold, across all operators, for a year, and you are blacklisted. The ₹2 lakh to ₹10 lakh fines you may have read about are imposed on telecom operators for misreporting spam counts, not on businesses.

Can a busy telecalling number get flagged as spam?

Yes, and this is the part most teams miss.

Operators must now watch for numbers with unusually high call volumes, very short call durations and few incoming calls compared to outgoing ones. That pattern describes a typical telecaller's SIM on a heavy day.

Since September 2026, that detection is written into the rules. Operators use AI systems to flag numbers likely to be sending spam and share those flags with each other. If five or more numbers linked to one sender are flagged within 10 days, the operator can re-verify the sender's KYC, carry out a physical check, bar outgoing calls, and disconnect repeat offenders.

For a team running 20 or 30 SIMs, a few careless agents can put every number at risk.TelecomLead's summary of the September 2026 amendment lists the full set of changes.

Team leads should watch the same three numbers for each agent: calls per day, average call duration and the ratio of incoming to outgoing calls. If one agent is dialling 300 numbers a day with 10-second calls and no callbacks, that SIM is at risk, whatever the reason.

Can telecallers use regular mobile numbers?

Sometimes, depending on who you’re calling and why. TRAI’s rules target unsolicited commercial calls, meaning promotional calls to people who never asked to hear from you. Calling back a lead who filled in your form an hour ago is different. So is calling an existing customer about their account. Cold-calling a bought database is exactly what the rules are aimed at.

TRAI hasn’t drawn an exact line between a sales follow-up and telemarketing. Use the points below as a starting guide, and check your setup with a lawyer.

• Cold calls to people you’ve never dealt with should go through a registered 140-series setup. Check every number against the DND list first.
• Calling leads who asked to be contacted carries less risk if you call within 7 days of their enquiry. TRAI now expects that enquiry to be in writing or to come through a digital channel. Keep proof of it, such as the form entry or the WhatsApp message.
• Calls to existing customers about their account or service are usually fine. But their implied consent ends when their contract ends.

The complaint rules cover every number, whatever the call is about. Five complaints in ten days can bar a SIM. If the operator’s AI has already flagged the number, three are enough. One agent who keeps calling people who said no can put the whole team’s numbers at risk.

If you’re weighing SIM-based calling against VoIP, our comparison of VoIP and SIM-based calling covers the trade-offs.

What does RBI require for BFSI and recovery calls?

On 6 August 2026 the RBI issued one set of recovery rules for banks, NBFCs, housing finance companies and small finance banks. They take effect on 1 January 2027, three months later than first proposed, to give lenders time to set up systems and train agents. The details below follow the published text of the directions for small finance banks; the versions for other lenders follow the same pattern.

What time can recovery agents call borrowers?

Between 8 am and 7 pm. Calls outside that window are allowed only if the borrower has asked for them. If a borrower asks you not to call at a particular time, you have to respect that in normal circumstances. Agents must also avoid calling during a death in the family, a medical emergency or a wedding.

Do recovery calls have to be recorded?

Yes. Call recording compliance in India now has a fixed standard for lenders. From 1 January 2027, they must:

1. Log the time and number of every recovery call an employee or agent makes to a borrower or guarantor.
2. Record those calls, plus calls the borrower makes to the number the lender gave them.
3. Tell the borrower the call is being recorded.
4. Keep recordings for six months from the call date, or until any court case is closed.

For a collections team working from home on mobile phones, this is the hardest rule to meet. If recordings sit on an agent's phone and that agent quits, the lender can't produce them. Recordings need to sync to central storage the lender controls.

What counts as harassment on a recovery call?

The directions list practices treated as harsh. They include calling or messaging too often, calling outside permitted hours, threatening or anonymous calls, abusive language, and pressuring a borrower's relatives, friends or co-workers. Agents may discuss the loan only with the borrower or guarantor.

Who is responsible when an outsourced agent breaks the rules?

The lender. Banks and NBFCs must vet recovery agencies, supervise them and check that their targets and incentives don't push agents toward harsh tactics.

Agents need an IIBF Debt Recovery Agent certificate. Every recovery message must include the name, email, phone number and address of the lender's grievance officer.

If you run a DSA or collections agency for a lender, expect these requirements to show up in your contract before January. Our guide on how call tracking ensures compliance for banking DSA agents shows what that looks like in practice.

What does DPDP Act compliance for call centers involve?

The Digital Personal Data Protection (DPDP) Act, 2023 sets the rules for how you handle customer data, from the moment you collect it to the day you delete it. The government notified the DPDP Rules on 13 November 2025. Most duties for businesses start on 13 May 2027. Until then, the older data rules under Section 43A of the IT Act still apply.

Telecalling teams hold a lot of personal data. Every lead list has names and phone numbers. Call recordings capture what customers say. Lending and healthcare teams also store loan or medical details. From May 2027, here’s what the law expects you to do with all of it:

• Clear notice. Customers must be told what data you hold, why, and what service it supports. The notice has to stand on its own, not buried in terms and conditions.
• Easy withdrawal. Withdrawing consent must be as easy as giving it. If a lead says "stop calling me and delete my number", your process has to make that happen.
• Purpose limits. Data collected for one purpose can't be reused for another without consent. A list gathered for home loans is not a list for insurance.
• Security safeguards. The Rules point to encryption, masking, access controls and activity logs, with logs kept for at least a year.
• Breach reporting. If customer data leaks, you must tell the Data Protection Board without delay and send a detailed report within 72 hours. Affected customers must also be told. A lost agent phone with call recordings on it can count as a breach.
• Grievances. Customer complaints about their data must be resolved within 90 days.

Failing to protect personal data with reasonable safeguards can attract penalties of up to ₹250 crore.

The Act protects your employees' data too. If you track agents' calls, read our guide on how to monitor employee call logs legally in India.

Do these rules apply to work-from-home agents?

Yes, all of them, in full. Remote call center compliance follows the same TRAI, RBI and DPDP rules as an office team, because none of them makes an exception for agents working from home. What changes is where things go wrong.

In an office, phones are company-owned, supervisors can hear calls, and customer data stays on company systems. At home, most of that disappears. These are the gaps we see most often in remote telecalling teams:

Monitoring remote agents is part of the answer, but it has to be done openly, with a written policy agents have agreed to. We cover how to do that without damaging trust in building trust when monitoring telesales remotely.

None of this has to slow a remote team down. The habits in our guide to remote sales techniques work just as well inside these rules.

What if you call customers outside India?

Then the customer's country's rules apply on top of Indian ones. For EU customers that means GDPR, with its own consent and breach rules.

US telemarketing falls under the TCPA, which restricts automated dialling and requires prior consent for many calls. If agents take card payments over the phone, PCI-DSS applies wherever you are: card numbers should be masked on screen, never written down, and never stored on the agent's device.

Each of these needs its own review, and the client contract usually spells out which ones apply.

Call center compliance checklist for team leads

Use this to check where your team stands. It's ordered by deadline, and most checks fit into a normal working day like the one in a day in the life of a telecalling team.

Right now (TRAI rules already apply)

• Promotional calls go out from a registered 140 number, and you remove DND numbers from your list before calling
• If you use an auto-dialler, robocalls or AI voice calls, you've told your telecom operator in advance
• You keep written or digital proof of each lead's enquiry, and you call them within 7 days
• When someone says "don't call me", your CRM marks them and stops all calls to them for at least 90 days
• Every week, you check each agent's calls per day, average call length, and how many calls they receive compared with how many they make
• Agents understand that calling people again after they've said "no" can get the whole team's numbers blocked

Before 1 January 2027 (RBI rules for banks, NBFCs and collection teams)

• Every recovery call is recorded, and the borrower is told at the start of the call
• Recordings are saved in one central place for at least six months, not on agents' phones
• You get an alert or report for any recovery call made before 8 am or after 7 pm
• Every recovery agent has passed the IIBF Debt Recovery Agent certification
• Your call scripts and messages include the contact details of the lender's grievance officer

Before 13 May 2027 (when the DPDP Act's main rules start)

• A simple privacy notice tells customers what data you keep and why
• Customers can take back their consent or ask you to delete their data as easily as they gave it
• Each person has their own CRM login, sees only the data their job needs, and their activity is logged
• You've decided who will report a data leak to the Data Protection Board within 72 hours
• When an agent leaves, their access to customer data is removed the same day

Where Callyzer fits

No tool makes a team compliant on its own. Consent, scripts and policies are still your job. What Callyzer handles is the record-keeping that office or remote teams struggle with.

Callyzer runs on the Android phones and SIMs your agents already use.

It logs every call with its time, duration and agent, and syncs call recordings to the cloud, so they don't live only on an agent's phone.

Managers can monitor call volumes and durations per agent, which are the same patterns telecom operators now watch for spam, and pull up any call by date and time when a dispute or audit comes in.

Want to see how this works for your team? Start a free 15-day trial for up to 5 phone numbers.

FAQs

What are the primary regulatory authorities governing call centers in India?

Three regulators set most of the rules. TRAI controls commercial calls, such as which number series you use, how you get consent and what happens after spam complaints. The RBI controls how banks, NBFCs and their agents contact borrowers. The Data Protection Board enforces the DPDP Act, India’s data privacy law. Insurance and investment firms answer to IRDAI and SEBI as well.

What are the data privacy requirements under India’s DPDP Act for remote agents?

The DPDP Act makes no exception for data on an agent’s home phone or laptop. As from 13th May 2027, all companies will have to ensure data collection is limited to what is required and secure with access control and encryption. They will be required to inform the Data Protection Board in case of data breach and submit a report detailing the breach within 72 hours. For remote work force, this means separate login and no list of customers on personal devices.

What is call center compliance in India?

It means following the laws that control how a call center contacts customers and handles their data. In India, that mainly means TRAI’s rules on commercial calls, the RBI’s rules on recovery calls, and the DPDP Act on personal data. It also means keeping proof, such as consent records and call recordings, in case a regulator or customer asks.

What regulations apply to remote call centers in India?

The same ones that apply to office teams:

• TRAI’s TCCCPR covers commercial calls now.
• The RBI’s recovery directions cover collection calls from 1 January 2027.
• The DPDP Act covers customer data from 13 May 2027.

None of them exempts agents working from home, and the business stays responsible for what its remote agents do.

What are the main compliance risks for remote call center agents?

Most problems come from losing control of phones and data. Common examples are call recordings saved only on an agent’s phone, former agents keeping lead lists, and family members overhearing sensitive calls. Recovery calls after 7 pm and repeat calls to people who opted out are also common. That last one can get the whole team’s numbers barred under TRAI’s complaint rules.

What tools help manage call center compliance?

Most teams use a mix:

• A CRM stores consent records and opt-out tags.
• Call monitoring software such as Callyzer logs every call and keeps recordings in central storage instead of on agents’ phones.
• DND scrubbing tools check numbers before promotional calls.
• Two-factor logins protect customer data.

No tool makes a team compliant on its own, so written policies and agent training still matter.