India's Digital Personal Data Protection Act became law in 2023, and the DPDP Rules that make it operational were notified in November 2025, with most obligations phasing in over the following eighteen months. For a business that talks to customers on WhatsApp, Instagram and the phone, that deadline is close enough to plan for now.
This is not legal advice, and you should read the Act and Rules with your counsel. It is a practical map of where personal data sits in an ordinary customer conversation — and the questions the law will make you answer about each place.
The Act in one paragraph
If you decide why and how personal data is processed, you are a data fiduciary. You must tell people what you collect and why, in plain language; get consent that is free, specific, informed and given by a clear action (or rely on one of the limited legitimate uses the Act lists); use the data only for that purpose; let people withdraw consent as easily as they gave it; erase the data when the purpose is over; protect it with reasonable safeguards; and report breaches. Penalties run to ₹250 crore for the most serious failures.
Any vendor that processes data on your behalf — your WhatsApp provider, your AI agent, your calling platform — is a data processor. The obligations stay with you.
Where personal data sits in a customer conversation
- The phone number and name
- Personal data the moment you store it, whether it arrived on a form, an ad lead or a WhatsApp message.
- The chat itself
- Messages often contain more than you asked for: addresses, order details, health complaints, account numbers. All of it is personal data you are now holding.
- Call recordings and transcripts
- A recording is personal data; an AI transcript and summary of it is too. These are easy to forget because they are created automatically.
- The fields your team fills in
- Lead stage, notes, custom attributes like budget or course of interest. Your CRM is a personal data store.
- Exports
- The spreadsheet someone downloaded for a campaign last quarter, sitting in a Downloads folder.
Six questions to answer before the deadline
1. What notice does a customer see before you collect?
The web form, the WhatsApp first message, the start of a recorded call. Each is a point where a short, plain notice belongs: what you collect, why, and how to withdraw. A chatbot's first message and a call's opening line are good places for one sentence and a link.
2. Is your consent specific to the purpose?
"I agree to the terms" covering everything is the pattern the Act is designed to end. Consent to be contacted about an enquiry is not consent to marketing broadcasts for a year. Keep the purposes separate, and keep a record of what each person agreed to and when. WhatsApp already requires opt-in for business messaging; treat that opt-in as a purpose-specific consent and record it.
3. Can people withdraw as easily as they gave it?
If someone can opt in with one tap, opting out cannot require an email to a support address. In practice: "STOP" on WhatsApp must actually stop marketing, "don't call me" on a call must actually remove them from calling lists, and both must reach every system that might contact them.
This is where most businesses leak. The person who opted out in the chat is still in last month's exported campaign list.
4. How long do you keep conversations and recordings?
Data has to be erased once the purpose is served, subject to whatever other laws require you to keep. Decide a retention period per type — chats, recordings, transcripts, contacts that never converted — and write it down. "Forever, because storage is cheap" is no longer an answer.
5. Who in your team can see and export what?
Reasonable safeguards include access control. An agent handling sales chats does not need every customer's history, and very few people need the ability to export the entire contact base.
6. What do your vendors do with the data?
Your AI agent processes customer conversations through a model someone else runs. Ask where it is processed, whether it is used for training, how long it is retained and how it is deleted — and get the answers in writing. Nine questions for an AI vendor.
The parts that catch conversation-heavy businesses
- Children's data. Processing a child's data needs verifiable consent from a parent. Coaching institutes, schools and edtech enquiry funnels talk to under-18s constantly. AI for education.
- Health details in chats. Patients describe symptoms when booking an appointment. Collect what the booking needs, and do not let the bot ask for more. AI for healthcare.
- Bought or scraped lists. Calling or messaging people who never gave you their number is a consent problem under DPDP, on top of the existing DND and telemarketing rules. Consent, DND and calling hours.
- Breaches. A breach must be reported to the Data Protection Board and to the affected people. Know in advance who would decide that and how.
A ninety-minute audit
- List every place customer data enters: forms, ads, WhatsApp, Instagram, calls, imports.
- For each, write the notice the customer sees and the consent you record. Gaps go on a list.
- List every system that stores it, including spreadsheets and exports.
- Test an opt-out end to end: send STOP, say "don't call me", and check nothing contacts you afterwards.
- Write a retention period per data type.
- Review who has admin and export rights. Remove the ones nobody can justify.
- Send your vendors the questions above.
How Convarza fits
Convarza does not make you compliant — no tool does — but several controls the Act cares about are part of how it works. Agents see only the conversations assigned to them; managers and admins see the rest. Exporting contacts is admin-only. The Do not call outcome and the DND stage take a person out of calling lists and dynamic campaign audiences automatically, so a withdrawal on a call does not depend on someone remembering. Each chat channel can be set not to create contacts at all, if you do not want a record for every message. And contacts can carry admin-only attributes, for the fields most people should not see. How contacts and lead stages work.