How long should you keep call recordings in India?

As of September 2026, no Indian law we have found sets a retention period for a real-estate business's sales call recordings. The DPDP Act, 2023 says personal data must be erased once its purpose is no longer served or consent is withdrawn, unless another law requires it to be kept. The DPDP Rules, 2025 add a floor: once they take effect, personal data and processing logs must be kept for at least a year for certain purposes of the State. So keep recordings as long as a written purpose needs them, not less than a year once the Rules apply, and delete them after that. This is not legal advice.

Why keep recordings at all

A recording is the only complete answer to "what was actually said?", and in sales that question comes up more than you would like.

• Complaints. A buyer says they were called after asking not to be, or that the call was spam. TRAI's February 2025 amendments (PDF), opens in a new tab let a consumer complain within 7 days of the call, and the September 2026 amendments (PDF), opens in a new tab add a right to appeal against the resolution of a complaint, within 15 days. The recording shows who called, what was said and whether an opt-out was honoured.
• Disputes over what was promised. A price, a possession date, a parking slot. An agent that answers only from your brochure is easy to check, but only if you can play the call back.
• Quality. When the budget field on a lead looks wrong, the recording and transcript tell you whether the buyer said it, the agent misheard it or the script asked badly.

One thing a recording probably cannot do is stand in for a written enquiry. TRAI's third amendment to the TCCCPR (PDF), opens in a new tab requires an enquiry used as the basis for commercial calls to be made "in writing or through digital means" and kept in a verifiable form, and its explanatory memorandum says the change was made because senders were reading "inquiry" as an oral one. Before relying on a recorded phone enquiry as that basis, ask your operator.

What the law says, as of September 2026

The DPDP Act, 2023

A recording in which a buyer gives their name, number, budget and preferred locality is personal data: the DPDP Act (PDF), opens in a new tab defines it as "any data about an individual who is identifiable by or in relation to such data." The Act's duties follow from that.

• Notice (section 5). The person must be told what personal data is being processed and for what purpose.
• Consent (section 6). Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action". The request must be available in English or any language in the Eighth Schedule to the Constitution, which includes Hindi and Gujarati (PDF), opens in a new tab. Withdrawing consent must be as easy as giving it.
• Legitimate uses (section 7). The Act's own illustration is a property one: a person who messages a real-estate broker for help finding a flat to rent may have her data used to send her options, and once she says she no longer needs help, "Y shall cease to process the personal data of X."
• Security (section 8(5)). Reasonable security safeguards to prevent a personal data breach, including for processing done by a vendor on your behalf.
• Erasure (section 8(7)). Erase personal data when consent is withdrawn or "as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier", and make your vendors erase it too, unless retention is necessary to comply with a law. The Act's example is a bank that must keep identity records for ten years after an account closes because banking law says so.

The DPDP Act glossary entry and our DPDP guide for sales teams cover the Act more widely.

The DPDP Rules, 2025

The DPDP Rules (PDF), opens in a new tab were published in the Gazette on 13 November 2025. Rule 1(4) brings rules 3, 5 to 16, 22 and 23 into force eighteen months after publication. Those cover notice, security safeguards, breach intimation, retention and the rights of data principals, so as of September 2026 they are published but not yet in force. Plan for them now.

• Fixed periods only for three kinds of business. Rule 8(1) and the Third Schedule set an erasure period, three years after the person last engaged, for e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh, and social media intermediaries with at least two crore. A developer or a broker is none of these.
• A one-year floor for everyone. Rule 8(3) says a data fiduciary "shall retain" personal data, associated traffic data and logs of processing "for a minimum period of one year from the date of such processing", for the purposes in the Seventh Schedule, which are uses by the State, and erase them after that unless another law requires more.
• Logs for security. Rule 6(1)(e) includes keeping logs and personal data for a year among the minimum safeguards, so that unauthorised access can be detected and investigated.
• Answering requests. Rule 14(3) requires grievances to be answered within a period not exceeding ninety days.

TRAI

The TCCCPR regulates the call, not your storage of it. We have not found a provision in it that says how long a business must keep its own call recordings. The two-year log requirement in the February 2025 regulations (PDF), opens in a new tab applies to telecom operators' spam-detection systems, not to your calls. The September 2026 amendment adds, in its definition of consent, that nothing in the regulations exempts a sender from the DPDP Act.

Said plainly

There is no retention period in law for a real-estate business's sales call recordings. There is a principle (erase when the purpose is served), a floor once the Rules take effect (a year), and whatever a sector law requires for your particular records. The number in between is yours to choose and to justify.

Consent and notice on a recorded call

Where you call on a consent basis, obtaining recording consent, with a way to withdraw it, is your obligation, not your calling vendor's. In practice:

• Say it at the start. We script each agent's opening with you so that it names your company in its first sentence. If you record, the notice belongs in the same opening, in the language the caller uses.
• Say why. "For quality and for our records" is short and true. The Act expects the purpose to be stated.
• Decide what happens when someone objects. Continue without recording, or end politely and offer another way to reach you. Write the answer into the script before the first call, not after the first complaint.

Where recordings live

Your carrier records calls on its own servers, for a period it chooses, and hands them to your SIP trunking setup by link or webhook. That copy is not your retention policy.

We copy recordings off the carrier into private storage, filed by workspace, and play it back through links that expire. There is no public address to guess. We copy rather than link for three reasons: the carrier's portal link needs a carrier login, our carrier rotates old recordings away eventually, and a client asking for a call from six months ago should not depend on our supplier's retention policy.

Getting that copy right taught us a few things worth checking with any vendor:

• Matching the recording to the right call. Carrier timestamps often arrive with no timezone. Read as UTC, an IST timestamp is five and a half hours out and the recording attaches to a different call, which is worse than no recording at all. We read carrier times in the carrier's timezone, match within a narrow window, and refuse a tie rather than guess.
• Fetching only from the carrier. The address of a recording arrives in a webhook, and the fetch carries a carrier credential. We fetch only from the carrier's own hosts, so the credential cannot be sent anywhere else.
• Checking that audio is audio. A carrier login page returns successfully and would be stored as a silent recording. Check what came back before you keep it.
• Watching for silence. A misconfigured webhook fails without an error. Count recordings against calls every day. Our SIP trunking guide covers the failures on the carrier side.

Ask any vendor where recordings are stored, whether they copy or link, how long playback links last, and whether you can delete one lead's recordings, or all of them, on request.

Who can listen

Recordings hold a buyer's voice, number, budget and sometimes their family's plans. Access should be as narrow as the work allows.

• Scope by account. Every recording belongs to one workspace, and every query is scoped to it.
• Choose who is in the workspace. In BlackWolf, everyone in a client workspace has the same access, recordings included; there are no admin roles inside it. So decide who needs to listen to calls, and keep the workspace to those people.
• Prefer links that expire to downloads. A downloaded file is a copy you can no longer delete when your retention period ends.
• Keep a trail. Rule 6 of the DPDP Rules lists access control and "visibility on the accessing of such personal data, through appropriate logs, monitoring and review" among the minimum safeguards. Ask what your vendor logs.

See security for how BlackWolf stores recordings, and compliance for what the product enforces on a call.

A retention policy you can defend

A sketch, to adapt with your lawyer:

Write it down, apply it to transcripts as well as audio, and make deletion automatic rather than a task someone remembers. An AI voice agent produces a recording and a transcript for every call, so the volume grows faster than any manual clean-up.

This post is part of our telephony series, which starts with SIP trunking explained for Indian businesses. For how recordings fit a property sales workflow, see AI calling for real estate.

What to do next

Write a one-page retention policy using the table above, check it against the DPDP Rules before they take effect, and ask your vendor to show you how a single recording is deleted.