Not legal advice. This is a plain-language overview to help you ask the right questions. Rules and deadlines change; confirm your obligations with your legal adviser.
Calling teams handle a lot of personal data: names, phone numbers, sometimes income, health or family details. Two sets of rules matter most in India.
The Digital Personal Data Protection (DPDP) Act, 2023
The DPDP Act governs how organisations collect and use digital personal data. Its rules are being brought into force in phases, so check which obligations apply to you today.
Who is who
- Your company decides why and how customer data is used, which makes it the Data Fiduciary.
- A software provider that stores or processes the data on your behalf is a Data Processor, and should be bound by a contract with you.
The ideas that matter day to day
- Purpose and consent. Collect data for a clear purpose, with valid consent or another lawful basis, and use it only for that purpose.
- Data minimisation. Don’t collect fields you don’t need. Every custom field is also a responsibility.
- Accuracy. Keep data correct and let people correct it.
- Rights of the individual. People can ask what data you hold about them, ask for corrections and ask for erasure. They must also have a way to raise a grievance.
- Security safeguards and breach notification. Protect the data sensibly, and report personal-data breaches as the rules require.
- Retention. Don’t keep data longer than the purpose needs.
TRAI rules on commercial calls (DND)
TRAI’s telecom commercial communication regulations let people register their preferences on the National Customer Preference Register (commonly called DND). Promotional calls to numbers that have opted out can lead to complaints and penalties. Businesses are also expected to use the number series and registrations that apply to their type of calls.
Practical steps:
- Know whether your calls are promotional or service/transactional — the rules differ.
- Keep a record of consent where your process relies on it.
- Honour “don’t call me again” immediately.
How VM CRM helps
| Need | In VM CRM |
|---|---|
| Only the right people see customer data | Role-based access enforced on every request; agents see only their own leads |
| Stop data walking out of the door | Agents cannot export; every export is logged with who, when and what |
| Know who did what | Audit log for logins, exports, imports and reassignments |
| Honour opt-outs | A do-not-call flag on each lead, visible in the calling queue |
| Remove leavers instantly | Deactivating a user signs them out on every device |
| Data residency | Hosted in an Indian cloud region |
The CRM supports compliance, but compliance comes from your processes: what you collect, why, for how long, and how you respond to requests.