DLT, DND and outbound voice bots in India: what the obligations actually are
A plain-language primer on the regulatory layer under automated outbound calling in India — who carries the obligation, what it means for a pilot, and the questions to settle in writing.
For buyers and builders·11 min read·
Teams building outbound voice bots in India usually discover the regulatory layer in week three, somewhere between a working prototype and a launch date. It is not a formality, it is not something the vendor quietly handles, and it is not fast.
The single most useful thing to internalise: the obligation attaches to the business placing the calls, not to the technology placing them. Automating your outbound does not move the responsibility to your automation vendor, any more than hiring a call centre would.
The three moving parts
1. Registration, commonly called DLT
India’s telecom regulator requires commercial communication to run through a registered chain. In practice that means the entity sending it is registered, and the content follows approved patterns, all recorded on a distributed ledger the operators maintain — which is where the DLT name comes from.
Most people meet this first through SMS, where template approval is unmissable. The same registration apparatus governs commercial voice calling, and the practical consequence is the same: there is an approval queue between you and your first call, and it is measured in days to weeks rather than minutes.
2. Preference registries — DND
Subscribers can register preferences about receiving commercial communication, at varying granularity. Before a commercial campaign dials a list, that list has to be checked against those preferences and the registered numbers removed.
Two things people get wrong here. First, scrubbing is not a one-time cleanup— preferences change, so a list scrubbed last quarter is not a scrubbed list. Second, consent and preference are different questions. Someone who gave you their number for one purpose has not necessarily agreed to be called for another.
3. Consent, and what it was for
Underneath both sits the ordinary question of whether you have a lawful basis to contact this person for this purpose. India’s data protection regime has sharpened this considerably: consent is expected to be specific, informed, and revocable — and you should expect to demonstrate it rather than assert it.
For voice bots this has a sting in the tail. If you record calls — and you almost certainly will, because you need the recordings to improve the bot — you are collecting personal data with a purpose, a retention period and a deletion obligation attached. The transcript is not safer than the audio. It is often worse, because it is searchable.
What this does to your timeline
The reason to care during vendor selection, rather than after, is that this runs on a clock you do not control:
- Registration is a queue. It does not compress because your launch date moved.
- It is sequential with your build, not parallel. You cannot dial real numbers to test at volume until it clears.
- Legal review is its own queue. Consent language, retention periods and the recording notice all need sign-off from people with their own backlog.
A vendor quoting six weeks to production is quoting their six weeks. If registration and legal review have not started, that clock has not started either. This is the single most common reason a voice AI pilot slips a quarter, and it has nothing to do with the technology.
Who does what — settle this in writing
Vendors differ enormously here, and the difference rarely appears on a pricing page. Some Indian platforms carry the telephony relationship and will handle registration and scrubbing as part of the service. Global platforms typically hand you an API and assume you have sorted it out. Both are legitimate; buying the second while assuming the first is not.
| Question | Why it decides something |
|---|---|
| Who holds the telecom registration? | Determines whether you are joining an existing chain or starting one. |
| Who scrubs the list, and how often? | Per-campaign scrubbing against a current registry is a different service from a one-time import check. |
| Where are recordings stored, and for how long? | Drives residency, retention and your deletion obligation. |
| Who redacts personal data from transcripts? | If the answer is you, that is engineering work nobody has scheduled — and it gates anything you want to use for training. |
| How is the recording notice delivered? | It has to be in the call flow itself, in the caller’s language, before anything is recorded. |
| What happens on an opt-out mid-call? | The bot must handle “stop calling me” and that has to propagate to your list. Many demos cannot. |
Design decisions that make compliance easier
A few choices materially reduce the surface, and they are cheap if made early:
- State the recording notice first, in the caller’s language. Not buried, not in English only when the call proceeds in Hindi.
- Make opt-out a first-class intent, not a fallback into a human transfer. Test it explicitly — it is one of the easiest things to get wrong and one of the worst to get wrong.
- Redact at write time, not at read time. Card numbers and identifiers should not enter storage in the first place. Redacting on the way out means the raw data still exists.
- Set a retention period you can defend and enforce it automatically. “We keep everything” is not a retention policy, and it converts a small incident into a large one.
- Keep an audit trail of consent — which number, which basis, when, for what. You need to produce this, not describe it.
The honest summary
None of this makes outbound voice AI a bad idea in India. It makes it a project with a regulatory path running alongside the engineering one, where the regulatory path is slower and starts earlier.
Teams that treat it as a launch checklist item lose a quarter. Teams that start it the same week they start the pilot usually do not.
Related
Compliance capabilities are recorded per vendor in this directory — you can filter to providers claiming DND and DLT handling, with the proof level shown. Data residency is a hard filter in the matcher, because for regulated buyers it is genuinely non-negotiable.