This is a practical checklist, not legal advice. Take advice on your own situation — but take it with these questions already answered, because they are the ones that change how a system is built.
The one thing to understand
Responsibility does not transfer. You decide why customer data is collected, which makes you the Data Fiduciary. Your vendor processes it on your instructions, which makes them a Data Processor. If they mishandle it, your obligation to your customer is unchanged.
That single fact is why the questions below belong in a contract rather than in a conversation.
Before anything is connected
What is the stated purpose? Data collected to book an appointment is for booking appointments. Reusing it for marketing later is a different purpose needing its own basis. Write the purpose down; it constrains the build.
What is the retention period? "Indefinitely" is not an answer. Call recordings in particular accumulate quietly. Decide a window, disclose it, and make sure deletion actually happens rather than being a policy nobody implemented.
Where does the data physically sit? Not "the cloud". A region. If any component runs outside India, that should be a decision you made knowingly and recorded, not something discovered during an audit.
Who are the sub-processors? Every AI system has several — the model provider, the telephony provider, the hosting provider, possibly a transcription service. You are entitled to a list. A vendor who cannot produce one does not know where your data goes.
How is a customer request serviced? Someone will ask what you hold about them, or ask you to delete it. If their data is scattered across a vendor's systems with no retrieval path, that request becomes very hard and the deadline does not move.
What does consent look like in practice? Callers should be told they are speaking to an automated system and that the call is recorded. This is both the legal position and the practical one — expectations set correctly reduce complaints.
The claim to be suspicious of
There is no DPDP certification. The Act provides no certification scheme. A vendor advertising themselves as "DPDP certified" is describing something that does not exist, and it is worth pausing on what else they may be describing loosely.
What a vendor can legitimately offer is concrete: contract to the obligations, name the sub-processors, state where data sits, support you when a customer exercises a right, and delete on exit with confirmation in writing.
Why this is worth doing before the build
Every item above changes architecture. Data residency decides which model you can use. Retention decides how storage is designed. Deletion on request decides whether records are structured to be findable.
Retrofitting any of it is expensive, and retrofitting all of it usually means building again. An hour spent on this list before the proposal is signed is the cheapest hour in the project.
Questions
- Does this apply to a small business?
- The obligations scale with what you process rather than switching on at a headcount. A small business handling health or financial information has more to think about than a larger one handling very little personal data.
- Can we use AI models hosted outside India?
- Generally yes, subject to the restrictions in force. The point is not that offshore is prohibited — it is that it should be a decision you made deliberately and can explain, rather than a default nobody examined.
- What should the contract actually say?
- At minimum: that the vendor processes only on your instructions and for the stated purpose, the retention period, the sub-processor list and notice of changes to it, the data location, support for data principal requests, and deletion with written confirmation on exit.
Want this working on your numbers rather than in an article? We scope it on one call.
Book a Consultation Call