Is Recording Customer Conversations Legal in an Indian Store? DPDP, Consent and What Retailers Must Do

Who is responsible

The retailer or brand that decides to record, and why, is the Data Fiduciary. The software vendor that transcribes and analyses on the retailer's instructions is a Data Processor, bound by contract. The customer is the Data Principal. The fiduciary carries the obligations; it cannot outsource them to the vendor, but it can and should require the vendor to provide the records that discharge them.

What consent has to look like

• Notice first: what is collected, why, how to withdraw, how to complain.
• A clear affirmative action: a tap on the customer's own phone, or a spoken confirmation recorded at the start. Walking past a sign is not consent.
• Specific to the purpose: quality, training and follow-up. Using the recording for anything else needs fresh consent.
• Withdrawable: as easy to withdraw as to give, with the fiduciary stopping processing and deleting on request.
• For minors: from the parent or guardian.

The design choices that make it defensible

1. Consent before capture, never after. Nothing is recorded until the customer has agreed.
2. Decline is one tap and the conversation proceeds unrecorded, with nothing held against the advisor.
3. The advisor's disclosure line is a scored step, so every recording carries evidence that notice was spoken.
4. Audio is deleted after transcription, with the deletion timestamped. The transcript is what is kept.
5. A retention window for transcripts, set by the retailer, enforced automatically.
6. Customers anonymous in every aggregate report. A customer is identified only where they shared a number, for follow-up.
7. Access scoped by role and geography, so an advisor sees their own conversations and a regional head their region.

What about staff consent?

The advisor is also a person whose voice is recorded. Employment contracts and store policy should say that conversations are recorded for quality and training, what is done with the scores, and who sees them. In practice, advisors accept recording when they start and stop it themselves, see every score about themselves, and know the standard. Transparency to staff is both the legal posture and the adoption strategy.

What to be able to produce

If a complaint or a query arrives, the fiduciary should be able to show: the notice the customer saw, the consent record with method and time, the purpose the data was used for, the deletion timestamp for the audio, the retention rule for the transcript, and any withdrawal request and action. A programme designed as above produces all of these per conversation. Most floor processes today cannot produce any of them.