Is call recording legal in India? A guide for hospitals

Many hospitals record their phone lines “for quality and training”. Patients record calls too, to keep what they were told or to back up a complaint. Both raise the same question, and the honest answer comes in three parts: what the Constitution says, what the courts have done with recordings, and what the DPDP Act will ask of a hospital from May 2027.

What Indian law says about recording a call

India has no statute written specifically about a person recording a call they are part of. The question is decided instead by four bodies of law:

1. The Constitution. Privacy is a fundamental right, as the Supreme Court held in 2017.
2. The Telecommunications Act, 2023. The government may order a message to be intercepted, on the grounds in section 20(2) and following the procedure and safeguards prescribed under it. Whoever “intercepts a message unlawfully” can be jailed for up to three years, fined up to ₹2 crore, or both (section 42(2)), and the offence is “cognizable and non-bailable” (section 42(7)). Both sections have been in force since 26 June 2024, under notification S.O. 2408(E).
3. The law of evidence, as the courts have applied it to recordings for more than fifty years.
4. The DPDP Act, 2023, whose duties start on 13 May 2027. Making a recording is processing under it (section 2(x) lists “recording”), and a recording of an identifiable patient is personal data like any other (section 2(t)).

Recording a call you are on is a different act from tapping someone else’s line. Under the old Telegraph Act, the Supreme Court held that a recorder attached with the permission of the person on the line was not unlawful tampering (the Malkani case, below). The Telecommunications Act, 2023, which now governs interception, does not define “intercept”.

Privacy is a fundamental right. Whom does it bind?

In Justice K.S. Puttaswamy v Union of India, nine judges of the Supreme Court held on 24 August 2017: “The right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution.”

Two passages matter for a hospital. Justice Chandrachud, writing for four of the nine judges, wrote that “Informational privacy is a facet of the right to privacy” and that “The dangers to privacy in an age of information can originate not only from the state but from non-state actors as well.” Justice Kaul added that “Recognition and enforcement of claims qua non-state actors may require legislative intervention by the State.”

The Court has since gone further. In Kaushal Kishor v State of Uttar Pradesh (2023), a Constitution Bench held by majority that rights under Articles 19 and 21 can be enforced against non-State entities, as the Supreme Court recounted in Vibhor Garg v Neha (below). Even so, the detailed rules a private hospital must follow on patient data come from statute, chiefly the DPDP Act.

Tapping has its own line of cases. In 1996, in PUCL v Union of India, the Court held that “Telephone-tapping would, thus, infract Article 21 of the Constitution of India unless it is permitted under the procedure established by law.” That case was about the government listening in. Today, lawful interception needs an order under section 20.

What courts have said about recordings made by one side

India’s leading case on recorded calls began in a hospital. In 1964 a patient died after an appendix operation, and the city’s coroner was accused of demanding a bribe from the doctor who had operated, to clear him at the inquest. A second doctor, who had treated the patient later, complained to the anti-corruption police, who attached a tape recorder to his phone, with his permission, before he rang the coroner. In R.M. Malkani v State of Maharashtra, the Supreme Court held in 1972 that this recording “cannot be said to be illegal because Dr. Motwani allowed the tape recording instrument to be attached to his instrument”, and dismissed the coroner’s appeal.

The Supreme Court has stayed steady on evidence, while High Courts have split on privacy:

The 2025 Supreme Court ruling reversed the Punjab and Haryana High Court, which had called the same recordings “a clear cut infringement of her privacy”. But read what the Supreme Court actually decided. Its answer on privacy rested on section 122 of the Evidence Act, which deals with what spouses say to each other: in a case between a couple, it held, “the right to privacy is not a relevant consideration”. It did not decide whether a business may record its customers without telling them.

Admissible is not the same as lawful

The Delhi High Court put the distinction plainly in Deepti Kapur: “Merely because a court allows evidence to be admitted, does not mean that the person who has illegally collected such evidence is absolved of liability that may arise, whether in civil or criminal law or both”. A recording you could play in court can still be a recording you should not have made.

So the honest answer to “is call recording legal in India?” is: recording a call you are on is not banned by any specific law, recordings are routinely used as evidence, and whether recording someone without telling them breaches their privacy is unsettled. We found no Indian judgment on hospitals recording patients’ calls.

What the DPDP Act changes for hospitals that record

From 13 May 2027, every recorded patient call is processing of personal data under the DPDP Act and the DPDP Rules, 2025. That brings the duties our DPDP guide for hospitals covers in full:

• A lawful ground. Either the caller’s consent, which must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action” (section 6(1)), or one of the narrow legitimate uses in section 7.
• A notice first, if you rely on consent, listing what you collect and why (section 5 and Rule 3).
• Security: access control, logs and encryption or masking, at the minimum (Rule 6), with penalties of up to ₹250 crore for failing to take reasonable safeguards.
• Breach reports: a leaked recording must be reported to the patient and the Data Protection Board without delay, with a full report to the Board within 72 hours (Rule 7).
• Erasure once the purpose is served, unless a law needs it kept (section 8(7)).

Until then, the 2011 IT Rules already treat a person’s “physical, physiological and mental health condition” as sensitive personal data. For hospitals run by companies, firms and sole proprietors, a recording in which a patient describes symptoms is covered by them today.

Five rules for a hospital that records calls

1. Say it before you record it

Announce recording at the very start, in Hindi and English, with the reason, and offer a way out. The Act doesn’t say whether staying on the line after an announcement counts as “a clear affirmative action”, so a spoken yes or an easy way to refuse is safer. Here is an example, written for this guide:

2. Record for one stated purpose, and use it for nothing else

“Quality and training” is a purpose. Marketing is a different one, and needs its own yes. Consent is limited to “such personal data as is necessary” for the specified purpose (section 6(1)).

3. Keep it for a fixed period, then delete it

Write down how long you keep recordings and delete on schedule. From 13 May 2027, Rule 8(3) also sets a floor: personal data and logs of processing are to be kept “for a minimum period of one year from the date of such processing”, then erased unless another law needs them. Read literally, that means a recording made after May 2027 will have to be kept for at least a year. Ask your lawyer how it applies to yours.

4. Restrict who can listen

Give access to named roles only, log every playback, and never let recordings be downloaded to personal phones. If a call-centre or IVR vendor records for you, it is your data processor: you need a valid contract with it (section 8(2)), and you remain responsible for what it does (section 8(1)).

5. Ask whether you need to record at all

If nobody listens to the recordings, ask why you make them. A short written note of each call’s outcome (booked, moved, cancelled, call back) often does the job with far less risk. A recording you never make cannot leak, and needs no retention schedule of its own.

When the patient is the one recording

The DPDP Act does not apply to personal data processed “by an individual for any personal or domestic purpose” (section 3(c)), and the courts accept relevant recordings as evidence. So assume any call to your hospital may be recorded by the caller. Train staff to say nothing on the phone they wouldn’t put in writing: no guesses about a diagnosis, no promises about a doctor’s hours that the schedule doesn’t show, and no comments about other patients.

Where DrMate fits

DrMate’s AI receptionist does not record call audio at all. It keeps a written record of each call for your team, which is patient data like any other; our safety and privacy page explains how it is handled.