India’s DPDP Act and LumaKol

This page is for businesses that use LumaKol and store or call people in India. India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) and the Digital Personal Data Protection Rules, 2025 (the DPDP Rules) then apply to the personal data of your leads, contacts and callers, and to your own staff’s data.

LumaKol is provided by BlackLens Studio, India. For the leads and contacts you store, your business decides why and how they are used, so under the Act it is the Data Fiduciary, and LumaKol processes that data for you as your Data Processor.

This page explains how LumaKol works and what it does and does not do. It is not legal advice. Your duties depend on your sector, on why you call people and on how you got their details, so take advice from your own lawyer before you rely on it.

The Act was passed in August 2023. The DPDP Rules were notified on 13 November 2025 and come into force in stages:

Most of what follows becomes enforceable on 13 May 2027. LumaKol already works this way, and the controls described below are available today, so you can prepare well before then.

As the Data Fiduciary for your leads’ data, your business is responsible for the following. LumaKol cannot do these for you, because they depend on your relationship with each person.

• Grounds: process a person’s data only with their consent or for one of the legitimate uses in section 7 of the Act, for example a person who voluntarily gives you their number for a stated purpose and does not object.
• Notice: when you ask for consent, give a notice in clear and plain language that stands on its own, itemises the data and the specific purpose, and explains how to withdraw consent, exercise rights and complain to the Board. The person can ask for it in English or any language in the Eighth Schedule of the Constitution.
• Consent: consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the purpose. Keep a record you can show, because the burden of proving consent is on you.
• Withdrawal: withdrawing must be as easy as consenting. When someone withdraws, stop processing their data within a reasonable time and have your processors stop too.
• Accuracy: keep data complete, accurate and consistent where you use it to make a decision about the person or share it with another Data Fiduciary.
• Security: take reasonable security safeguards, as rule 6 describes, and require your processors to do the same.
• Breaches: tell each affected person and the Board, as described under “Personal data breaches” below.
• Retention: erase data once the purpose is served or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too.
• Contact and grievances: publish the business contact of a person who can answer questions about the processing, and answer grievances within the period you publish, at most 90 days.
• Children: see “Children” below.

Separately, TRAI’s rules on commercial calls still apply to how and when you call. See India calling rules.

The Data Processing Addendum forms part of the Terms for every customer and is the contract the Act requires between a Data Fiduciary and its Data Processor. Under it, LumaKol:

• processes your leads’ data only to provide the Service on your instructions, and never for its own purposes, advertising or model training;
• protects it with the safeguards rule 6 describes: encryption in transit and at rest, a second layer of encryption for secrets, organisation-scoped access, staff access limited and logged, multi-factor authentication for staff, encrypted backups, and logs kept for at least one year;
• tells you of a personal data breach within 24 hours of becoming aware of it, with the details you need for your own notices, and helps you prepare them;
• erases your data when you delete it, close the workspace or ask us to, including after a person withdraws consent;
• helps you answer requests the product cannot handle, including those from a person’s nominee;
• uses only the sub-processors listed in the DPA, on terms that protect the data in the same way.

If a breach affects personal data in your workspace, the duties and the deadlines are:

The Board may extend the 72 hours on request. Keep a record of each breach and what you did, since the Board can ask for it.

The people whose details you store can ask your business for a summary of their data and of the processing, for the identities of every Data Fiduciary and Data Processor you have shared it with and what you shared, and for correction, completion, updating or erasure. They can also name a nominee to act for them after their death or incapacity, and they can raise a grievance.

For data held in LumaKol, your Data Processors are LumaKol and the sub-processors listed in the DPA. If one of these requests reaches us, we pass it to you without delay and help you answer it; we do not decide it ourselves. You must answer within the period you publish, at most 90 days, and the person must try your grievance process before going to the Board.

A child under the Act is anyone under 18. Before you store or process a child’s personal data you must obtain verifiable consent from a parent or lawful guardian, check that the person giving it is an identifiable adult, and you must not track or monitor children’s behaviour or target advertising at them. The Rules exempt some purposes, such as educational institutions and healthcare, within limits.

LumaKol does not know who your leads are. If your business may hold children’s data, for example an education business calling students, set up verifiable parental consent before their details reach LumaKol, and delete any child’s record you hold without it.

The LumaKol application runs on servers in Singapore and the database is hosted in Japan; recordings, voice notes and visit photos stay in your team members’ own Google Drive. Section 16 of the Act allows personal data to be processed outside India except in countries the Government of India restricts by notification, and none of these countries is restricted today. If one becomes restricted, LumaKol will stop transferring data there and move it. Sector rules can be stricter, so if a regulator requires your data to stay in India, ask us at privacy@lumakol.com before you sign up so we can tell you honestly whether we can meet it.

The Government can notify a business as a Significant Data Fiduciary, based on the volume and sensitivity of the data it processes and the risks involved. A Significant Data Fiduciary must also appoint a Data Protection Officer based in India, appoint an independent data auditor, carry out a Data Protection Impact Assessment and an audit every year, and check that its algorithms do not put people’s rights at risk.

If your business is notified, LumaKol will provide the information about its processing that your assessments and audits need. LumaKol itself has not been notified as a Significant Data Fiduciary.

The Data Protection Board of India can impose penalties for each breach of the Act, up to:

The Board sets the amount by the nature, seriousness and duration of the breach, the data affected, whether it was repeated, any gain made or loss avoided, and the steps taken to limit it.

Questions about this page or about how LumaKol processes your data: privacy@lumakol.com. For our own processing in India, the same address reaches our Grievance Officer, who acknowledges a grievance within 24 hours and resolves it within 15 days.

The binding terms are the Terms of Service, the Data Processing Addendum and the Privacy Policy.