Automated order confirmation calls are generally treated as service calls about the customer's own order, but that doesn't mean anything goes. How the call is classified, whether the number is on the DND list, what hours you call in, what you say, and how you handle the customer's data all matter. This post sets out the questions to ask and sensible defaults to start from.
This is general information, not legal advice. Telecom and data protection rules in India change, and how they apply depends on your business and how your calls are sent. Check the current rules with your telecom provider and a qualified legal advisor before you rely on them.
Defaults built in: COD order confirmation calls call only inside your calling hours (9 am to 9 pm IST by default) and skip numbers on your do-not-call list.
Who sets the rules
Two areas of rules usually matter for automated calls to customers in India:
- Telecom rules on commercial communication, set by TRAI (the Telecom Regulatory Authority of India) and applied through telecom operators. These cover how promotional and service communications are classified, the DND preference register, registration of senders, and what happens when customers complain.
- Data protection rules, under India's Digital Personal Data Protection Act and its rules. These cover how you collect, use and keep personal data such as a customer's name, phone number and order details.
Your telecom provider (the platform that places the calls) operates within the telecom rules on your behalf for some of these steps, but you remain responsible for what you send and why.
Transactional vs promotional calls
The biggest single question is which category your call falls into.
A service or transactional call relates to something the customer has already done: an order they placed, a delivery they're expecting, a payment that's due. A confirmation call that says "this is your order, this is the amount, press 1 to confirm or 2 to cancel" fits this description.
A promotional call tries to sell something: an offer, a discount, a new product.
The line can blur. If your confirmation call adds "and get 10% off your next order", or pushes an upsell, it may no longer be treated as purely transactional. Keep confirmation calls to the order and nothing else, and send offers through channels and consents meant for them.
Practical rules of thumb
- Only call about an order the customer actually placed. Never use the confirmation flow to reach people who haven't ordered.
- Only say what the call is for. Store name, order, amount, confirm or cancel.
- No offers inside the confirmation. Keep marketing separate.
- Call the number the customer gave for that order, not a number from another source.
DND and do-not-call lists
The DND preference register lets people opt out of promotional communication by category. Service calls about a customer's own order are treated differently from promotional calls, but the exact treatment of automated service calls depends on how they are classified and sent.
Sensible defaults:
- Keep a do-not-call check on unless your provider and advisor have confirmed it's not needed for your calls.
- Maintain your own do-not-call list. If a customer asks not to be called again, add their number and honour it across all calls, not just this one.
- Make it easy to opt out. Your support team should know how to add a number to the list.
On Edesy, numbers on your do-not-call list are skipped, and the check is on by default.
Calling hours
Calling at night isn't just discourteous; it generates complaints, and complaints are what bring scrutiny on a sender.
- Use a daytime window. 9 am to 9 pm IST is a common default for order confirmation.
- Night orders wait for the morning. Don't call at midnight to beat a courier cut-off.
- Retries stay inside the window. A retry that would fall at night should move to the next morning.
- Check whether a specific rule applies to your call category and stay inside it.
For timing and retries in detail, read when to call a COD customer.
What to say on the call
- Identify the business at the start, with the name the customer knows from their order.
- State the purpose: confirming their cash-on-delivery order.
- Give a clear choice: confirm or cancel.
- Don't collect sensitive data on a keypad call: no card numbers, OTPs, passwords or bank details.
- Don't threaten or pressure. A customer who cancels should hear a polite confirmation of the cancellation, nothing more.
The default scripts in COD confirmation call script in Hindi and English follow this shape.
Data handling
A confirmation call uses personal data: the customer's name, phone number, order number and amount.
- Use it for the purpose it was collected for: delivering and confirming the order.
- Share only what the call needs. The calling platform needs the phone number, name, order number and amount; it doesn't need the full address or order history for a keypad confirmation.
- Know where it's stored and for how long, including call logs and any recordings.
- Mention order confirmation calls in your privacy policy and order flow, so customers expect the call.
- Secure the connection. Order webhooks to your calling provider should be signed and sent over HTTPS, and store API keys should be stored securely.
Consent and expectation
Customers who expect a call are more likely to answer and less likely to complain.
- Say it at checkout. A line such as "For COD orders, we'll call to confirm before shipping" sets the expectation.
- Say it in the order confirmation message or email.
- Use the store name they know in the call, not a legal entity name they've never seen.
A checklist before you go live
- Calls are about the customer's own order, with no promotional content
- Your telecom provider has confirmed how these calls are classified and sent
- DND or do-not-call check is on, or you have written confirmation it isn't needed
- Calling window is daytime, with night orders moved to the morning
- Retries stay inside the window and stop after a fixed time
- Script names the store and the purpose, and offers confirm or cancel only
- Customers are told at checkout that COD orders get a confirmation call
- Privacy policy mentions confirmation calls and the data used
- Opt-out requests are added to your do-not-call list
- Webhooks are signed and keys are stored securely
For a printable version, use the calling hours and compliance checklist.
How Edesy handles the defaults
COD order confirmation calls are built around these defaults:
- Calling hours of 9 am to 9 pm IST by default, adjustable; night orders are called in the morning.
- Retries stay inside your calling hours, and orders not reached within the give-up time are closed.
- Do-not-call check on by default; numbers on your list are skipped.
- A fresh check before each call, so customers who already cancelled aren't called.
- Signed webhooks from your store, and the script contains only the order, the amount and the confirm or cancel choice unless you change it.
These defaults help, but they don't replace your own check of the rules that apply to your business.