# Number Masking and the DPDP Act: A Practical Privacy View for Indian Businesses (2026)

> How number masking fits with the privacy principles in India's Digital Personal Data Protection Act: sharing less personal data, limiting access, retention and security. A general overview, not legal advice.

Source: https://edesy.in/blog/number-masking-and-dpdp-act-india-2026

**India's Digital Personal Data Protection Act, 2023 doesn't mention number masking, but its core duties (use
personal data only for a stated purpose, protect it, erase it when the purpose ends) fit what masking does: people
talk without seeing each other's numbers. Masking supports a privacy program; it doesn't replace one. This is not
legal advice.**

> **Share fewer phone numbers:** [Open the Edesy masking portal](https://masking.edesy.in/?utm_source=edesy.in&utm_medium=blog&utm_campaign=number-masking-and-dpdp-act-india-2026). Set up masked sessions or extension codes for customer-partner calls.

## Why phone numbers are a privacy problem

Marketplaces, delivery apps, home services, classifieds and dating apps all connect two people who need to talk
but don't need each other's number. Without masking, the app hands a customer's number to a rider, technician or
seller, and it stays in their phone long after the job. Once shared, you can't take it back, limit its use or
delete it.

Masking puts a virtual number in between. Each side calls the virtual number, and the platform connects them.
Neither side sees the other's real number, and the link can be ended when the job is done.

## DPDP principles and where masking helps

The table maps general principles in the Act to what masking can contribute. It's a planning aid, not an
interpretation of the law.

| Principle (general) | What it asks of a business | How masking can help | What masking doesn't do |
|---|---|---|---|
| Purpose limitation | Use personal data only for the stated purpose | Numbers are used only to connect the call for that order or booking | Write your notice or purpose statement |
| Sharing only what's necessary | Don't collect or disclose more than you need | Partners never receive the customer's number | Decide which other data you collect |
| Retention and erasure | Erase data once the purpose is served | Sessions expire; extension codes can be deactivated or deleted | Delete data in your own systems |
| Security safeguards | Protect personal data with reasonable measures | Encrypted recording storage, signed links, signed webhooks | Secure your own app and staff access |
| Accountability for processors | Make sure vendors handling data on your behalf act on your instructions | Configurable expiry, recording, routing and logs | Replace your contract with the vendor |
| Rights of individuals | Respond to requests for access, correction and erasure | Per-session history and CSV export help you find records | Run your request process |

## How Edesy masking works

| Feature | What it does |
|---|---|
| Sessions | Pair A and B on a virtual number; route by who is calling; set expiry and max calls; pause, extend or end |
| Webhook routing | Your server decides where each call goes (`masking.route`) |
| Extension codes | One masked number plus a short code; for tags, labels, listings, intercom |
| Two-leg click-to-call | Ring A, then bridge to B, with a masked caller ID |
| Recordings | Per-number toggle; encrypted cloud storage with signed links |
| Events | Signed webhooks for session and call events |
| Logs | Per-session history, analytics, CSV export |

## A privacy-minded masking setup

1. **Define the purpose.** "Let the rider reach the customer about this delivery." Write it down; it drives every
   other choice.
2. **Pick the mode.** Sessions when both people are known; extension codes when the caller isn't (a parcel label or
   a vehicle tag). See [extension code number masking](https://edesy.in/blog/extension-code-number-masking-2026).
3. **Set an end.** Give sessions an expiry and a max-call limit that match the purpose. Deactivate extension codes
   when the shipment, listing or booking closes.
4. **Decide on recording.** Leave it off unless you have a reason. If you record, tell people and limit who can
   listen.
5. **Limit access.** Use workspace roles so only the people who need call logs and recordings can see them.
6. **Verify webhooks.** Check the HMAC signature on every event before acting on it.
7. **Clean up your side.** Masking keeps numbers out of partners' phones, but your own database still holds them.
   Apply your retention rules there too.
8. **Write it into your notice.** Tell customers that calls with partners go through a masked number, and whether
   they're recorded.

## Common gaps masking doesn't close

- **Numbers shown in the partner app.** If your app displays the customer's number next to the call button,
  masking the call doesn't help. Show only the masked number.
- **Numbers in exports.** CSVs shared with partners or agencies can leak what masking protected.
- **SMS and WhatsApp.** Edesy masking is for voice calls. If partners message customers directly, those numbers are
  still shared.
- **Long-lived sessions.** A session that never expires is a permanent shared line.

## Questions to ask any masking vendor

1. Can I set an expiry and a call limit per session?
2. Can I turn recording off per number?
3. How are recordings stored and accessed?
4. Are webhooks signed, and is there a delivery log?
5. Can I export call logs for my own records and requests?
6. What does the vendor do with my data, and what does our contract say?

On the last point, ask for answers in writing and have them reviewed. Edesy doesn't claim any DPDP certification;
you decide whether its features meet your needs.

## Cost

Masked calls are Rs 1.50/min on a 60-second pulse with a 1-minute minimum, plus number rental (Rs 499/month for
mobile or 92-series). Prices exclude 18% GST. See [number masking pricing](https://edesy.in/number-masking/pricing).

## Further reading

- [What is number masking?](https://edesy.in/blog/what-is-number-masking-call-masking-guide-2026)
- [DPDP Act and voice AI](https://edesy.in/blog/dpdp-act-voice-ai-compliance-india-2026)
- [Number masking for marketplaces and gig platforms](https://edesy.in/blog/number-masking-for-marketplaces-gig-platforms-2026)
- The [number masking hub](https://edesy.in/number-masking) and [number masking docs](https://edesy.in/docs/number-masking)

This article is for general information. It isn't legal advice, and the law and the rules made under it can
change. Speak to a qualified adviser about your obligations.

## Frequently Asked Questions

### Does the DPDP Act require number masking?

The Act doesn't name number masking. It sets duties such as processing personal data only for a specified purpose, protecting it with reasonable security safeguards and erasing it when it's no longer needed. Masking is one practical way to share fewer phone numbers, which supports those duties. Take legal advice on what applies to you.

### Is a phone number personal data under the DPDP Act?

A phone number that can identify a person is generally treated as personal data. That's why sharing customers' and partners' numbers with each other deserves the same care as other personal data.

### Does using number masking make my business DPDP compliant?

No single tool makes a business compliant. Compliance covers notices, consent or another lawful basis, security, retention, breach handling and the rights of individuals. Masking reduces how widely phone numbers are shared; the rest is your process.

### Is Edesy certified for DPDP compliance?

Edesy doesn't claim any DPDP certification. What it provides are features you can use in your own privacy program: masked calling, session expiry, per-number recording control, encrypted recording storage with signed links, signed webhooks and exportable logs.

### Should masked calls be recorded?

Only if you have a clear reason, such as dispute resolution or quality review, and you tell people. Recording is a per-number toggle on Edesy, so you can turn it on only where you need it.

### How long should masking sessions last?

As long as the purpose needs and no longer. For a delivery, that might be until delivery plus a short window. Edesy sessions support expiry and a maximum number of calls, and extension codes can be deactivated when the purpose ends.