DPDP Act AI Compliance: A Practical Guide for Indian Companies
What India's Digital Personal Data Protection Act, 2023 means for AI projects, and a practical checklist for building compliant models and GenAI systems.
DPDP Act AI compliance means making sure any AI system that uses personal data of people in India follows the Digital Personal Data Protection Act, 2023. In practice, that requires a lawful basis (usually clear consent), a proper notice, use limited to the stated purpose, support for data principal rights, reasonable security safeguards and a plan for reporting breaches.
The Act does not mention machine learning or large language models by name. It regulates personal data, and AI systems happen to be some of the heaviest users of it. That makes AI teams, not only legal teams, responsible for getting the details right. This article sets out the practical implications as we see them on real projects.
This is general information, not legal advice. The rules under the Act and their interpretation continue to develop, so confirm specifics with qualified counsel before making decisions.
The DPDP Act in brief
The Digital Personal Data Protection Act, 2023 governs the processing of digital personal data in India, and also processing outside India where it relates to offering goods or services to people in India. A few terms matter for AI teams:
- Data principal: the individual the data relates to (for a child, this includes the parent or lawful guardian).
- Data fiduciary: the organisation that decides why and how personal data is processed. If you train or run an AI model on customer data, you are usually the data fiduciary.
- Data processor: an entity processing data on behalf of a fiduciary. Your cloud provider, model API vendor or annotation partner may fall here.
- Significant data fiduciary: a category the government can notify based on factors such as the volume and sensitivity of data processed, with additional obligations such as appointing a Data Protection Officer and conducting periodic audits and impact assessments.
- Data Protection Board of India: the body that handles complaints, inquiries and breach matters, and can impose penalties.
DPDP Act AI compliance: where the obligations bite
AI adds complexity because personal data moves through more stages than a typical application: collection, labelling, feature engineering, training, evaluation, inference, logging and monitoring. Each stage needs to respect the same core principles.
| DPDP principle | What it means for AI systems | Typical question to answer |
|---|---|---|
| Consent and notice | People must be told, in clear language, what data is collected and why | Did our notice cover model training, or only service delivery? |
| Purpose limitation | Data should be used only for the purpose it was collected for | Can we reuse support chat logs to fine-tune a model? |
| Data minimisation | Collect and use only what is necessary | Does the model really need full name and phone number as features? |
| Accuracy | Reasonable efforts to keep data complete and accurate, especially where it drives decisions | How do we correct data that feeds automated decisions? |
| Storage limitation | Erase data once the purpose is served, unless law requires retention | How long do we keep prompts, outputs and training snapshots? |
| Security safeguards | Reasonable measures to prevent breaches | Who can access training data, embeddings and inference logs? |
| Accountability | The fiduciary is responsible, including for processors | Does our LLM vendor contract restrict their use of our data? |
Consent and purpose are the hardest part for AI
The most common issue we see is purpose creep. Data collected to deliver a service is later used to train a model for something else, such as marketing propensity scoring. Under a consent-based framework, that new use generally needs to be covered by the original notice and consent, or by a fresh one.
Consent under the Act is expected to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. Pre-ticked boxes and bundled consent buried in terms of service are unlikely to meet that standard. Individuals can also withdraw consent, and it should be as easy to withdraw as it was to give.
Data principal rights in an AI context
Individuals have rights to access information about their personal data and its processing, to correction and erasure, to grievance redressal, and to nominate someone to exercise their rights in the event of death or incapacity. For AI systems this raises practical engineering questions:
- Can you find every place a person's data lives, including feature stores, vector databases and log archives?
- If someone asks for erasure, can you delete their records from training data for future model versions?
- Do you have a grievance process that can explain, at a reasonable level, how their data is used?
Retraining a model every time one record is erased is rarely practical. A common approach is to remove the data from source and training sets promptly, then ensure the next scheduled retraining excludes it, with that policy documented. Discuss the right approach for your situation with counsel.
Children's data and high-risk processing
The Act sets stricter rules for children's data, including verifiable parental consent and restrictions on tracking, behavioural monitoring and targeted advertising directed at children. If your AI product could plausibly be used by minors, such as in edtech, gaming or consumer apps, treat this as a design constraint from day one, not a later fix.
GenAI and LLM specific risks
Generative AI brings some specific exposures that traditional analytics did not:
- Prompts contain personal data. Users paste customer details, medical notes or ID numbers into chat interfaces. These end up in logs and sometimes in vendor systems.
- Third-party model APIs. Sending personal data to an external model provider makes them a processor. You need a contract that limits their use of the data, including for training their own models, and clarity on where data is stored.
- Retrieval indexes. A RAG system built over internal documents may expose personal data to employees who should not see it, unless access controls are applied at retrieval time.
- Model memorisation. Models fine-tuned on raw personal data can, in some cases, reproduce it. Minimise and mask before training.
If you are weighing architecture choices, our guide to RAG vs fine tuning covers why retrieval often makes data governance simpler than training personal data into model weights.
A step-by-step DPDP compliance checklist for AI projects
Use this as a working list alongside your legal team:
- Map the data. List every personal data field used across the AI lifecycle, its source, where it is stored and who can access it.
- Confirm the lawful basis. For each use, confirm whether consent covers it or whether another basis permitted by the Act applies, as advised by counsel.
- Review notices. Make sure notices describe AI-related uses in plain language, and are available in English or languages listed in the Eighth Schedule to the Constitution, as the Act provides.
- Minimise and mask. Drop fields the model does not need. Pseudonymise or tokenise identifiers before training and in logs.
- Set retention rules. Define how long raw data, training snapshots, prompts, outputs and embeddings are kept, and automate deletion.
- Engineer for rights requests. Build a way to locate, export, correct and erase an individual's data across systems, including AI stores.
- Review processor contracts. Check model vendors, cloud providers and labelling partners for data use limits, security obligations and breach notification terms.
- Harden security. Apply role-based access, encryption, audit logs and secrets management to training pipelines and inference services.
- Prepare for breaches. Have an incident response plan that covers notifying the Data Protection Board and affected individuals, as the Act requires.
- Assign ownership. Name who owns DPDP compliance for each AI system, and review it whenever the model, data or purpose changes.
Strong security operations and cloud controls make several of these steps easier. Our managed services team handles much of this day to day for clients.
Sector overlays: DPDP is not the only rule
For many organisations, the DPDP Act sits alongside sector regulation. Banks and NBFCs follow RBI directions on outsourcing, IT governance and data handling. Healthcare providers must consider clinical confidentiality and health data norms. Global companies may also be subject to GDPR or other regimes for non-Indian users.
The practical approach is to design one set of controls that satisfies the strictest applicable requirement, rather than maintaining separate systems per regulation. Teams in financial services usually find their existing RBI-driven controls give them a head start.
Frequently asked questions
Does the DPDP Act apply to AI models?
The Act applies to the processing of digital personal data, not to AI as a technology. If your AI system collects, trains on, stores or generates outputs from personal data of individuals in India, the relevant obligations apply to that processing. Models built only on anonymised or non-personal data are generally outside its scope.
Can I use customer data to train an AI model under the DPDP Act?
Possibly, but only if the use is covered by a valid basis, usually consent that was specific enough to include it. Reusing data collected for one purpose to train a model for a different purpose is a common compliance gap. Review notices and consent with counsel before training.
Is publicly available data exempt under the DPDP Act?
The Act contains an exemption for personal data that the individual has made, or caused to be made, publicly available, and for data made public under a legal obligation. The scope of this exemption needs careful interpretation, so do not assume all scraped web data is automatically exempt. Take legal advice for your specific case.
What happens if an AI system causes a data breach?
The data fiduciary must notify the Data Protection Board and affected data principals in the manner prescribed under the rules. The Board can inquire into the breach and impose financial penalties where it finds non-compliance, including for failing to take reasonable security safeguards.
Do I need a Data Protection Officer for AI projects?
A Data Protection Officer based in India is a specific obligation for organisations notified as significant data fiduciaries. Other organisations still need to publish contact details of a person who can answer questions about data processing. Many mid-size companies appoint a privacy lead regardless, as good practice.
How Sunday Labs can help
We help Indian and global companies build AI systems where data protection is designed in from the start: data mapping, masking pipelines, access-controlled retrieval, retention automation and rights-request tooling. We work alongside your legal advisers rather than replacing them. Every engagement is founder-led and delivered by senior engineers with experience in regulated industries. If you want a second pair of eyes on an AI project's data flows, get in touch.
