India's DPDP Act: AI Data Privacy Requirements for Businesses

Key Takeaways

• The Act applies to digital personal data processed in India, and to processing abroad linked to offering goods or services to people in India.
• The Data Protection Board provisions took effect on 13 November 2025, consent manager rules start on 13 November 2026, and the core obligations follow on 13 May 2027.
• Consent must be free, specific, informed, unconditional and unambiguous, and limited to the data needed for the stated purpose, which rules out vague "AI improvement" wording.
• Rule 6 names encryption, obfuscation, masking and virtual tokens as security measures and requires logs and personal data to be kept for a year for investigations.
• Significant Data Fiduciaries must run yearly impact assessments and audits and check that algorithmic software does not put people's rights at risk.
• Penalties reach up to ₹250 crore for failing to keep reasonable security safeguards.

Many Indian companies have spent the last two years adding AI to support desks, HR, analytics and product features. Much of that work uses customer and employee data collected for something else, sent to models hosted by someone else, under contracts written before the DPDP Rules existed. That gap between law and practice is what are the PII data governance in AI pipelines is meant to close.

This guide explains what the Act and the Rules actually require from AI systems, when each duty begins and how to get ready in the eighteen months the government allowed.

Why the DPDP Act Matters for AI Even Without the Word AI

The Digital Personal Data Protection Act, 2023 received presidential assent on 11 August 2023. Its definition of processing covers collection, storage, structuring, retrieval, combination, use, sharing and erasure. Training a model, building a retrieval index, sending a prompt to an API and storing the output all fit inside that list. India has not passed a standalone AI statute, so for now the DPDP Act is the main binding law shaping how AI uses personal data, as our roundup of AI regulation in 2026 also notes.

The Act covers personal data collected in digital form, or collected on paper and digitised later, when it is processed in India. It also covers processing outside India if it is connected to offering goods or services to people in India. A model provider abroad serving Indian customers through app is inside the frame, which is why AI data residency questions keep coming up in Indian procurement.

One exemption gets misread often. The Act does not apply to personal data that the person concerned made publicly available, or that someone was legally required to publish. The official illustration is a person sharing her views on social media. That is narrower than "anything on the internet," because data posted about someone by a third party is not covered by the exemption, so scraping public pages for training data still needs a careful review under India's data privacy laws.

The DPDP Rules 2025 and the Phased Timeline

The Digital Personal Data Protection Rules, 2025 were published in the Gazette dated 13 November 2025, alongside a notification bringing the Act's sections into force in three steps. Provisions setting up the Data Protection Board took effect that day. The consent manager rules and the Board's related powers begin one year later, on 13 November 2026. Notice, consent, security, breach reporting, children's data, rights and Significant Data Fiduciary duties apply eighteen months after publication, on 13 May 2027.

MeitY consulted industry in early 2026 on shortening that window for some large platforms, but no notification has changed the dates so far.

The government's explainer on the notified Rules summarises the phased approach and the rights involved. Companies also subject to other regimes can compare it with Canada's new AI privacy law.

Most duties land on the same date, so one readiness program can cover them. Almost every row asks you to know where personal data sits inside AI pipeline, which is hard to do without an AI inventory and a map of how data flows through your AI systems.

What the DPDP Act Requires From AI Systems

A lawful basis and an itemised notice for each AI purpose

Under the Act you can process personal data only with consent or for one of the listed legitimate uses. Consent has to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data necessary for the specified purpose. Rule 3 adds that the notice must stand on its own, give an itemised description of the personal data and describe the specific purpose and the goods, services or uses it enables. It must also explain how to withdraw consent as easily as it was given.

For AI teams, that means a purpose "improving our services" will struggle. If customer chats will be used to fine-tune a support model, say so, and build privacy by design into the flow from the start. Legitimate uses, such as employment purposes, are narrow.

Accuracy when AI output drives decisions

Section 8(3) is easy to miss and very relevant to AI. Where personal data is likely to be used to make a decision affecting the person, or shared with another Data Fiduciary, the fiduciary ensure its completeness, accuracy and consistency. Model that scores applicants using stale records creates exactly risk clause targets. Keep human in the loop review for decisions that affect people, and document the data quality checks you run as part of your AI governance framework.

Security safeguards that name masking and tokens

Rule 6 sets minimum reasonable security safeguards. It lists encryption, obfuscation, masking and virtual tokens mapped to personal data, access controls on computer resources, logs and monitoring to detect and investigate unauthorised access, and backups for continued processing. It also requires those logs and the personal data to be kept for one year unless another law says otherwise, and a contract clause requiring the Data Processor to take reasonable safeguards.

Data masking or tokenization before a prompt leaves your network is a safeguard the Rules name directly, and prompt logs you control give the Board the visibility it expects after an incident.

Breach reporting on a 72-hour clock

Rule 7 requires plain-language notice to each affected person without delay, covering what happened, the likely consequences and what they can do. The Board must get an initial description without delay and a detailed report within 72 hours of becoming aware, unless it allows longer on a written request. A prompt containing customer records sent to an unvetted AI tool can be a personal data breach under the Act's definition of unauthorised processing, so your incident plan should cover AI tools explicitly, including shadow AI use by staff.

Erasure when the purpose is served

A Data Fiduciary must erase personal data when consent is withdrawn or when it is reasonable to assume the purpose is no longer served, and must make its processors erase it too. For large e-commerce, online gaming and social media platforms, the Third Schedule sets a three-year inactivity period, with a warning to the user at least 48 hours before erasure. For AI, this reaches beyond databases into vector indexes, cached prompts, fine-tuning sets and vendor logs, the AI training data risks most teams have not mapped.

Children's data and behavioural tracking

A child under the Act is anyone under eighteen. Processing a child's data needs verifiable parental consent, and Rule 10 asks fiduciaries to check that the person consenting is an identifiable adult. The Act also bars tracking, behavioural monitoring and targeted advertising directed at children, and processing likely to harm a child's wellbeing. Recommendation models in education, gaming and consumer apps need a hard look at that line.

Extra duties for Significant Data Fiduciaries

The government can notify companies as Significant Data Fiduciaries based on factors such as the volume and sensitivity of data and the risk to people's rights. They must appoint a Data Protection Officer based in India, appoint an independent data auditor and run periodic impact assessments. Rule 13 makes the assessment and audit yearly and adds a duty to verify that technical measures, including algorithmic software, are not likely to pose a risk to the rights of Data Principals. AI impact assessments shows how to structure that review.

How to Prepare Your AI Stack Before May 2027

Start with discovery. List every AI tool in use, including the unofficial ones, and record which personal data each touches, where it is processed and under which contract. Our guide to AI data discovery covers practical ways to find personal data inside prompts, documents and logs.

Next, fix the paper. Rewrite notices so each AI purpose is itemised, and update vendor contracts so every AI provider acting as your Data Processor is bound to reasonable safeguards, erasure on instruction and prompt breach notice. Remember that the Act keeps you responsible for processing done on your behalf, whatever the contract says, which makes third-party data exposure your problem too.

Then fix the pipeline. Put masking or prompt anonymization in front of external models, keep a year of access logs, and test that you can find and erase one person's data across every AI system within the ninety days the Rules allow for grievances. Teams running large outsourced operations should also read AI literacy for BPO compliance, since staff habits drive many incidents.

Where Questa AI Fits

The DPDP Rules reward companies that can show personal data was protected before it was used. Questa AI gives you that control by detecting and anonymizing names, phone numbers, ID numbers and other personal data in prompts, documents and transcripts before they reach any model, and recording what was protected for your audit file.

Companies that want processing to stay on their own infrastructure can use the tool Questa Blackbox, and outsourcing teams can see how it works in our BPO solutions.

With consent manager rules starting on 13 November 2026 and core duties in May 2027, the companies that start redesigning AI data flows this quarter will have the easiest year.

Frequently Asked Questions

Conclusion

The DPDP Act turns AI data practices into a legal duty with dates attached. Consent and notices must describe AI purposes clearly, safeguards must include measures like masking and logging, breaches must reach the Board within 72 hours, and data must be erased when its purpose ends, including inside the AI systems that copied it.

The calendar is generous but not endless. Consent manager rules start this month, and the core obligations follow on 13 May 2027. Businesses that map their AI data flows, fix their contracts and protect personal data before it reaches any model will meet those dates without rebuilding everything at the last minute.

This article is for general information only and is not legal advice. It reflects the DPDP Act, 2023 and the DPDP Rules, 2025 as published by MeitY and checked in November 2026. Commencement dates and requirements may change through new notifications, so confirm your obligations with qualified counsel.