Home Insights India’s DPDP Act and AI Projects: What to Do Before May 2027
Governance & regulation
India’s DPDP Act and AI projects: what to do before May 2027
Last reviewed: 29 September 2026
Key takeaways
- India’s DPDP Rules were notified in November 2025 and phase in over 18 months; full data-fiduciary obligations apply from 13 May 2027.
- AI projects that use personal data must meet the Act’s rules on notice, consent or legitimate use, purpose limitation, security, breach reporting and individuals’ rights.
- The practical starting point is an inventory of AI use cases that touch personal data.
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India’s comprehensive law on the processing of digital personal data. With its Rules notified in November 2025, it now has dated obligations — and AI projects are among the most exposed, because they often combine personal data from several sources for new purposes.
The timeline
| Phase | Date | What applies |
|---|---|---|
| Phase 1 | November 2025 | Data Protection Board of India established; related provisions in force |
| Phase 2 | November 2026 | Consent manager provisions |
| Phase 3 | 13 May 2027 | Substantive data-fiduciary obligations: notice, consent, security safeguards, breach notification, rights, grievance redressal |
Who it applies to
The Act applies to the processing of digital personal data within India, and to processing outside India connected with offering goods or services to people in India. If your organisation determines why and how personal data is processed, you are a data fiduciary. Vendors processing data on your behalf are data processors — and you remain responsible for what they do.
Where AI projects meet the Act
1
A valid basis for processing.
Personal data may be processed with consent — which must be free, specific, informed, unconditional and unambiguous — or for certain legitimate uses defined in the Act. Using customer or employee data to build or run an AI system requires one of these bases for that specific purpose.
2
Notice.
Individuals must receive a clear notice describing the personal data and the purpose of processing. If AI is a new purpose, existing notices may not cover it.
3
Purpose limitation.
Data collected for one purpose cannot simply be reused for another. Training or grounding an AI assistant on historic customer interactions is a new purpose unless your original basis covers it.
4
Security safeguards.
Fiduciaries must take reasonable security safeguards to prevent personal data breaches. Failure can attract penalties of up to ₹250 crore. For AI, this includes access controls on knowledge sources, logging, and controls on what AI tools can retrieve and display.
5
Breach notification.
Personal data breaches must be reported to the Data Protection Board and to affected individuals. AI systems that expose data they should not — for example, through overly broad retrieval — can create reportable breaches.
6
Rights.
Individuals can seek information about processing, correction, completion, updating and erasure, and can withdraw consent. AI systems must be designed so these rights can actually be honoured — including removing a person’s data from knowledge bases.
7
Retention.
Personal data must be erased once the purpose is served, unless the law requires retention. AI logs and knowledge indexes need retention rules too.
8
Children’s data.
Processing the personal data of children (under 18) requires verifiable parental consent, with restrictions on tracking and targeted advertising.
A practical plan for the next two quarters
1
Inventory
every AI use case that touches personal data — including AI features switched on inside your ERP, CRM and productivity tools.
2
Map the basis
for each: consent, legitimate use or neither. Flag gaps.
3
Update notices and consent flows
where AI introduces a new purpose.
4
Minimise
: remove personal data from AI inputs and knowledge sources where it is not needed.
5
Secure
retrieval: make sure AI tools respect the same access rules as the source systems.
6
Design for rights
: document how you would find, correct or erase a person’s data in each AI system.
7
Extend breach and retention processes
to AI logs and indexes.
8
Review vendor contracts
for AI tools and processors.
DPDP and GDPR together
If you also process data of people in the EU, align both programmes. The two laws differ — the DPDP Act relies mainly on consent and defined legitimate uses rather than GDPR’s wider range of lawful bases — but the operational work of inventory, notice, minimisation, security and rights handling overlaps heavily. Building one AI data-governance process for both is far cheaper than two.
Know where your AI stands before May 2027.
Frequently asked questions
Does the DPDP Act regulate AI directly?
No. It regulates the processing of digital personal data, whatever the technology. AI projects are affected whenever they use personal data.
Is publicly available personal data exempt?
The Act excludes certain personal data made publicly available by the individual or under a legal obligation. Whether a particular dataset qualifies needs careful legal assessment; do not assume that scraped or purchased data is exempt.
What should we do first?
Build the inventory of AI use cases involving personal data. Every other step depends on it.
This article is a summary for planning purposes and is not legal advice.