India's DPDP Act and AI Projects: A Practical Checklist

If your AI system touches personal data of people in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) will apply to it. Most of its duties start in May 2027, not today. AI systems copy personal data into training sets, vector stores, prompts, logs and vendor systems, so the work takes time.

This article is general information, not legal advice. Check your own facts with qualified Indian counsel.

Status as of 26 October 2026: The DPDP Rules, 2025 were notified on 13 November 2025 and start in three phases. Board and definition provisions are already in force. Consent Manager registration follows one year after notification, around 13 November 2026. The core duties (notice, consent, security, breach reporting, children, rights, cross-border) follow eighteen months after notification, around 13 May 2027. Some firms count these as 12 November 2026 and 12 May 2027, so confirm the day with counsel. The Data Protection Board was established on paper in November 2025. As of August 2026, LiveLaw reported that no Chairperson or Members had been appointed, and we found no official appointment notice since then.

Who is who in an AI project

The Act covers digital personal data: "any data about an individual who is identifiable by or in relation to such data" (section 2(t)). It applies to processing in India. It also applies outside India when the processing is connected to offering goods or services to people in India (section 3(b)). A foreign SaaS company serving Indian users is in scope.

In an AI project, personal data shows up in more places than the source database:

• Customer documents indexed for RAG, and the text chunks stored next to the embeddings
• Prompts and chat transcripts
• Model outputs that repeat names, phone numbers or account details
• Logs and fine-tuning or evaluation datasets

The Data Fiduciary decides the purpose and means of processing (section 2(i)). That is usually the company deploying the AI system. A Data Processor processes data on the fiduciary's behalf (section 2(k)). Model API providers, cloud and vector database hosts and AI build partners are usually processors. The fiduciary stays responsible for what its processors do (section 8(1)) and may use them only under a valid contract (section 8(2)).

The duties, mapped to AI systems

Consent and notice

Processing needs consent or a "certain legitimate use" (section 4). Consent must be free, specific, informed, unconditional and unambiguous, and limited to the data needed for the stated purpose (section 6(1)). Every consent request needs a notice (section 5). Rule 3 requires an itemised description of the data and the specific purpose.

For AI this means:

• Consent to "provide customer support" is not consent to train a model. Name AI training as its own purpose if you plan to do it.
• Withdrawal must be as easy as giving consent (section 6(4)). You then must stop processing and make your processors stop (section 6(6)).
• For data collected before the Act commences, you must send a fresh notice as soon as reasonably practicable (section 5(2)). Legacy training sets are included.

Legitimate uses

Section 7 lists the uses that do not need consent. They include data a person gave voluntarily for a specified purpose (section 7(a)), legal obligations, medical emergencies and employment purposes (section 7(i)). There is no general "legitimate interests" ground like the one in GDPR. Do not assume product improvement or model training fits section 7.

Two narrow carve-outs matter. Personal data that the person made public herself is outside the Act (section 3(c)(ii)). Law firm King Stubb & Kasiva reads this narrowly: data being findable online is not enough. Research and statistical processing is exempt only if it is not used for decisions about a specific person and meets the Second Schedule standards (section 17(2)(b), Rule 16).

Children's data

A child is anyone under 18 (section 2(f)). You need verifiable parental consent before processing a child's data (section 9(1), Rule 10). You must not do tracking, behavioural monitoring or targeted advertising directed at children (section 9(3)). A chatbot or personalisation model open to the public needs an age gate and a parental consent flow, or a decision to keep children out.

Significant Data Fiduciaries

The government can notify some companies as Significant Data Fiduciaries (SDFs) based on data volume, sensitivity and risk (section 10(1)). Section 10 is not yet in force. An SDF must appoint a Data Protection Officer based in India and an independent data auditor (section 10(2)). Rule 13 adds a Data Protection Impact Assessment and audit every twelve months. It also requires due diligence that "algorithmic software" used on personal data does not risk people's rights. That is a direct hook for AI models. Rule 13(4) allows the government to require that specified personal data stays in India.

Cross-border transfers

Section 16 uses a negative list. Transfers are allowed unless the government restricts a country by notification. We found no such notification as of this date. Rule 15 adds that you must meet any requirements the government sets for making data available to a foreign State or its agencies. Stricter sector laws, for example from financial regulators, still apply (section 16(2)). If you call a model API hosted abroad, record where prompts, embeddings and logs are stored.

Security and breach notification

Rule 6 sets minimum safeguards: encryption, masking or tokenisation, access control, logging and monitoring, backups, and security clauses in processor contracts. After a breach you must tell each affected person without delay (Rule 7(1)). You must also tell the Board without delay, with a detailed report within 72 hours (Rule 7(2)). A prompt-injection attack that leaks personal data from indexed documents counts as a breach (section 2(u)).

Rights of Data Principals

People can ask for a summary of their data and a list of fiduciaries and processors it was shared with (section 11). They can ask for correction and erasure (section 12) and nominate someone to act for them (section 14). You must run a grievance system (section 13) and publish a response period of no more than 90 days (Rule 14(3)).

For RAG and analytics, this means:

• Tag every chunk and embedding with a source document ID and a person or customer ID, so you can find it.
• Erasure must reach the vector index, the document store, caches, fine-tuning sets and processors (section 8(7)).
• Plan for retraining or exclusion lists if personal data is inside model weights.
• Rule 8(3) says you must keep processing logs for at least one year. Agree with counsel how this fits with erasure requests.

Checklist

Penalties

The Schedule to the Act sets maximum penalties per breach (section 33):

Questions to ask your AI vendor

1. Are you acting as our Data Processor only, or do you use our data for your own purposes?
2. Do you train or tune any model on our prompts, files or outputs? Can we switch that off in writing?
3. In which countries are prompts, embeddings, logs and backups stored?
4. Which sub-processors do you use, and how will you tell us about changes?
5. How fast will you tell us about a breach, so we can meet our 72-hour Board report?
6. Can you delete one person's data from indexes, logs and backups, and confirm it?
7. Which security controls do you use, and will you share third-party audit reports?

FAQ

Is the DPDP Act in force for AI projects today?

Only partly. Definitions and Board provisions started on 13 November 2025. Consent Manager rules start around November 2026. The duties that matter most for AI teams start around May 2027. Build deletion, notice and logging in now.

Can we train models on scraped public web data?

Be careful. The exclusion covers data the person made public herself, or data published under a legal duty (section 3(c)(ii)). Scraped datasets usually mix many sources. Assess each source and keep records.

Are embeddings personal data?

The Act does not mention embeddings. If a vector, or the text chunk stored with it, can be linked back to an identifiable person, treat it as personal data. Most RAG stores keep the original text, so the answer is usually yes.

Did the October 2026 order change anything?

The Removal of Difficulties Order, 2026 made two wording fixes. Section 9(1) now reads "child or of a person with disability", and section 10(2)(c)(ii) says "data audit". Law firm reports say it does not add duties or change start dates.

Sources

1. The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette text, Ministry of Electronics and Information Technology
2. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025, Ministry of Electronics and Information Technology
3. India's Digital Personal Data Protection Act: Phased Rollout and Key Compliance Milestones, AZB & Partners
4. India's Data Protection Board: Established In Law, Absent In Fact, LiveLaw
5. MeitY Clarifies Consent and Audit Requirements Under the DPDP Act Through the Removal of Difficulties Order, 2026, LexOrbis
6. How Does the DPDP Act Regulate AI Training and Automated Decision-Making in India?, King Stubb & Kasiva