The Digital Personal Data Protection Act, 2023 is India's first full data protection law, and its rules were notified in 2025. Most obligations phase in over the following months, which gives businesses a window to prepare. If your AI systems touch personal data, from a chatbot that collects phone numbers to a model trained on customer records, the Act applies to them.

The roles the Act creates

The Act calls the organisation that decides why and how personal data is processed a Data Fiduciary, and the person the data is about a Data Principal. If you deploy an AI system on your customers' data, you are almost always the Data Fiduciary, even when the model comes from a vendor. That means the responsibility stays with you.

Where AI raises the stakes

  • Consent and notice: people must be told clearly what data is collected and for what purpose. Reusing data collected for one purpose to train a model for another needs careful review.
  • Purpose and minimisation: collect what the purpose needs, and keep it only as long as that purpose lasts.
  • Rights: Data Principals can ask for access, correction and erasure. Your AI pipeline needs a way to honour those requests.
  • Security and breaches: you must protect personal data with reasonable safeguards and report breaches to the Data Protection Board and the people affected.
  • Children's data: processing children's data needs verifiable parental consent, and tracking or targeted advertising aimed at children is restricted.

Five steps to take first

  • Make an inventory of every system that uses personal data, including AI tools your teams adopted on their own.
  • Map where that data comes from, which purpose it serves and who can access it.
  • Review your notices and consent flows, especially in chatbots, forms and apps.
  • Agree data protection terms with every AI vendor that processes data on your behalf.
  • Set up a simple process for access, correction and erasure requests, and for breach response.

None of this needs a large budget. It needs someone to own it and a clear plan. That is the work our regulation readiness service does with you.