DPDP Act and AI: Consent, Training Data and 2027 Compliance

The DPDP Act and AI meet wherever an AI system touches digital personal data: a chatbot collecting phone numbers, a hiring tool reading CVs, a model trained on customer transcripts. The Digital Personal Data Protection Act, 2023 has no exemption for AI and none for small companies. Under the DPDP Rules, 2025 notified on 13 November 2025, most obligations (notice, consent, security safeguards, breach reporting, children’s data and individuals’ rights) apply from 13 May 2027, and penalties go up to ₹250 crore.

How the DPDP Act and AI fit together: roles and lawful basis

A company that decides why and how personal data is processed is the Data Fiduciary. The AI vendor processing data on its behalf is a Data Processor. The individual is the Data Principal. A company using a vendor’s AI tool on its own customers’ data is normally the fiduciary, and s.8(1) keeps it responsible for the processor “irrespective of any agreement to the contrary”. It can shift the cost to the vendor by contract, not the legal duty.

Every AI use of personal data needs a lawful basis:

• Consent must be free, specific, informed, unconditional and unambiguous, by a clear affirmative action, limited to necessary data (s.6(1)), and as easy to withdraw as to give (s.6(4)). It must follow a plain-language notice that itemises the data and purpose (s.5 and the Rules).
• Legitimate uses under s.7 allow some processing without fresh consent, such as s.7(a) (the purpose for which the person voluntarily gave the data) and s.7(i) (employment, or safeguarding the employer from loss or liability).

A payroll engine fits s.7(i). Feeding employees’ private chats into a model that predicts who will resign is much harder to justify.

Where AI projects usually slip

Most friction between the DPDP Act and AI comes from five habits.

1. Purpose creep. Data collected for one purpose is “already there”, so teams feed it to a new model. A Jaipur diagnostics chain wanting to train a marketing model on patient reports collected for testing needs fresh notice and consent, or properly anonymised data.
2. Scraping on a broad reading of s.3(c)(ii). The Act excludes data the person herself made public, or that someone was legally obliged to publish. It does not cover leaked data or data posted by others, and copyright and website terms still apply.
3. Inaccurate data in decisions. Section 8(3) requires personal data used for decisions about a person to be complete, accurate and consistent. Stale data in a credit or hiring model is a compliance problem.
4. Cosmetic anonymisation. Removing names is not enough if a phone number, address or a mix of age, pin code and employer can identify someone.
5. Staff pasting data into public chatbots. An article assistant at an Indore CA firm pasting a client’s bank statements into a free tool discloses data to a third party with no processor contract. From 13 May 2027 that can be a personal data breach.

Security, breaches, children and Significant Data Fiduciaries

• Security (s.8(5), Rule 6): encryption, masking or tokens; access control; logs and monitoring; backups; and security terms in processor contracts. For AI, add prompts stored by providers, outputs that leak training data and prompt injection attacks.
• Breach (Rule 7): tell affected persons in plain language without delay, inform the Board without delay and send a detailed report within 72 hours. The CERT-In 6-hour clock already applies and is shorter.
• Children (s.9): anyone below 18. Verifiable parental consent; nothing detrimental to the child’s well-being; no tracking, behavioural monitoring or targeted advertising directed at children, subject to limited exemptions in the Rules. An AI tutor that monitors a 15-year-old’s behaviour needs careful analysis.
• Significant Data Fiduciaries (s.10, Rule 13): a DPIA and audit every twelve months, and due diligence that technical measures, “including algorithmic software”, do not risk Data Principals’ rights.
• Rights (ss.11 to 14): access, correction, erasure, grievance and nomination, answered within 90 days. You must be able to find a person’s data inside vendor AI tools too.

Before you train or fine-tune a model on your own data

1. Does the original purpose cover this use? If not, anonymise properly or take fresh notice and consent.
2. Mask financial, health and children’s data in the training set.
3. Test whether the model can reproduce personal data.
4. Decide and record how you will handle erasure requests for data already used.
5. Check sector rules, for example RBI expectations for regulated lenders.

Frequently asked questions

Do the DPDP Act and AI rules apply to small companies?

Yes. The DPDP Act has no exemption based on company size or on the use of AI. Any organisation whose AI tools process digital personal data must have a lawful basis, give notice, keep data secure and report breaches once the obligations apply on 13 May 2027.

Can I train an AI model on customer data in India?

Only if the purpose for which the data was collected covers the training, a legitimate use under s.7 applies, or you take fresh notice and consent. Properly anonymised data that no longer identifies anyone falls outside the Act, but removing names alone is not anonymisation.

Who is liable if an AI vendor leaks our customers’ data?

Your organisation, as Data Fiduciary, remains responsible to customers and the Board under s.8(1), whatever the contract says. A good processor contract lets you recover the cost from the vendor and requires breach notice within hours.

When do DPDP obligations start?

The Board provisions took effect on notification in November 2025 and consent manager provisions on 13 November 2026. The main obligations apply from 13 May 2027. MeitY consulted in early 2026 on shortening this window, but no earlier date had been notified as on 31 October 2026.

Quick quiz

Map your AI uses in AI Law and Governance in India, ₹599, and master the privacy law itself in Data Protection Law: DPDP Act 2023 and DPDP Rules 2025, ₹599.

Sources

• Digital Personal Data Protection Act, 2023, ss.3(c)(ii), 5, 6, 7, 8, 9, 10, 11 to 14, 44(2) and Schedule
• Digital Personal Data Protection Rules, 2025 (notified 13 November 2025), Rules 6, 7 and 13
• Information Technology Act, 2000, ss.43A and 72A; CERT-In Directions of 28 April 2022

This page is for education and general information, not legal advice for a specific case. Law as on 31 October 2026.