DPDPA 2023: what it means for your AI programme

India’s Digital Personal Data Protection Act, 2023 is now part of the operating reality for any organisation handling personal data, and AI programmes sit squarely in its scope. The law is principles-based rather than prescriptive, which gives flexibility but also shifts the burden onto you to show your controls are reasonable and documented.

What the law actually expects

At its core, the DPDPA asks for a clear lawful basis for processing personal data, meaningful consent or a recognised legitimate use, and a set of duties as a Data Fiduciary: protect the data, use it only for the stated purpose, and be able to honour the rights of the people it belongs to. None of this is unusual. What is new for many teams is being able to demonstrate it on demand.

Where AI adds friction

AI complicates three things in particular. Purpose limitation becomes harder when training data is reused across models. Data minimisation collides with the instinct to collect everything “just in case”. And the right to correction or erasure is awkward when personal data has already been baked into a model. Planning for these early is far cheaper than retrofitting them later.

Controls worth putting in place

• A record of what personal data feeds each model, and the lawful basis for it.
• Purpose tagging, so data collected for one use is not silently repurposed for training.
• A documented process for access, correction, and erasure requests that accounts for model artefacts.
• Retention limits and deletion that actually run, rather than living only in policy.
• Vendor checks, since fiduciary duty does not disappear when you use a third-party tool.

A pragmatic sequence

Start with visibility: map which AI systems touch personal data at all. Most teams find the list is longer than expected once embedded and vendor tools are counted. Then attach a lawful basis and an owner to each. Only after that does it make sense to invest in tooling for rights requests and automated retention. Sequenced this way, compliance becomes a series of manageable steps rather than a single overwhelming project.