DPDP Act And AI: What It Means For Global Tech Companies

In brief

India's Digital Personal Data Protection Act, 2023 (‘DPDP Act’) is now fully operational - the DPDP Rules, 2025 were notified on 13 November 2025 and the substantive obligations become fully enforceable on 13 May 2027.

India's Digital Personal Data Protection Act, 2023 (‘DPDP Act’) is now fully operational - the DPDP Rules, 2025 were notified on 13 November 2025 and the substantive obligations become fully enforceable on 13 May 2027. 

The new regulatory framework is a significant departure from the previous one, with monetary penalties of up to INR 250 crore (approx. US$30 million) depending on the nature of contravention.

Key Issues for Global AI & Tech Companies

Consent-First

Unlike the European General Data Protection Regulation, the DPDP Act permits processing only with express consent, or for specifically listed 'legitimate uses'. 

Therefore, data fiduciaries who use a GDPR playbook and offer AI-enabled products will have to re-assess their approach to consent and make a transition to the DPDP Act’s ‘consent’ or ‘legitimate use’ construct (or risk significant monetary penalties). Therefore, a fresh (and urgent!) impact assessment will have to be undertaken to identify (and plug) compliance gaps.

Algorithmic Due - Diligence

The new regime introduces the concept of ‘Significant Data Fiduciaries’ (‘SDFs’). These SDFs are fiduciaries notified by the Central Government, based on parameters such as volume and sensitivity of personal data processed by them, potential risk to data principals and state security. 

SDFs need to ensure that any AI-driven algorithmic software utilized by them does not pose a risk to data principals’ rights, since the liability of any such breach would rest with on them under the new regime. It follows that entities offering AI products and solutions to customers likely to be categorized as SDFs (for example, entities engaged in the financial services sectors) need to immediately self-assess and be prepared for compliance with the DPDP Act and the DPDP Rules, failing which they would risk being unable to render services or offer their products in a legally compliant manner.

Regulation of ‘Synthetic Content’ 

Synthetically generated content (SGC’) is now regulated under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026. Under these rules, significant social media intermediaries have to undertake due diligence and direct users to declare the utilization of any SGCs, as a pre-condition for safe harbor protection. The ripple effect of this will be felt by the service providers who offer these products or services to end-users on such platforms, as implementation of this requirement will rest with them, and may require them to make urgent changes to their systems/offerings.

Way Forward

If you are a foreign entity with an AI-driven business model which is (even remotely) connected to data procured from, or traceable to India, these are the key steps that you should undertake before 13 May 2027:

Data - Mapping

Inventory every Indian personal data flow touching AI systems such as training materials, prompts, logs, telemetry and vendor pipelines. Classify by source, legal basis and destination. You cannot lawfully process what you have not mapped.

Consent

Rebuild notice and consent architecture to DPDP Act specifications with clear, itemized notices (in English and other mandatory prescribed languages) with a consent withdrawal process that is as easy as the consent procurement process. Even legacy data collected pre-enforcement will have to be re-evaluated to ensure the consent remains valid.

SDF Assessment

Evaluatethe risk of being designated as an SDF before the Indian central government's designation notifications are actually issued and understand the obligations it entails, to ensure preparedness. This is important to plan, since designation as an SDF would significantly increase compliance obligations, such as annual data protection impact assessment, audit obligations, algorithmic due diligence, appointment of an independent data auditor and an India-resident data protection officer.

Cross-Border Transfers

Cross-border data transfers are permitted by default, unless a notification is issued restricting transfers to a particular jurisdiction. While no negative list of restricted jurisdictions has been notified yet, it is paramount to keep an eye on regulatory updates, and to ensure cloud and model-hosting arrangements have adequate exit options which account for this potential change.

Compliance - Readiness

DPDP Act and the DPDP Rules require data fiduciaries to: (a) intimate each data principal affected by a personal data breach in a clear and concise manner, without delay; and (b) undertake a 2 (two) stage reporting to the Data Protection Board of India (an immediate intimation of the personal data breach and a subsequent detailed report within 72 (seventy-two) hours). This is an example of compliance obligations under the new regime which requires intentional and timely planning, preparation of controls and response methodologies, compliance and breach-readiness walk-throughs to ensure smooth transition to a DPDP Act-compliant ecosystem.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.