Building AI Systems Around India’s Digital Personal Data Protection Framework

Who does the law make responsible, and for what?

The Digital Personal Data Protection Act, 2023 uses three plain names. A Data Fiduciary determines the purpose and means of processing personal data (section 2(i)). A Data Principal is the individual the data is about (section 2(j)). A Data Processor processes it on a fiduciary’s behalf (section 2(k)). If your business decides why customer information is used and how, you are the fiduciary, even when a vendor’s software does the work.

Personal data means any data about an individual who is identifiable by or in relation to it (section 2(t)). Processing is defined widely, and includes collection, storage, retrieval, use, indexing, sharing and erasure (section 2(x)). Section 3 applies the Act to digital personal data processed within India, and to processing outside India connected with offering goods or services to people in India. Enquiry messages, KYC files, support transcripts and CRM notes are all in scope.

When may an AI system use someone’s personal data?

Section 4 allows processing only for a lawful purpose, which it defines as any purpose not expressly forbidden by law, and only where the person has given consent or one of the certain legitimate uses applies. Two questions, then, not one: is the purpose lawful, and what is your ground for it?

Consent has a shape. Section 6(1) requires it to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. That last phrase is where minimisation begins. Section 6(4) gives a right to withdraw with comparable ease, and section 6(6) requires you to stop, and to cause your processors to stop. Section 6(10) puts the burden on you to prove notice was given and consent taken, so both records belong inside the system.

Notice comes first. Section 5(1) requires it to state the personal data and the purpose, how she may exercise her rights and how she may complain to the Board. Rule 3 of the DPDP Rules, 2025 adds that the notice must be understandable on its own, and must give in clear and plain language at least an itemised description of the personal data and the specified purposes, with a specific description of the goods, services or uses the processing enables.

Section 7 lists the certain legitimate uses. The common one is clause (a): data the person voluntarily provided for a specified purpose, where she has not indicated that she objects. Others cover State functions, legal obligations, court orders, medical emergencies, disasters and employment purposes. It is a defined list, not a general exemption for anything convenient.

How much personal data should the model actually see?

Purpose limitation and minimisation turn into three concrete decisions: what goes into the prompt, what goes into the retrieval index and what is written to the log. Each creates a copy of personal data that must then be protected, found and erased.

• Inventory the personal data each workflow touches: which fields, which documents, which channels.
• Send the fields the task needs rather than the whole customer record.
• Mask or tokenise identifiers the task does not need. Rule 6 names masking and virtual tokens as security measures.
• Decide in writing whether a vendor may use your data to improve its models.
• Record the specified purpose for each workflow, so nobody justifies a use by saying the data was already in the file.

What do the security and breach rules mean for logs?

Section 8(5) requires reasonable security safeguards for personal data in your possession or control, including processing done on your behalf. Rule 6 sets the minimum: encryption, obfuscation, masking or virtual tokens; control of access to the computer resources used; visibility on access through logs, monitoring and review, so unauthorised access can be detected and investigated; backups; retention of those logs and data for one year unless another law requires otherwise; a contract term obliging your processor to take safeguards; and technical and organisational measures to make them effective.

Set that beside the way AI systems are usually built. Prompts, outputs and traces often contain personal data, and once they do they are personal data in your possession. The access rules you apply to the customer database apply to the prompt log too. Decide what is written there before launch, in the same spirit as permissions, logs and approval gates.

A personal data breach is defined broadly in section 2(u): any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises confidentiality, integrity or availability. Section 8(6) requires intimation to the Board and to each affected person, and rule 7 sets out the shape of it.

How long can a system keep the data, and how do you delete it?

Section 8(7) requires erasure when consent is withdrawn, or as soon as it is reasonable to assume the specified purpose is no longer being served, whichever is earlier, unless retention is necessary to comply with a law in force. You must also cause your processor to erase what you gave it. Section 12 separately gives the person a right to correction, completion, updating and erasure on request.

Section 8(8) deems the purpose no longer served when the person neither approaches you for it nor exercises her rights for a prescribed period. Rule 8 and the Third Schedule prescribe those periods for specified classes, such as an e-commerce entity with not less than two crore registered users in India: three years from her last approach or from the commencement of the Rules, whichever is latest, with carve-outs for account access and stored tokens. Rule 8(2) requires at least forty-eight hours’ notice before that erasure.

There is a floor as well as a ceiling. Rule 8(3) requires personal data, associated traffic data and other logs of the processing to be kept for a minimum of one year, for the purposes in the Seventh Schedule, unless another law requires longer. The Rules illustrate it with an e-book platform that keeps order details and processing logs for a year even after the customer deletes her account.

Deletion in an AI system is rarely one button. A person’s data may sit in the application record, the prompt log, the retrieval index, the analytics copy, the vendor’s stored conversations and last night’s backup. Map those places while the system is being built. Our own privacy information page is a short example of the plain tone that suits this.

What changes for children’s data and larger organisations?

A child is anyone who has not completed eighteen years (section 2(f)). Section 9 requires verifiable consent from a parent or lawful guardian before processing a child’s personal data, prohibits processing likely to cause a detrimental effect on a child’s well-being, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. Rule 10 asks for due diligence that the person identifying herself as the parent is an identifiable adult. Rule 12 and the Fourth Schedule exempt certain classes and purposes, subject to conditions.

Under section 10 the Central Government may notify a fiduciary, or a class of them, as a Significant Data Fiduciary, weighing factors that include the volume and sensitivity of personal data processed and the risk to the rights of Data Principals. Such a fiduciary must appoint a Data Protection Officer based in India and an independent data auditor, and carry out periodic impact assessments and audits. Rule 13 makes those annual, requires significant observations to reach the Board, and adds due diligence that algorithmic software used to process personal data is not likely to pose a risk to those rights.

Where do vendors, processors and transfers outside India fit?

Section 8(1) is the sentence to remember when a vendor offers comfortable terms. The fiduciary is responsible for complying with the Act for any processing undertaken by it or on its behalf by a processor, irrespective of any agreement to the contrary. Section 8(2) permits engaging a processor only under a valid contract, and rule 6(1)(f) requires that contract to provide for security safeguards. Outsourcing the work does not outsource the responsibility. Six things belong in the contract:

• The purposes the vendor may process for, and an explicit position on training models with your data.
• Sub-processors, and notice before they change.
• Security measures, and the evidence you can ask for.
• Breach notification to you fast enough to meet the rule 7 timelines.
• Deletion on request and on exit, including logs and derived copies.
• Where processing and storage take place.

On transfers, the Act takes a specific approach. Section 16(1) allows the Central Government, by notification, to restrict transfers of personal data for processing to a country or territory it notifies. Section 16(2) makes clear this does not displace any Indian law giving higher protection or a stricter restriction, so sector rules still bind you. Rule 15 adds that a transfer is subject to requirements the Government may specify about making personal data available to a foreign State, and rule 13(4) allows specified data of Significant Data Fiduciaries to be kept within India. In practice, know which region each provider processes in and keep the ability to change it, which is the vendor lock-in question in another form.

Where should you start, and who enforces this?

Enforcement sits with the Data Protection Board of India, established under section 18. Section 27 lets it direct urgent remedial measures on a breach intimation, inquire into breaches and impose penalties. Section 33 allows the monetary penalties in the Schedule after an inquiry and a hearing, having regard to the nature, gravity and duration of the breach and what was done to mitigate it. The Schedule sets ceilings of up to two hundred and fifty crore rupees for failing to take reasonable security safeguards, up to two hundred crore rupees each for breach intimation and children’s obligations, and up to fifty crore rupees for any other breach.

1. Inventory the personal data each AI workflow touches, including prompts, logs and indexes.
2. Write the specified purpose for each workflow and check your notice covers it.
3. Reduce what the model sees: fields instead of full records.
4. Decide what is written to logs, who may read them and how long they stay.
5. Put the processor contract in place before data moves.
6. Rehearse a deletion request and a breach intimation on paper, with a name against each step.

One design point is easy to miss. Section 8(3) requires completeness, accuracy and consistency of personal data likely to be used in a decision affecting the person or disclosed to another fiduciary. If your system prepares decisions about people, that is another reason to keep a person in the loop with the evidence beside the output. The rest is ordinary discipline, described in what enterprise AI governance means in practice. Our Infrastructure & Governance work covers the access controls, logs and evidence such a review asks for.