INDIA's AI ambitions are gathering pace, with the India AI Impact Summit earlier attracting delegates from 100 countries and Google’s announcement of a US$15 billion AI hub in Vishakhapatnam and new subsea cable routes signalling the scale of investment ahead. But organisations building and deploying AI must also navigate the law. Their challenge is not to simply expand AI capability, but to establish whether the personal data underpinning it can lawfully be collected, reused, and processed in line with the obligations set out in the Digital Personal Data Protection Act (DPDPA).
Understanding how these two forces converge - accelerating AI innovation on one hand and strengthening individual data rights on the other - is essential to avoiding a car crash when it comes to responsible and future‑proofed growth.
The DPDPA applies to both fully and partially automated processing of personal data, which naturally encompasses AI-driven operations. Companies deploying AI systems that handle personal information – from chatbots processing customer queries to algorithms analysing medical records – must therefore comply with the Act, which mandates that organisations obtain clear, granular consent from individuals before collecting their data, implement robust security measures to prevent data breaches, and enable individuals to access their data and requesting its deletion.
The DPDPA introduces the concept of “data fiduciaries”, meaning any are entity that determines the purpose and means of personal data processing, and imposes specific obligations upon them. For significant data fiduciaries, which the government may designate based on factors such as data volume and sensitivity, additional requirements include appointing data protection officers, conducting periodic audits, and performing data protection impact assessments.
These provisions are particularly relevant for AI companies that process vast amounts of personal information to train and operate their models. The relationship between AI technologies and data protection regulations is multifaceted, presenting both opportunities for innovation and challenges for compliance. Realising this potential while respecting individual privacy requires careful navigation of regulatory requirements.
One of the most significant challenges AI developers face under the DPDPA is the consent requirement. The Act mandates that organisations obtain free, specific, and informed consent before processing personal data. For AI systems, particularly those involving machine learning models that require extensive datasets, this presents practical difficulties. How can developers obtain meaningful consent from every individual whose data appears in massive training datasets, especially when that data may have been collected years earlier for entirely different purposes?
The principle of “purpose limitation” further complicates matters. Under the DPDPA, data collected for one purpose cannot simply be repurposed for training AI models without explicit consent. This constraint could significantly impact companies looking to leverage existing databases to develop new AI applications. A hospital that collected patient records for treatment purposes, for instance, cannot automatically use that same data to train diagnostic AI systems without obtaining fresh consent.
The DPDPA does however contains some notable exemptions that could relieve some of the pressures around consent. The Act exempts data processing for “research, archiving or statistical purposes,” provided such processing doesn’t lead to decisions affecting specific individuals.
And Section 3(c)(ii) of the DPDPA exempts personal data made “publicly available” by individuals or pursuant to legal obligations from the Act’s provisions. This exemption theoretically allows AI developers to scrape public websites, social media platforms, and online directories without triggering DPDPA compliance obligations.
Still, this straightforward-sounding exemption masks considerable complexity. Determining whether data was “voluntarily” made public becomes extraordinarily burdensome for AI companies working with datasets containing millions of records. Additionally,
The DPDPA, while not containing provisions as explicit as the GDPR’s Article 22 (Automated individual decision-making, including profiling), still requires data fiduciaries to use personal data only for specified purposes and implement reasonable security practices.
The nature of many AI systems poses challenges for transparency and accountability. AI systems increasingly make decisions that have profound impacts on individuals’ lives: determining creditworthiness, screening job applications, diagnosing diseases, or even predicting criminal behaviour. When an AI algorithm denies someone a loan or flags them as a security risk, can they understand why? Can they challenge the decision? These questions remain partially unanswered in India’s current framework, though the requirement for data protection impact assessments for significant data fiduciaries suggests some recognition of these concerns.
India is revving its digital engines: its AI ambitions are surging, and regulatory expectations are crystallising. But AI innovation cannot advance without a deliberate and compliant approach to data protection. The DPDPA provides the guardrails; the AI revolution provides the momentum. Those who adapt early will lead. What’s more, a legally compliant organisation will naturally have a more organised dataset, and a more organised dataset can only improve the output of the AI they deploy.
Organisations should begin by mapping their AI related data flows, assessing compliance gaps, and integrating privacy by design into every stage of AI development. Engage your leadership teams, audit your existing datasets, and prepare your governance structures for a future in which AI capability and data protection are inseparable.