DPDP Duties for AI Features in SaaS Products
Purpose limits, rights requests and breach notices when AI processes personal data.
Fiduciary or processor
For your own users' data, your company is usually the Data Fiduciary. For data your enterprise customers upload, you are often their Data Processor, acting under contract. Know which role applies to each AI feature, because it decides who gives notice and who answers rights requests.
Purpose and retention
Data collected to provide a feature should not quietly be used for another purpose, such as training. State AI processing in your privacy notice and customer contracts, list sub-processors, and set retention for prompts, outputs and embeddings.
Rights requests and breaches
The DPDP Rules notified in November 2025 give a maximum of ninety days to address access, correction and erasure requests. Erasure must reach vector stores, caches and logs where the law allows. Breaches must be reported to affected individuals and the Data Protection Board. The Act allows penalties of up to ₹250 crore for failing to keep reasonable security safeguards.
- Map personal data in prompts, outputs, embeddings and logs.
- Build deletion that reaches every store.
- Prepare user and Board breach notices.
- Update the privacy notice and contracts.
- Know whether you are fiduciary or processor for each feature.
- Limit purpose and set retention for AI data.
- Rights requests and erasure must reach every store within 90 days.
Trace one user's personal data through an AI feature and list every place it is stored, including embeddings and logs.
Check your understanding
1. What is the maximum time to address a DPDP rights request?
2. Where must erasure reach for an AI feature?
3. What is the maximum penalty for failing to keep security safeguards?
From USD 49 or INR 2,999 a month. A person approves every step.