Blog/AI Security

Using AI under the DPDP Act: what Indian companies should check

Review how your AI tools collect, process and store personal data so you can discuss DPDP Act readiness clearly with your legal counsel.

By Sagar Makker · 6 min read · October 2026
In short
The DPDP Act, 2023 governs digital personal data in India, including data your AI tools process.
Map personal data in AI flows, check notice and consent, purpose, vendors, safeguards and breach response.
This is not legal advice. Confirm your specific obligations and timelines with qualified counsel.
The problem

Your sales team pastes customer conversations into an AI tool for summaries, support uses a chatbot that collects phone numbers, and HR is testing AI screening of CVs. Each use involves personal data of Indian individuals. When the board asks whether this is in line with the Digital Personal Data Protection Act, nobody can say with confidence.

The DPDP Act, 2023 and its Rules set out obligations for organisations that decide how digital personal data is processed. AI does not get a special exemption. The practical challenge is visibility: many AI uses start informally, data moves to vendors without review, and nobody has written down why the data is collected or how long it is kept.

Why it happens
01AI tools adopted by teams without a record of what personal data they process
02Notices and consent wording written before AI uses were added
03AI vendors receive personal data without a reviewed processing agreement
04No defined retention, deletion or breach response for data inside AI systems
How to fix it
1
Inventory personal data in AI
List every AI tool and feature, the personal data it touches, whose data it is, where it is stored, and which vendor processes it. Include informal tools staff use.
2
Review notice, consent and purpose
Check with counsel whether your notices explain the AI use, whether consent or another lawful basis applies, and whether the AI use stays within the purpose people were told about.
3
Tighten vendor and security controls
Put processing agreements in place with AI vendors, restrict retention and model training on your data, and apply reasonable security safeguards such as access control, encryption and logging.
4
Plan rights and breach handling
Make sure you can find, correct and erase a person's data inside AI systems, and include AI tools in your breach response plan. Confirm notification duties and timelines with counsel.
Where an AI agent helps
Input
AI tool inventory, data flows, notices and vendor contracts
Agent does
An agent on XDQ AgentOS maps personal data across AI systems and flags gaps for counsel review
Human gate
Legal counsel or DPO confirms each compliance decision
Outcome
A clear, documented picture of personal data in AI use
What to measure
AI tools with personal data mappedAI vendors with signed processing termsData principal requests closed on timeOpen DPDP gaps flagged for counsel
Questions
Does the DPDP Act apply to data we process with AI tools?

In general, yes, if the tool processes digital personal data of individuals and your organisation decides the purpose and means. Exemptions and specific duties depend on your situation, so confirm with qualified legal counsel.

Can we send personal data to an AI vendor outside India?

The Act allows cross-border transfers broadly, subject to restrictions the government may notify and any sector rules, such as those from RBI or other regulators. Review your sector requirements and vendor terms with counsel before transferring.

Is our AI vendor responsible for DPDP compliance?

Usually the organisation deciding why and how data is processed stays responsible, even when a vendor processes it on its behalf. That is why processing agreements, security safeguards and vendor review matter. Confirm your position with counsel.

Keep reading
All posts →
AI Security
Prompt injection explained for business leaders, and how to reduce risk
5 min readRead →
AI Security
Securing AI agents that can take actions in your business systems
5 min readRead →
AI Security
Keeping private documents private in RAG and AI search tools
5 min readRead →

Want this fixed in your business?

Send the workflow. We reply with a scope and a fixed price in two working days.
Send a brief →