DPDP Act and AI: what Indian companies must do before deploying AI agents

If you are planning an AI agent that talks to customers, reads their documents or answers questions from their records, you are planning a system that processes personal data at scale. In India that means the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025.

Most companies we speak to know the Act exists. Fewer have worked through what it means for an AI system specifically. This piece is a practical starting point: the timeline, why AI raises the stakes, and the things to do before go-live.

The timeline in one table

As of today, 23 October 2026, there are just under seven months until the core duties apply. That sounds like a long time. For an AI system that is designed, piloted, built and rolled out across a business, it is not.

The vocabulary you need

• Data principal: the person the data is about. Your customer, patient, borrower or employee.
• Data fiduciary: the organisation that decides why and how personal data is processed. That is you.
• Data processor: an organisation that processes data on your behalf. Your AI vendor, your cloud provider and your model provider are typically processors.

The important point: using a vendor does not move your duties to the vendor. You remain responsible for what your processors do with the data, so your contracts and controls need to reflect that.

Why AI agents raise the stakes

An AI agent is not a database. It reads free text, listens to calls, looks at images and writes new text. That creates risks a traditional system does not have.

• It sees more than it needs. A support agent given a customer’s full record to answer a delivery question is processing far more data than the purpose requires.
• Data flows to third parties. If the agent calls a commercial model API, personal data may leave your environment, and possibly India, with every request.
• Logs become the biggest store of personal data. Prompts, transcripts and outputs are logged for debugging. Without redaction and a retention limit, the log store quietly becomes your largest and least protected copy of customer data.
• It can be manipulated. A crafted message or a planted line in a document can try to make an agent reveal data it should not. This is called prompt injection, and it is a security problem, not just a quality problem.
• It talks. An agent can say something to the wrong person. A voice agent that reads out an account balance before verifying the caller has caused a breach.

None of these is a reason not to build. Each is a reason to design for data protection from the first week, not the last.

Ten things to do before go-live

1. Map the data flow. For each AI use case, draw where personal data comes from, which systems and vendors it passes through, which country each one sits in, where it is stored and when it is deleted. Include logs and backups. If you cannot draw it, you cannot defend it.

2. Fix the purpose and minimise. Write down the specific purpose. Then give the agent only the fields that purpose needs. Redact identifiers such as Aadhaar, PAN, card numbers and OTPs before they reach a model or a log, wherever the task allows.

3. Confirm the lawful basis. Consent is the main basis under the Act. Certain legitimate uses are also listed, for example where a person voluntarily provides data for a specified purpose. Decide which applies to each use case and record why. Do not assume old consent text covers a new AI purpose.

4. Rewrite the notice. Notices must be clear and itemised: what data, for what purpose, and how to withdraw consent or complain. People must be able to read them in English or any of the 22 languages in the Eighth Schedule of the Constitution. If your customers speak Marathi, your notice should be available in Marathi.

5. Tell people they are talking to AI. This is good practice everywhere and expected by many regulators. Say it at the start of every chat and call, and give a clear way to reach a person.

6. Treat children’s data separately. Processing data of anyone under 18 needs verifiable consent from a parent or guardian, and tracking, behavioural monitoring and targeted advertising aimed at children are not allowed. If your agent might talk to students or minors, design for it.

7. Decide where data and models live. Cross-border transfer is allowed, except to countries the government restricts. Sector rules can be stricter, and many regulated businesses choose India-hosted deployments anyway. Know which region each model call is processed in, and read your provider’s retention and training terms for the exact product tier you use. The answer to “is our data used for training?” must be no, in writing.

8. Put security safeguards in place. Encryption, access control, logging of who accessed what, and testing against prompt injection. The Act calls these reasonable security safeguards, and failing to take them carries the highest penalty: up to ₹250 crore per instance.

9. Prepare for a breach. If a personal data breach happens, you must inform the Data Protection Board and each affected person. The Rules require a detailed report to the Board within 72 hours of becoming aware of the breach. Confirm the current rule text with counsel, then write a runbook, name an owner and rehearse it once before go-live.

10. Honour rights and retention. People can ask to access, correct or erase their data and to withdraw consent. Make sure your AI system, including its logs, vector stores and caches, can actually find and delete a person’s data. Set a retention period for every store and enforce it automatically.

Sector rules can be stricter

The DPDP Act sets the floor. Regulated sectors often have more specific rules.

• Banks, NBFCs and payments: the RBI’s outsourcing directions, its data localisation direction for payment system data, and the principles in its FREE-AI framework report of August 2025, which covers board-approved AI policy, human oversight and monitoring.
• Insurers: IRDAI’s information and cyber security guidelines, including where data is stored and how incidents are reported.
• Brokers and market intermediaries: SEBI’s cyber security and record-keeping requirements.
• Healthcare: clinical responsibility rules, and the consent-based sharing model of the Ayushman Bharat Digital Mission where you are integrated with it.

Where a sector rule and the DPDP Act both apply, design for both. Your compliance team should be in the room at the start of the project, not at the launch review.

What to ask your AI vendor

Before you sign, ask any AI vendor, including us, these questions and get the answers in writing.

• Where will our data be stored and processed, by region and by provider?
• Which model providers will see our data, under which terms, and is any of it used for training?
• What is redacted before data reaches a model or a log?
• How long are prompts, outputs, transcripts and logs kept, and who can access them?
• How do you test for prompt injection and data leakage?
• What is your breach process, and how fast will you tell us?
• How do we find and delete one person’s data across the whole system?
• Will you sign a data processing agreement that reflects our duties as data fiduciary?

A vendor who cannot answer these clearly is not ready to handle your customers’ data.

A short checklist

• Data flow mapped for each AI use case, including logs and backups
• Purpose written down and inputs minimised
• Lawful basis recorded for each purpose
• Notice updated, available in English and the languages your customers use
• AI disclosure and a route to a person in every conversation
• Children’s data handled separately, or excluded
• Hosting region and model provider terms confirmed in writing
• Security safeguards and prompt injection tests in place
• Breach runbook written, owner named, rehearsed once
• Access, correction, erasure and retention working across every data store
• Sector rules checked by your compliance team
• Data processing agreements signed with every processor

The short version

The DPDP Act does not stop you from using AI. It asks you to know what personal data your system touches, to use only what you need, to tell people what you are doing, to protect it properly and to be ready when something goes wrong. Those are also the habits of a well-built AI system. If you design them in from the first week, compliance becomes part of the build, not a reason to delay it.