How Does the DPDP Act Regulate AI Training and Automated Decision-Making in India?

Introduction

The rapid adoption of artificial intelligence (“AI”) has brought data protection considerations into the design, training and deployment of AI systems. AI models may be trained using datasets containing names, images, text, identifiers, behavioural information or other data that can relate to identifiable individuals. AI systems may also process personal data when they are deployed for purposes such as recruitment, credit assessment, insurance, healthcare, customer profiling or content moderation.

This raises two important questions: Does India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) apply to AI training? And what does it require when AI systems are used to make decisions affecting individuals?

The DPDP Act does not contain a separate chapter dedicated to AI. However, its provisions apply to the processing of digital personal data, and “processing” is defined broadly enough to cover automated operations performed on digital personal data. Consequently, where personal data is used to train, test, fine-tune or operate an AI system, the relevant processing may fall within the DPDP framework.

The position is subject to an important qualification: not every AI dataset contains personal data, and not every AI activity necessarily falls within the DPDP Act. The first step is therefore to determine whether the information being processed is “personal data” within the meaning of the Act and whether the processing falls within its territorial scope or an applicable exemption.

The DPDP Act and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) are also being implemented in phases. The substantive provisions of the Act are scheduled to take effect on 13 May 2027, while certain institutional provisions came into force earlier. The DPDP Rules similarly adopt a staggered commencement framework. (meity.gov.in)

This article examines the application of the DPDP framework to AI training and automated decision-making, and identifies practical compliance considerations for organisations developing or deploying AI systems in India.

Does the DPDP Act Apply to AI Training?

The DPDP Act defines “processing” broadly to include an automated operation or set of operations performed on digital personal data, including collection, storage, use, sharing and related activities. Accordingly, where an organisation processes personal data as part of an AI training pipeline, such processing may fall within the DPDP Act.

For example, an organisation may process personal data when it:

• collects datasets for AI model development;
• stores or cleans training data;
• labels or annotates personal data;
• uses personal data to train or fine-tune a model;
• evaluates a model using personal data;
• transfers training datasets to vendors or cloud providers; or
• deploys a model that processes personal data.

However, AI training is not automatically regulated merely because it involves large datasets. The relevant question is whether the data constitutes “personal data” and whether the processing falls within the territorial scope of the Act. The Act applies to digital personal data processed within India and may also apply to processing outside India where such processing is connected with offering goods or services to Data Principals in India, subject to the statutory framework.

What Counts as Personal Data in an AI Training Dataset?

Under the DPDP Act, personal data means any data about an individual who is identifiable by or in relation to that data. AI datasets can create particular challenges because information that appears innocuous when viewed individually may contribute to identification when combined with other information.

For example, text, photographs, metadata, account identifiers or location information may constitute personal data where an individual is identifiable from the information. Organisations should therefore assess AI datasets at the level of the information actually processed rather than assuming that a dataset is outside the DPDP Act simply because it is publicly accessible, large-scale or partially anonymised.

Does the DPDP Act Apply to Publicly Available Data Used for AI Training?

This is one of the most important questions for generative AI developers. Section 3(c)(ii) of the DPDP Act excludes certain personal data that has been made or caused to be made publicly available by the Data Principal herself or by a person under an obligation under a law to make such personal data publicly available.

The exclusion is therefore narrower than a general “publicly available data” exception. The fact that information can be found on the internet does not, by itself, establish that the information falls within this statutory exclusion. For instance, personal information published directly by an individual may fall within the exclusion in appropriate circumstances. By contrast, the fact that information has been scraped from a website or social media platform does not automatically mean that the data is outside the DPDP Act.

AI developers should therefore undertake a source-by-source assessment of training datasets rather than treating all publicly accessible information as freely reusable personal data.

What Is the Lawful Basis for AI Training Under the DPDP Act?

The DPDP Act permits processing of personal data on the basis of consent or for specified “certain legitimate uses” under Section 7. Unlike the GDPR, the DPDP Act does not contain a general private-sector “legitimate interests” ground that organisations can invoke for any balancing exercise. For AI developers, the appropriate legal basis will depend on the nature and purpose of the processing.

Consent

Where consent is relied upon, the DPDP Act requires consent to be free, specific, informed and unambiguous, with a clear affirmative action. Consent is also capable of being withdrawn. The purpose described to the individual is therefore important. If personal data was originally collected for one purpose, organisations should not automatically assume that the same consent covers an unrelated AI training purpose.

The DPDP Rules further require notices to be presented independently and in clear and plain language, including a description of the personal data and the specified purpose or purposes of processing. These notice provisions, however, are scheduled to come into force as part of the phased implementation of the Rules.

Certain legitimate uses

Section 7 contains specified circumstances in which personal data may be processed without consent. These include certain employment-related processing, medical emergencies, government functions and other specified circumstances. There is no general commercial AI-training exemption under Section 7 merely because the processing is commercially useful or technologically innovative. An organisation should therefore identify the specific statutory ground applicable to its processing rather than assuming that AI development itself constitutes a legitimate use.

Is There an Exemption for AI Research?

Yes, but it is conditional. Section 17(2)(b) of the DPDP Act provides for an exemption in relation to processing necessary for research, archiving or statistical purposes, subject to the prescribed conditions. Rule 16 of the DPDP Rules provides that the provisions of the Act do not apply to processing of personal data necessary for research, archiving or statistical purposes where the processing is carried out in accordance with the standards specified in the Second Schedule.

The Second Schedule includes requirements relating to lawful processing, limiting processing to necessary personal data, reasonable efforts concerning completeness, accuracy and consistency, retention, security safeguards and accountability. This means that the research exemption should not be treated as a blanket exemption for AI companies or model developers. Whether AI model development falls within the exemption will depend on the purpose and circumstances of the processing and compliance with the prescribed standards.

In particular, organisations should separately assess what happens when research outputs are subsequently used for commercial products, services or individual-level decision-making. The availability of the exemption should be documented rather than assumed.

What About Anonymised or De-identified Training Data?

Data that genuinely falls outside the definition of personal data is not subject to the DPDP Act merely because it originated from personal data and organisations must distinguish between anonymisation and pseudonymisation. Removing names or replacing identifiers with random codes does not necessarily make a dataset anonymous if individuals can still reasonably be identified using other information.

For organisations relying on anonymisation to place training datasets outside the DPDP framework, the technical methodology, residual identification risks and governance measures should therefore be documented. The more significant the possibility of re-identification, the greater the need for careful legal and technical assessment before treating the dataset as non-personal.

How Does the DPDP Act Regulate Automated Decision-Making?

The DPDP Act does not contain an equivalent of Article 22 of the GDPR, which specifically addresses certain solely automated decisions producing legal or similarly significant effects. There is therefore no standalone provision in the DPDP Act that generally prohibits organisations from using solely automated decision-making and automated decision-making can still engage several provisions of the DPDP framework.

Accuracy of Personal Data Used for AI Decisions

Section 8(3) of the DPDP Act provides that where personal data processed by a Data Fiduciary is likely to be used to make a decision affecting a Data Principal, or is to be disclosed to another Data Fiduciary, the Data Fiduciary must ensure the completeness, accuracy and consistency of that personal data. This is particularly relevant to AI systems used for:

• recruitment and employment decisions;
• credit assessment;
• insurance underwriting;
• eligibility decisions;
• customer profiling;
• fraud detection; and
• other decisions that may materially affect individuals.

An organisation should therefore consider the quality and provenance of personal data used by an AI system where that data may influence a decision affecting an individual.

What Additional Obligations Apply to Significant Data Fiduciaries?

The DPDP Act permits the Central Government to notify certain Data Fiduciaries or classes of Data Fiduciaries as Significant Data Fiduciaries (“SDFs”), having regard to factors including the volume and sensitivity of personal data processed, risk to the Data Principal, potential impact on sovereignty and integrity of India, electoral democracy, security of the State and public order. SDFs are subject to additional obligations.

Under Rule 13 of the DPDP Rules, an SDF must undertake a Data Protection Impact Assessment and an audit once every 12 months and furnish reports containing significant observations to the Board. The SDF must also exercise due diligence to verify that technical measures, including algorithmic software used for specified processing activities, are not likely to pose a risk to the rights of Data Principals.

This provision is relevant to AI systems, but it should not be overstated as a general statutory requirement that every AI system undergo a separate “algorithmic fairness assessment”. The Rules impose the specific due-diligence requirement described above on SDFs.

Is There a Right to an Explanation for AI Decisions Under the DPDP Act?

The DPDP Act does not establish a standalone statutory “right to explanation” comparable to the GDPR’s broader transparency framework around automated decision-making. Similarly, it does not establish a general right to demand human review of every automated decision.

Data Principals have rights under the Act relating to access to information, correction and erasure, and grievance redressal, subject to the statutory framework. In addition, the accuracy obligations under Section 8 and the enhanced obligations applicable to SDFs can become particularly relevant where AI systems process personal data for decisions affecting individuals. Organisations using AI in high-impact contexts should therefore consider maintaining meaningful internal review and escalation mechanisms even where the DPDP Act does not expressly mandate human intervention in every case.

What Are the Key DPDP Compliance Challenges for AI Developers?

1. Data provenance and lawful basis

The first question should be: Where did the training data come from, and why is the organisation legally entitled to process it? AI developers should maintain records identifying:

• the source of training data;
• whether the data contains personal data;
• the purpose for which it was originally collected;
• the applicable legal basis;
• whether consent was obtained;
• whether a statutory exemption is being relied upon; and
• whether the data has subsequently been transformed or anonymised.

This is particularly important where datasets are assembled from multiple sources.

2. Publicly scraped data

Organisations should not assume that “publicly available” means “free to use”. A dataset containing information scraped from websites or social media platforms should be assessed to determine whether the statutory exclusion for publicly available personal data applies. Other legal issues including contractual restrictions, intellectual property rights, copyright and sector-specific requirements may also arise independently of the DPDP Act.

3. Data Processors and AI vendors

AI development frequently involves multiple vendors, including:

• cloud service providers;
• data-labeling and annotation companies;
• model-hosting providers;
• analytics providers; and
• AI infrastructure providers.

Under the DPDP Act, a Data Fiduciary remains responsible for compliance in relation to processing undertaken on its behalf by a Data Processor. Where processors are engaged, organisations should therefore use appropriate contractual arrangements and undertake due diligence concerning security, permitted processing, confidentiality, breach response and data handling.

4. Security of AI training datasets

AI training datasets may represent valuable concentrations of personal and commercially sensitive information. The DPDP Act requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches. The DPDP Rules prescribe specific security measures, including measures relating to encryption, masking, access controls, logging, backups and other safeguards. The Rules also prescribe a 72-hour period for furnishing a detailed breach report to the Board after the initial intimation requirements are triggered.

Importantly, these substantive security and breach provisions are part of the Rules scheduled to take effect 18 months after publication. Organisations should nevertheless begin designing their AI data infrastructure around these requirements rather than waiting until the commencement date.

5. Documentation and governance

AI governance should not be limited to the final deployed model. Organisations should maintain documentation covering, as appropriate:

• training-data sources;
• data-mapping exercises;
• lawful-basis assessments;
• consent and notice mechanisms;
• research or statistical exemptions;
• anonymisation methodologies;
• processor arrangements;
• security controls;
• retention and deletion mechanisms;
• model limitations and known data-quality issues; and
• decisions concerning high-risk AI deployments.

This documentation can provide an important audit trail as the Indian regulatory framework develops.

DPDP Act vs GDPR: Key Differences for AI

The comparison demonstrates why organisations should not simply transplant a GDPR compliance framework into India. The two regimes have different concepts of lawful processing, public-data treatment, automated decision-making and regulatory obligations.

What Is the Current Position on AI Regulation in India?

India does not currently have a single horizontal AI statute equivalent to the EU AI Act. Instead, AI governance is developing through a combination of existing laws, sectoral regulation, government policy and the emerging DPDP framework.

The Government’s India AI Governance Guidelines and related IndiaAI initiatives emphasise responsible and trustworthy AI, including considerations around safety, accountability and inclusive development. However, policy and governance guidelines should be distinguished from binding statutory obligations.

AI developers and deployers must therefore consider the legal framework applicable to the particular use case, including data protection, intellectual property, consumer protection, financial-sector regulation, healthcare regulation, employment law and other sector-specific requirements. The legal position on copyright and the use of copyrighted material for AI training is also a distinct issue from personal-data protection and should be separately assessed.

What Should AI Developers and Businesses Do Before May 2027?

Organisations developing or deploying AI systems that process personal data should use the transition period to establish a DPDP-ready governance framework.

1. Map AI data flows: Identify what personal data enters the AI lifecycle, where it comes from, where it is stored, who accesses it and where it is transferred.

2. Determine whether the data is actually personal data: Do not assume that every AI training dataset falls within the DPDP Act. Conversely, do not assume that apparently anonymous, aggregated or publicly available information is automatically outside the Act.

3. Identify the lawful basis: For every significant dataset, document whether processing is based on consent, a specified legitimate use or an applicable statutory exemption.

4. Assess research exemptions carefully: Where Rule 16 is being considered, document why the processing qualifies as research, archiving or statistical processing and how the Second Schedule standards are being satisfied.

5. Review AI vendors and processors: Ensure contracts and due-diligence processes address security, permitted processing, confidentiality, breach response and deletion/return of data.

6. Build data-quality controls: Where AI outputs or decisions may affect individuals, organisations should establish processes to address the completeness, accuracy and consistency of relevant personal data.

7. Assess high-risk AI use cases: AI used in recruitment, lending, insurance, healthcare, eligibility determination or similar contexts warrants enhanced legal, technical and governance review.

8. Prepare for SDF obligations: Organisations that may fall within the SDF framework should prepare for DPIAs, annual audits and the additional requirements applicable to SDFs.

9. Design for privacy rather than retrofitting compliance: Data protection considerations should be incorporated at the dataset, model-development and deployment stages rather than addressed only after an AI product has been built.

Conclusion

The DPDP Act does not contain a dedicated AI regime, but AI systems that process digital personal data can fall within its scope. For AI developers, the critical questions are therefore not simply “Is this AI?” or “Is this data publicly available?”. The more relevant questions are:

• Does the dataset contain personal data?
• Is the processing within the territorial scope of the DPDP Act?
• What is the lawful basis for processing?
• Does a statutory exemption apply?
• Is the data being used to make decisions affecting individuals?
• Does the organisation qualify as a Significant Data Fiduciary?
• What security, governance and processor safeguards are required?

The answers will depend on the particular AI system, dataset and use case.

With the substantive DPDP framework scheduled to become applicable in May 2027, organisations have an important opportunity to build privacy and data governance into AI development pipelines now. A defensible AI governance framework should combine data provenance, lawful processing, appropriate safeguards, data quality, vendor governance and documented risk assessment rather than treating data protection as a post-deployment compliance exercise.