Generative AI Use Policy for Employees in India: Legal Risks and Employer Compliance

Introduction

The increasing adoption of Generative Artificial Intelligence (“AI”) in workplaces has transformed how organisations approach drafting, research, coding, document review, translation, summarisation and customer support. While these tools can improve operational efficiency and productivity, their use also raises important legal and compliance concerns relating to confidentiality, personal data protection, intellectual property rights and employee accountability.

Employees may routinely use publicly available AI platforms or AI-enabled features integrated into workplace software without fully appreciating the implications of sharing business information, personal data or proprietary material with such systems. Unregulated use may expose employers to risks involving unauthorised disclosure of confidential information, data security incidents, intellectual property disputes and contractual non-compliance.

Consequently, employers in India should consider adopting a comprehensive Generative AI Use Policy that establishes clear boundaries for the use of AI tools, identifies information that employees may or may not upload, specifies approval and review mechanisms, and addresses ownership and accountability in relation to AI-assisted work products.

An effective policy should not merely prohibit the use of publicly available AI platforms. Instead, it should establish a framework for the responsible use of AI while safeguarding the employer’s commercial, legal and operational interests.

1. Scope and Purpose of an AI Use Policy

An AI Use Policy should establish the circumstances in which employees and other individuals associated with an organisation may access and use AI systems for work-related activities.

The policy should cover:

• Publicly available Generative AI platforms;
• Enterprise-approved AI tools and applications;
• AI features integrated into productivity, human resources, coding, legal and customer service software;
• AI systems provided by external vendors, consultants or affiliated entities; and
• Locally hosted or internally developed AI models.

The policy should apply to employees, consultants, interns, temporary staff, secondees and other individuals who access the employer’s systems, networks or information.

The principal objectives of an AI Use Policy should include:

1. Encouraging the responsible and productive use of AI tools;
2. Preventing unauthorised disclosure of confidential and proprietary information;
3. Protecting personal data and reducing information security risks;
4. Safeguarding the intellectual property and contractual interests of the employer and third parties;
5. Ensuring appropriate human oversight of AI-generated outputs;
6. Establishing accountability, reporting and audit mechanisms; and
7. Providing proportionate consequences for violations of the policy.

The AI Use Policy should operate alongside the organisation’s existing confidentiality, information security, acceptable-use, data protection, intellectual property and disciplinary policies.

2. Confidentiality and Protection of Business Information

One of the primary risks associated with workplace AI usage is the inadvertent disclosure of confidential business information through prompts, document uploads or other inputs.

Employees may perceive a prompt as a simple instruction to an AI system. However, the information supplied may be transmitted to and processed by an external service provider, depending on the platform’s architecture and applicable terms of service.

Information that may require protection includes:

• Unpublished business plans and commercial strategies;
• Source code, software architecture and technical documentation;
• Customer information and account details;
• Internal investigation reports and sensitive correspondence;
• Draft agreements, legal opinions and litigation strategies;
• Financial forecasts, pricing information and business projections;
• Product development plans and research data;
• Unpublished financial information and market-sensitive information;
• Passwords, API keys, credentials and security configurations;
• Employee performance records and remuneration information; and
• Information relating to mergers, acquisitions and corporate restructuring.

The deletion of a prompt from an employee’s visible chat history should not automatically be treated as confirmation that the information has been deleted from the service provider’s systems. Retention, deletion, backup and model-training practices may differ across platforms and depend on their contractual terms, privacy settings and technical architecture.

Employers should therefore prohibit employees from uploading confidential, privileged, proprietary or security-sensitive information to AI platforms unless the particular tool and intended use have been expressly approved.

Information Classification for AI Usage

Employers may adopt a three-tier information classification framework to determine the extent to which different categories of information may be used with AI systems.

This classification framework should be supported by clear approval procedures, employee training and periodic compliance reviews.

3. Personal Data Protection and the DPDP Framework

The use of AI tools may involve the processing of personal data relating to employees, customers, vendors and other individuals. For example, employees may upload names, contact details, identification information, salary records, health information or customer correspondence into AI platforms without considering the consequences of such disclosure.

The Digital Personal Data Protection Act, 2023 (“DPDP Act”) establishes a framework governing the processing of digital personal data in India. Under the Act, an organisation determining the purpose and means of processing personal data may qualify as a Data Fiduciary, while a service provider processing personal data on behalf of the organisation may qualify as a Data Processor.

The legal classification of an AI service provider will depend on the actual processing arrangement and the purposes for which the data is processed.

Current Applicability of the DPDP Act

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and provide for phased implementation of the data protection framework.

The substantive provisions governing the processing of personal data, including the principal obligations of Data Fiduciaries, are scheduled to come into force on 13 May 2027.

Accordingly, employers should distinguish between the provisions currently in force and those for which compliance preparations are required ahead of their scheduled commencement. During the transition period, the applicable provisions of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 must also be considered.

Under the DPDP Act, Section 7(i) recognises certain legitimate uses of personal data for employment-related purposes, including safeguarding an employer from loss or liability. However, this provision should not be interpreted as an unrestricted authorisation to process employee data for any purpose.

Employers should assess the following when adopting AI tools that involve personal data:

• The purpose for which personal data is being processed;
• Whether the processing falls within a recognised lawful basis under the applicable framework;
• The respective roles and responsibilities of the employer and AI service provider;
• The location and duration of data storage;
• Data retention, deletion and access arrangements;
• Appropriate contractual safeguards governing third-party processing; and
• Applicable information security and breach-response requirements.

Employers should also consider data minimisation as a key safeguard. Employees should use only the minimum personal information necessary for the intended task and remove or mask identifying details wherever reasonably possible.

Any unauthorised disclosure or accidental uploading of personal data should be promptly reported to the organisation’s legal, privacy or information security team for assessment and appropriate action.

4. Ownership of AI-Assisted Work Products and Intellectual Property

The use of an AI tool does not, by itself, establish that the employer owns the resulting output or that the output is capable of copyright protection.

Under Section 17 of the Copyright Act, 1957, the author is ordinarily the first owner of copyright. However, Section 17(c) provides that, in the absence of an agreement to the contrary, the employer is the first owner of copyright in a work made by an employee in the course of employment under a contract of service or apprenticeship.

The application of this provision to AI-assisted work products requires careful consideration. In particular, questions may arise regarding human authorship, originality, the extent of human creative contribution and whether the resulting material qualifies for copyright protection.

The position may also differ depending on whether the output is substantially generated by AI or involves meaningful human contribution through selection, arrangement, modification and creative inputs.

Accordingly, employers should not assume that every AI-generated output automatically becomes their intellectual property merely because an employee generated it using a workplace account.

Employment agreements, consultancy agreements and relevant intellectual property policies should address:

• Ownership of work products created in the course of employment;
• Assignment of intellectual property rights, where applicable;
• Ownership and permitted use of prompts, workflows and datasets;
• Disclosure requirements where AI has materially contributed to a work product;
• Restrictions on using third-party copyrighted material; and
• Continuing confidentiality and information protection obligations following termination of employment.

Employers should also consider requiring employees to maintain appropriate records of the AI tools used, source materials relied upon, material human contributions and reviews undertaken before adopting or distributing AI-assisted outputs.

5. Data Minimisation and De-identification

Data minimisation is an important operational safeguard when employees use AI systems, particularly where the intended task does not require the identification of specific individuals.

Before entering information into an AI system, employees should, wherever practicable:

• Remove names, residential addresses, telephone numbers and email addresses;
• Replace customer and employee identifiers with generic references;
• Remove account numbers, passwords and other credentials;
• Generalise dates and geographical references where exact details are unnecessary; and
• Use fabricated or sample data for testing and demonstrations.

Employees should avoid uploading complete documents or datasets when only a limited extract is required for the intended task.

Where anonymisation or de-identification is undertaken, employers should also consider whether the remaining information could still identify an individual when combined with other available information. Merely replacing names with codes does not necessarily constitute irreversible anonymisation.

6. Vendor Due Diligence and Information Security Safeguards

The use of third-party AI platforms introduces additional risks because business information may be processed through systems outside the employer’s direct operational control.

Before approving an AI service provider, employers should evaluate its data handling practices, security architecture, contractual commitments and mechanisms for managing information security incidents.

Relevant safeguards may include:

• Access controls and role-based permissions;
• Encryption and appropriate data protection measures;
• Use of organisation-approved accounts rather than personal accounts;
• Restrictions on the retention and secondary use of submitted information;
• Clear data deletion and backup arrangements;
• Vendor due diligence and security assessments;
• Appropriate contractual confidentiality and data processing obligations; and
• Periodic reviews of the provider’s security and compliance practices.

The organisation should also establish an internal incident-reporting mechanism requiring employees to immediately notify the designated legal, privacy or information security team where:

• Personal data has been uploaded to an unauthorised AI platform;
• A personal AI account has been used for business-related information;
• Credentials, confidential documents or proprietary information have been exposed;
• AI-generated output contains personal or confidential information belonging to another individual; or
• There are reasonable grounds to suspect unauthorised retention, access or disclosure of information by an AI service provider.

CERT-In Reporting Requirements

The CERT-In Directions dated 28 April 2022, issued under Section 70B of the Information Technology Act, 2000, require specified entities, including body corporates, to report the cyber incidents listed in Annexure I within six hours of noticing such incidents or being informed about them.

The specified incidents include data breaches, data leaks, unauthorised access to IT systems and certain other cyber security incidents.

The Directions also require covered entities to maintain ICT system logs securely for a rolling period of 180 days within Indian jurisdiction.

An accidental upload of information to an unauthorised AI platform should therefore be assessed promptly to determine whether it constitutes a reportable cyber incident under the CERT-In framework. The six-hour reporting requirement should not be treated as automatically applicable to every instance of employee misuse.

Employers should incorporate these reporting obligations into their incident response procedures and ensure that employees understand the internal escalation process.

7. Disclosure, Human Oversight and Employee Accountability

An AI Use Policy should establish clear requirements regarding when employees must disclose the use of AI in preparing or reviewing work products.

Internal disclosure may be required where AI has materially contributed to:

• Client deliverables or business-critical documents;
• Legal opinions, financial analysis or compliance reports;
• Human resources recommendations;
• Decisions involving individuals;
• Documents containing confidential or regulated information; or
• Work products subject to contractual, regulatory or client-specific disclosure requirements.

External disclosure should be governed by applicable law, contractual obligations, professional requirements, client instructions and the organisation’s authorised disclosure procedures.

Employees should not make unauthorised representations to clients, regulators, media organisations or other third parties concerning the organisation’s use of AI.

Human Review of AI-Generated Outputs

AI-generated outputs may contain inaccurate information, fabricated references, incomplete analysis or misleading conclusions. Consequently, AI-generated material should not be treated as independently verified or professionally reliable.

Before relying on or distributing AI-generated content, the responsible employee should review:

1. Accuracy and completeness of the information;
2. Reliability of cited sources, authorities and references;
3. Confidentiality and applicable privilege obligations;
4. Potential disclosure of personal or sensitive information;
5. Possible infringement of third-party intellectual property rights;
6. Bias, discriminatory assumptions or misleading conclusions;
7. Compliance with contractual and regulatory requirements; and
8. Technical accuracy, including calculations, code and security vulnerabilities, where relevant.

The employee responsible for the work product should remain accountable for its accuracy and suitability, notwithstanding the use of AI as an assistance tool.

AI-Assisted Employment Decisions

Employers should exercise particular caution when deploying AI systems for recruitment, candidate screening, performance evaluation, promotion, remuneration, disciplinary action and termination decisions.

Automated scoring, ranking and profiling systems may produce inaccurate or biased results and can materially affect an individual’s employment prospects.

Employers should therefore establish appropriate human oversight, verify the information relied upon and maintain records of material decisions. Individuals affected by such decisions should be provided appropriate mechanisms to seek correction or review, consistent with applicable legal and organisational requirements.

These safeguards should be treated as responsible governance measures and assessed alongside the applicable employment, equality, contractual and data protection framework, rather than as a blanket statutory prohibition on AI-assisted employment decisions.

8. Implementation and Enforcement of an AI Use Policy

The effectiveness of an AI Use Policy depends not only on the wording of the policy but also on its implementation and enforcement.

Employers should consider the following measures:

• Identify and maintain an inventory of AI tools approved for workplace use;
• Establish clear approval procedures for introducing new AI platforms;
• Classify information according to its sensitivity and permitted use;
• Incorporate AI-related confidentiality and intellectual property obligations into employment and consultancy agreements;
• Conduct periodic employee awareness and training programmes;
• Establish procedures for reporting suspected misuse or data security incidents;
• Maintain appropriate records of material AI usage and compliance reviews; and
• Review the policy periodically to account for technological developments and changes in applicable law.

The policy should also provide for proportionate disciplinary consequences in cases of unauthorised disclosure, misuse of confidential information, violation of security requirements or repeated non-compliance, subject to applicable employment contracts, service rules and labour laws.

Conclusion

Generative AI can significantly improve workplace productivity and operational efficiency. However, its adoption without appropriate safeguards may expose employers to confidentiality breaches, data protection risks, intellectual property disputes and operational liabilities.

For employers in India, an effective AI Use Policy should establish clear rules governing the use of AI tools, the handling of confidential and personal information, ownership of AI-assisted work products, vendor arrangements, incident reporting and employee accountability.

As the DPDP framework moves towards full implementation, organisations should use the transition period to review their existing employment contracts, confidentiality obligations, information security procedures and data governance arrangements.

A well-structured AI Use Policy can help employers encourage responsible technological adoption while protecting their business interests, employees and third parties.