Explainer2 min read
DPDP Act and AI: A Compliance Primer for India
India’s Digital Personal Data Protection Act, 2023 applies to any business processing personal data of people in India — including every AI system that touches customer data. This primer covers the principles; it is not legal advice, and the implementing rules should be checked with counsel for your specific case.
TrueCodeAI Team
Studio
- Published
ComplianceIndiaData protection
The core principles
- Consent: clear, specific consent for a stated purpose, or another lawful ground the Act allows.
- Purpose limitation: use data only for the purpose you collected it for.
- Data minimisation: collect only what the purpose needs.
- Accuracy and retention: keep data accurate and delete it when the purpose is served.
- Security: reasonable safeguards, and notification of breaches.
- Rights: individuals can access, correct and erase their data, and withdraw consent.
What it means for AI projects
| AI component | Question to answer |
|---|---|
| Chat / voice agent | Is the privacy notice shown and consent captured before collecting data? |
| Model provider | Is the provider a processor under a contract with appropriate terms? |
| Training / fine-tuning | Was the data collected for a purpose that covers this use? |
| Logs and traces | Is personal data redacted and retention limited? |
| Memory features | Can users see and erase what is remembered? |
Practical steps
- Map what personal data each AI feature processes and why.
- Update privacy notices and consent flows.
- Sign processor agreements with AI and hosting providers.
- Redact personal data from logs and eval sets.
- Build erasure into every store: database, vector index, memory, backups.
Frequently asked questions
Does DPDP stop us using foreign AI providers?
The Act allows cross-border transfers except to countries the government restricts. Check current notifications and your sector’s rules.
Are chat logs personal data?
Often, yes — they usually contain names, numbers and details that identify people.
Do you build compliance in?
Yes — consent capture, redaction, retention and erasure are standard in our builds. Legal sign-off stays with your counsel.
