India's DPDP Act: What It Says (and Doesn't Say) About AI

A lot of writing about Indian AI regulation describes obligations the Digital Personal Data Protection Act does not contain. The Act is a consent-centred data protection statute with one clause that mentions algorithms, and being precise about which duties are real is more useful than a longer list.

The shape of the Act

The Digital Personal Data Protection Act, 2023 received assent on 11 August 2023 but did not commence on assent; its provisions were left to be brought into force by notification, and the operative detail was left to rules. Draft rules were published for consultation in January 2025 and the Digital Personal Data Protection Rules were notified in November 2025, with a phased commencement over the following period rather than immediate effect. The Ministry of Electronics and Information Technology publishes the Act and the rules: MeitY’s data protection framework page.

The Act is deliberately short. It runs on a small number of concepts: Data Principal (the individual), Data Fiduciary (who determines the purpose and means), Data Processor, consent as the primary lawful ground with a closed list of “legitimate uses” alongside it, a consent manager mechanism, and a Data Protection Board of India as the adjudicating body. Section 3 gives it extraterritorial reach: it applies to digital personal data processed in India, and to processing outside India where it is in connection with offering goods or services to Data Principals within India.

What is not in it

Stated plainly, because the absence is the fact most often misreported:

• No right against automated decision-making. There is no Indian equivalent of GDPR Article 22. A decision produced entirely by a model is not, by that fact, restricted under the DPDP Act.
• No right to an explanation. The rights the Act confers—access to a summary of personal data and processing, correction and erasure, grievance redressal, and nomination—do not include a right to information about the logic of a decision.
• No right to object and no portability right. Both exist in the GDPR and were dropped from the Indian text.
• No risk tiers, no prohibited practices, no AI system classification. Nothing in the Act sorts AI systems by risk.
• No training-data regime. The Act does not address model training as such, and says nothing about copyright, which is governed by the Copyright Act, 1957 and is a separate and unresolved question in India.

Indian AI governance activity has happened, but largely outside this statute—in MeitY advisories, in NITI Aayog’s responsible AI work, in sectoral regulation from the Reserve Bank of India, and in expert-committee reporting. None of that is a binding AI statute, and a summary that presents it as one is describing policy as law.

The publicly available data carve-out

Section 3 excludes from the Act personal data that the Data Principal has made publicly available themselves, and personal data that a person is required by law to make publicly available. The illustration given in the Act itself is a person publishing their own contact details.

For anyone training on scraped material this is a materially different starting point from Europe. Under the GDPR, personal data does not leave the regime by having been published; a lawful basis is still required and the analysis is the one described in the lawful basis for web scraping. Under the DPDP Act, self-published personal data is outside the Act altogether.

Two cautions attach. The exclusion turns on the data having been made public by the Data Principal or under a legal requirement— not on it being findable. A profile scraped from a site where the individual posted it is a different case from personal data republished by somebody else, and a bulk scrape rarely distinguishes the two at collection time. And the exclusion is from the DPDP Act only; it does not displace contract, confidentiality, copyright, or a platform’s terms. It is narrower in effect than it first reads.

The one algorithmic duty

Section 10 lets the central government notify a Data Fiduciary, or a class of them, as a Significant Data Fiduciary, on factors including the volume and sensitivity of personal data processed, risk to Data Principals, and risks to the sovereignty and integrity of India and to electoral democracy. A Significant Data Fiduciary carries additional obligations: appointing a Data Protection Officer based in India who reports to the board or governing body, appointing an independent data auditor, and undertaking periodic Data Protection Impact Assessments and periodic audits.

The same subsection adds the provision that actually names algorithms: a Significant Data Fiduciary must observe due diligence to verify that the algorithmic software it deploys for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data it processes is not likely to pose a risk to the rights of Data Principals.

That single clause is the whole of the Act’s explicit engagement with algorithmic systems, and it is worth reading carefully rather than expansively. It is a due diligence duty, not an outcome guarantee. It attaches only to notified Significant Data Fiduciaries, not to everyone. It is framed around algorithmic software used in the handling of personal data, which is a narrower field than “AI systems”. And it says nothing about what the diligence must consist of, which is the kind of gap that rules and guidance fill. Treated sensibly, it points at the same artefacts that every other regime asks for—a documented assessment, a record of what was tested, an owner—which is why model cards and datasheets as regulatory evidence travel well across jurisdictions.

Accuracy, consent and the practical duties

Three general duties do most of the work for an AI deployment in India.

Notice and consent. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. The notice must be itemised and available in English or any language in the Eighth Schedule to the Constitution. Consent is withdrawable, and withdrawal must be as easy as giving it—which raises the same hard question as everywhere else about data already absorbed into a trained model, discussed in consent withdrawal and the trained model.

Accuracy where decisions are made. The Act requires a Data Fiduciary to ensure the completeness, accuracy and consistency of personal data where it is used to make a decision affecting the Data Principal or is disclosed to another Data Fiduciary. For a system that feeds model output back into a customer record, this is the provision that makes a confidently wrong generated attribute a compliance problem rather than a quality problem.

Security, breach notification and erasure. Reasonable security safeguards are mandatory, breaches must be notified to the Board and to affected Data Principals, and personal data must be erased when consent is withdrawn or the purpose is no longer being served. Penalties under the Schedule are substantial, with the largest tier for failure to take reasonable security safeguards running to hundreds of crores of rupees, and they are imposed by the Data Protection Board rather than by a court in the first instance.