India's Digital Personal Data Protection Act 2023, once its rules are finalized, will make consent the load-bearing wall of every AI system that touches Indian personal data — with penalties up to ₹250 crore per instance of non-compliance. The DPDP Act was enacted in August 2023, and the draft DPDP Rules were published for public consultation in January 2025, bringing the law's obligations into view: consent-based processing, consent managers, verifiable parental consent for children's data, breach notification to the Data Protection Board of India, and designated significant data fiduciaries with extra duties. For AI teams, the Act lands on top of the existing IT Rules 2021 and their 2024 amendments on synthetic media labeling — which means generative AI systems built or deployed in India must now reconcile three layers: intermediary obligations, content labeling, and personal data protection. This article maps what the DPDP Act requires of AI development and deployment, what remains in flux, and how to sequence compliance without freezing AI delivery.
What Does India's Regulatory Landscape Look Like in Mid-2025?
The DPDP Act is India's first comprehensive personal data protection statute, replacing the decade-long stopgap of the 2011 IT rules on data protection. Its structure is consent-centric: personal data may be processed only for a lawful purpose with the data principal's consent, or under a limited set of deemed-consent grounds for specified legitimate uses such as employment, health emergencies, and fraud prevention. The act's most consequential design choice for AI is the absence of a blanket cross-border restriction: transfers are permitted to countries the central government notifies, and prohibited only to explicitly restricted destinations — a pragmatic posture that leaves AI teams a lawful path while keeping data sovereignty leverage in reserve. The regulatory infrastructure is being stood up alongside the rules: the Data Protection Board of India, consent managers as independent intermediaries, and a significant data fiduciary regime for entities whose scale or sensitivity warrants heightened duties, including data protection impact assessments, periodic audits, and record-keeping.
The commercial context explains the urgency. India's digital economy is expanding faster than almost anywhere else — IDC expects worldwide AI spending to reach $632 billion by 2028, with India among the fastest-growing markets for AI adoption — and the country is simultaneously building AI supply: the IndiaAI Mission, launched in 2024 with roughly ₹10,000 crore in committed funding, is assembling a national compute program with tens of thousands of GPUs, a datasets platform, and an AI innovation centre. Stanford's AI Index 2025 found that 78% of organizations reported using AI in at least one business function in 2024, up from 55% in 2023. That combination — a new data law, an AI build-out, and a huge population of data principals — makes the DPDP Act the single most important compliance variable for AI deployments involving Indian personal data in the next two years.
What Are the Key DPDP Compliance Requirements for AI Systems?
For AI systems specifically, the DPDP obligations that bite hardest are:
- Consent for training and inference data — personal data used to train, fine-tune, or prompt models requires valid consent or a deemed-consent ground, with notice in plain language covering purpose and use
- Children's data — processing personal data of individuals under 18 requires verifiable parental consent, and behavioral tracking or targeted advertising aimed at children is prohibited, which constrains personalization models
- Breach notification — a data breach must be notified to the Data Protection Board and affected data principals without delay, which requires AI systems to have breach-detection and notification workflows, not just logs
- Significant data fiduciary duties — if designated, a data fiduciary must run data protection impact assessments, engage a data auditor, and maintain enhanced records, all of which apply to the data layer of AI systems
- Consent manager integration — consent must be capable of being managed through interoperable consent managers, so AI products that rely on personal data must build to a consent-management interface rather than ad-hoc tick boxes
- Cross-border routes — transfers of personal data for training or inference must follow the notification regime, with documentation proving the lawful route
On top of the DPDP Act, generative AI providers must still honor the IT Rules 2021 as amended in 2024, which require intermediaries to label synthetic media — AI-generated or deepfake content — and to act on takedown requests. The practical effect is that an AI product in India has a layered compliance profile: personal data flows governed by the DPDP Act, content outputs governed by the IT Rules, and both intersecting on any system that both ingests personal data and generates content.
What Does the DPDP Act Mean for AI Training and Inference Data?
The question every AI team should ask is which of its data flows the Act actually reaches. Training data containing Indian personal data is squarely in scope: the data fiduciary must have consent or a legitimate-use ground for that processing, and the draft rules add notice and purpose-limiting detail that will affect how training datasets are assembled and documented. Inference is in scope too: a conversational AI system that answers questions about customers is processing personal data at query time, which implicates consent, purpose limitation, and breach notification the moment the system holds personal data in memory, logs, or caches. Where AI systems process only non-personal or anonymized data, much of the DPDP machinery does not apply — but the act's definitions and the rules' treatment of data that can reasonably identify an individual mean "anonymized" claims need a documented basis, not a label. The defensible posture is to classify every AI data flow — training, validation, fine-tuning, and inference — against the consent, children's data, breach, and cross-border obligations before build, and to record that classification the way the DPDP Act's record-keeping duties anticipate.
What Cross-Jurisdictional Challenges Do Multinationals Face?
For multinational enterprises, the DPDP Act lands in an already-crowded compliance landscape. The EU AI Act reached its prohibition stage in February 2025 and its general-purpose-AI obligations in August 2025; China's generative AI measures and mandatory content labeling took effect through 2023–2025; and US enterprises face a state-by-state patchwork after the federal executive order was rescinded in January 2025. India's consent-centric model is distinctive — it puts consent at the center where the EU leans on legitimate interest and China leans on regulatory permission — so a single global AI product may need three different data-justification architectures. The practical answer is modular compliance architecture: one data-flow map that shows which personal data moves under which legal basis in which jurisdiction, one consent-management layer that can interoperate with India's consent managers and the EU's GDPR mechanics, and one record-keeping standard that satisfies the strictest requirement in the portfolio. Enterprises that build this way report materially fewer regulator-driven findings — and in India specifically, where the DPDP Board will be building its enforcement track record, defensible records are the cheapest insurance.
How Should Enterprises Implement DPDP Compliance?
Sequencing matters because the DPDP Rules are still being finalized. In the near term, run a gap assessment against the Act as written: classify AI data flows, inventory consent states, map cross-border transfers, and document breach-notification workflows for AI systems — none of this depends on the final rule text, and all of it will be needed regardless. Next, build to the draft rules' direction of travel: plain-language notices, consent-manager interoperability, and verifiable parental consent mechanisms are all near-certain to survive consultation, so investing there is low-risk. For generative AI specifically, align the synthetic media labeling obligations of the IT Rules with the content governance your models already need, so one pipeline satisfies both. Finally, treat designation risk seriously: organizations processing large volumes of Indian personal data, including data-heavy AI platforms, should assess whether they are likely to be designated significant data fiduciaries and pre-position the DPIA, audit, and record-keeping machinery accordingly. Gartner has projected that by 2026 more than 80% of enterprises will have used generative AI APIs or deployed generative-AI-enabled applications in production; for that generation of deployments touching India, the enterprises that move early on the DPDP groundwork will turn a looming compliance deadline into a competitive advantage rather than a fire drill.
How Should Enterprises Prepare for the Next Wave of Regulation?
The DPDP Act is not the end of India's AI regulation story — it is the data-protection layer of a stack that will keep growing as India's AI build-out matures. IBM's 2024 Cost of a Data Breach research put the average breach cost in India at roughly ₹29 crore (about $3.5 million), a figure that has climbed year over year and that the DPDP Board's penalty regime — up to ₹250 crore per instance — explicitly aims to make worse for the careless. The direction of travel is unambiguous: consent infrastructure, breach accountability, children's protections, and documented cross-border routes will become table stakes for any AI product processing Indian personal data, and the next wave will add sectoral and AI-specific rules on top. The foundation you build now — classified data flows, consent-manager-ready consent, auditable records — is the same foundation a future Indian AI law will extend rather than replace. Enterprises that treat the DPDP Act as the first layer of a durable data-governance program, rather than a compliance event to survive once, will be the ones that deploy AI in India at speed when the rules finalize.
How Does the DPDP Act Compare to GDPR and PIPL?
For AI teams operating across borders, the DPDP Act is easiest to reason about next to the two other major regimes it most often meets in production: the European Union's GDPR and China's PIPL. All three rest on a notice-and-consent foundation, but they diverge on exactly the details that determine how a model is trained, where data may travel, and who gets fined. Reading the DPDP Act through that comparative lens prevents teams from assuming a single "global AI compliance module" can be copied from one jurisdiction to another.
| Dimension | India DPDP Act 2023 | EU GDPR | China PIPL |
|---|---|---|---|
| Primary legal basis | Consent plus deemed-consent for specified legitimate uses | Lawful basis including legitimate interest, contract, legal obligation | Consent, often with regulatory permission for cross-border |
| Cross-border transfers | Permitted to notified countries; blocked only to restricted ones | Adequacy decisions or transfer safeguards such as SCCs | Security assessment plus localization for important data |
| Children's data | Under-18 treated as a child; verifiable parental consent required | Under-16 (member-state variable) with parental consent | Under-14 with parental consent; strict protections |
| Penalties | Up to ₹250 crore per instance | Up to €20m or 4% of global turnover | Up to 5% of turnover or ¥50m |
| AI-specific rules | Layer over IT Rules 2021 (synthetic-media labeling) | EU AI Act as a separate instrument | Generative-AI measures plus content labeling |
| Enforcement body | Data Protection Board of India | National supervisory authorities | CAC and other regulators |
The practical takeaway is that India's model is the most consent-centric of the three. Where the GDPR lets a team lean on "legitimate interest" and PIPL leans on regulatory permission, the DPDP Act pushes consent to the center of nearly every AI data flow. That single design choice is why a consent-management layer, not just a privacy policy, becomes the linchpin of India compliance.
What Practical Steps Should AI Teams Take in the First 90 Days?
The DPDP Rules are still being finalized, but the Act itself is already law and the draft rules signal the direction clearly enough to act now. The following 90-day sequence makes progress without guessing at final rule text:
- Days 1–15 — Inventory AI data flows. List every training, validation, fine-tuning, and inference flow that touches Indian personal data. Tag each with its source, purpose, and whether it holds data on minors.
- Days 16–30 — Map consent states. For each flow, record whether valid consent or a deemed-consent ground exists, and where the notice falls short of the draft rules' plain-language standard.
- Days 31–45 — Stand up breach detection and notification. The Act requires notifying the Data Protection Board and affected principals without delay. Build the workflow now so a future incident triggers a response, not a scramble.
- Days 46–60 — Prototype consent-manager interoperability. Because consent must be manageable through independent consent managers, design your consent layer to an interoperable interface rather than ad-hoc checkboxes.
- Days 61–75 — Assess significant-data-fiduciary risk. If your platform processes large volumes of Indian personal data, you are a likely candidate for designation, which triggers DPIAs, audits, and enhanced records.
- Days 76–90 — Make records auditable. Document the classification, consent basis, and transfer route for every flow in a form that satisfies the strictest requirement in your portfolio.
None of these steps depends on the final rule text, and all of them will be required regardless of how the consultation lands. Teams that complete this sequence turn a moving regulatory target into a fixed engineering backlog they can plan around.
Why Does Children's Data Require Special Safeguards Under the DPDP Act?
One obligation that routinely surprises AI product teams is the DPDP Act's treatment of anyone under 18 as a child who requires verifiable parental consent for any processing of their personal data. That single rule reshapes several common AI use cases. An edtech tutoring model, a children's gaming recommender, or a youth-focused health chatbot cannot simply bury consent in a terms-of-service link; it must obtain and be able to demonstrate verifiable parental approval before personalization begins.
The Act goes further: it prohibits behavioral monitoring and targeted advertising directed at children. For recommendation engines whose entire value proposition is behavioral targeting, this is not a disclosure fix but a product-redesign requirement. The defensible approach is to segment minors into a separate processing path with age-assurance at the boundary, non-personalized defaults, and no ad-targeting, and to log that segmentation so the data fiduciary can evidence compliance if the Board asks. Treating children's data as a first-class design constraint, rather than a clause to be waived, is the difference between an AI product that scales in India and one that gets pulled.
