India Digital Personal Data Protection Act
Data Protection Board of India (to be established by MeitY). Currently enforced via IT Act powers pending Board establishment.
August 2023 - In Force. Rules and enforcement by Data Protection Board anticipated 2025.
Status
In Force
Risk Level
High
Jurisdiction
India
Enforcement
August 2023 - In Force. Rules and enforcement by Data Protection Board anticipated 2025.
high risk framework
Any organization processing digital personal data of Indian residents for AI purposes - including foreign companies.
Overview
India's Digital Personal Data Protection Act 2023 establishes comprehensive data protection for digital personal data of Indian citizens. Significant implications for AI systems processing personal data - including training, inference, and automated decision-making affecting Indian individuals.
Scope
Any organization processing digital personal data of persons in India. Includes foreign companies processing data of Indian residents (extra-territorial application similar to GDPR).
Applicability
Who Is Affected
- Indian companies building or deploying AI using Indian personal data
- Foreign AI companies serving Indian users (must appoint India Data Representative)
- Significant Data Fiduciaries (high-volume/high-sensitivity personal data processing)
- AI companies training on Indian user data, social media content, or public web data
Key Prohibitions
- Processing children's personal data without verifiable parental consent
- Processing personal data beyond stated purposes without fresh consent
- Transferring data to countries blacklisted by Indian government
- Tracking or behavioral monitoring of children in AI systems
Key Requirements
- Consent for processing personal data in AI training (valid, informed, specific)
- Purpose limitation: AI systems can only process data for stated, specific purposes
- Data minimization: collect only what is necessary for AI functionality
- Right to erasure: delete individual data from AI systems upon valid request
- Prohibition on processing children's data (under 18) without verifiable parental consent
- Data localization: critical data (to be specified) must remain in India
- Significant Data Fiduciary obligations for large-scale AI data processors
- Breach notification to Data Protection Board within prescribed time
Guardrails & Operational Controls
- Consent management: granular, withdrawable consent records for AI training and inference
- Erasure capability: AI pipelines must support right-to-erasure of individual data
- Children's AI protection: no profiling, behavioral advertising, or high-risk processing for under-18s
- Significant Data Fiduciary: data audits, DPIA, and Data Protection Officer required
Implementation Guidance
- 1Audit AI training data for Indian personal data and establish consent records
- 2Implement data erasure capability for Indian user data in AI pipelines
- 3Restrict children's data processing in AI - implement age-verification
- 4Prepare for Significant Data Fiduciary classification if processing at scale
- 5Monitor MeitY for DPDPA Rules finalization
Industry Impact
Technology / AI
LLM training on Indian web data, apps, and social media requires compliance architecture.
E-commerce / FinTech
Recommendation AI, credit scoring, and payment AI processing Indian personal data require consent infrastructure.
Social Media
User data processing for AI training requires explicit purpose and consent. Children's data prohibitions are strict.
Healthcare
Health data is sensitive personal data - strict consent and localization requirements.
EdTech
Children's data (most EdTech users) - highest standard of consent and prohibition on tracking.
Regulatory Timeline
Aug 2023
DPDPA passed by Indian Parliament
Late 2024
Draft DPDPA Rules published for consultation
2025
Data Protection Board of India to be established
2025–2026
Full enforcement with Data Protection Board operational
Penalties for Non-Compliance
Up to ₹250 crore (~$30M) per violation; cumulative up to ₹500 crore (~$60M)
Framework Details
Short Name
India DPDP
Jurisdiction
India
Enforcement Date
August 2023 - In Force. Rules and enforcement by Data Protection Board anticipated 2025.
Enforcing Authority
Data Protection Board of India (to be established by MeitY). Currently enforced via IT Act powers pending Board establishment.
Status
Risk Level
Affected Organizations
Any organization processing digital personal data of Indian residents for AI purposes - including foreign companies.
Tags
This is educational guidance only. Always consult qualified legal counsel for compliance decisions affecting your organization.