The DPDP Act 2023 and AI: What Indian Businesses Building AI Systems Need to Know
India's Digital Personal Data Protection Act 2023 is the country's first comprehensive data privacy law. If your business processes personal data of Indian residents — and if you're building AI systems, you almost certainly do — this law affects you.
This article explains what the DPDP Act means for AI systems specifically, what's required now, and how private LLM deployment addresses the most common compliance gaps.
What the DPDP Act Covers
The DPDP Act applies to the processing of 'digital personal data' of Indian residents. Personal data is any information that identifies or can identify an individual — names, phone numbers, email addresses, financial information, health data, location data, biometric data.
If your AI system:
- Processes customer names and phone numbers for a chatbot → DPDP applies
- Analyzes medical records for a healthcare AI tool → DPDP applies
- Handles employee data for an HR automation → DPDP applies
- Processes financial records for invoice automation → DPDP applies
Key Requirements for AI Systems
1. Lawful Purpose and Consent
You must have a lawful basis for processing personal data. For most business AI applications, this means either:
- Consent — the individual has explicitly agreed to their data being processed
- Legitimate use — processing is necessary for a function the individual would reasonably expect (customer service, contract fulfillment)
For AI chatbots: Add a disclosure notice before data collection. This conversation is processed by an AI system. Your contact details will be stored for follow-up. [Accept / Decline]
2. Data Minimization
Collect only what you need. If your AI calling agent only needs name and phone number to qualify a lead, don't also capture email, company, and location unless you actually use all of it.
3. Cross-Border Data Transfers
The most critical issue for AI systems: The DPDP Act authorizes the government to restrict certain categories of personal data from being transferred outside India. While final restricted categories are pending notification, sensitive personal data (financial, health, biometric) is expected to face restrictions.
Practical implication: If you're sending customer financial data, medical records, or sensitive personal information to OpenAI's US servers or Google's Gemini API, you may be in violation once the cross-border rules are notified.
This is the single strongest compliance argument for private LLM deployment: keep all data processing on Indian servers, and the cross-border question disappears entirely.
4. Security Safeguards
The Act requires 'reasonable security safeguards' to prevent data breaches. For AI systems, this means:
- Encrypted data in transit (HTTPS/TLS)
- Encrypted data at rest
- Access controls limiting who can query the AI system and see its logs
- Audit logs of data processing
5. Data Retention Limits
You cannot keep personal data longer than necessary. For AI chatbot conversations: define a retention policy (e.g., conversation logs deleted after 12 months) and implement it.
High-Risk Categories
| Category | Stricter Requirements | Common AI Use Case |
|---|---|---|
| Health data | Explicit consent required | Medical chatbots, health apps |
| Financial data | Enhanced security + likely localization | Invoice processing, BFSI chatbots |
| Children's data (<18) | Verifiable parental consent | EdTech platforms |
| Biometric data | Explicit consent + restricted processing | Attendance systems, face recognition |
The Significant Data Fiduciary Classification
Businesses that process large volumes of personal data may be classified as 'Significant Data Fiduciaries' (SDFs) by the central government. SDFs face additional requirements including:
- Data Protection Impact Assessments
- Appointment of Data Protection Officers
- Periodic audits
- Algorithm transparency requirements
While the SDF list is pending, large-scale AI systems handling millions of records should prepare for this classification.
Practical Compliance Checklist for AI Systems
Immediate actions:
- Document every AI system that processes Indian personal data
- Add privacy notices and consent mechanisms to all AI interfaces
- Review data flows: what data goes to which AI API and where are those servers located?
- Implement data retention policies
For compliance-sensitive sectors (BFSI, healthcare, legal):
- Evaluate whether current AI APIs (OpenAI, Gemini) are appropriate given cross-border concerns
- Consider private LLM deployment on Indian infrastructure for sensitive workloads
- Appoint or designate someone responsible for data protection
Documentation:
- Maintain a Record of Processing Activities (ROPA) for each AI system
- Document your lawful basis for each data processing activity
The Private LLM Solution
The cleanest compliance path for processing sensitive Indian personal data with AI: keep everything on Indian soil.
Self-hosted Ollama (running Mistral 7B or LLaMA 3) on AWS Mumbai or an on-premise server processes every query locally. No data leaves India. No cross-border transfer questions. No dependency on foreign API availability or policy changes.
We've deployed this architecture for banking, insurance, and legal clients in Gujarat and Maharashtra. The compliance clarity alone justified the deployment cost — the cost savings from eliminated API fees were a bonus.
We're Monk Media One Tech — AI automation agency, Ahmedabad. We specialize in privacy-compliant AI deployments for Indian businesses.
Book a free discovery call: monkmediaone.tech/contact
📞 +91 88668 19349 | hello@monkmediaone.tech