Digital Personal Data Protection Act (DPDP Act) 2023 & Implementation Rules
Statutory Overview
The DPDP Act 2023 is India's principal statutory framework governing the processing of digital personal data. For AI companies, it mandates explicit, itemized consent for training data containing personal identifiable information (PII), strict purpose limitation, parental consent mechanisms for children's data, and penalties reaching up to ₹250 Crore per violation.
Key Compliance Requirements for AI Companies
Explicit and verifiable notice & consent architecture prior to ingesting personal data into training corpora.
Right to erasure: AI developers must establish mechanisms for data deletion or model unlearning upon user consent withdrawal.
Strict prohibition on behavioral tracking, targeted advertising, or harmful profiling directed at minors under 18.
Data Protection Board of India (DPBI) notification within mandatory timeframes in the event of an AI data breach.
Significant Data Fiduciaries (SDF) designation for major LLM providers requiring Data Protection Officers (DPO) and regular Data Protection Impact Assessments (DPIA).
Legislative Timeline & Milestones
Presidential Assent
Passed by Lok Sabha and Rajya Sabha, published in the Gazette of India.
Draft Rules Formulation
MeitY drafts procedural guidelines for DPBI appointment and data breach protocols.
DPBI Operationalization
Establishment of the digital office of the Data Protection Board of India.
Enforcement Readiness
All generative AI providers operating in India subject to compliance audits.
Official Gazette & Regulatory References
Frequently Asked Questions & Legal Interpretations
Q:Can publicly available web data be scraped in India to train commercial LLMs?
The DPDP Act does not contain a blanket fair-use exemption for scraping personal data from public platforms without consent. AI developers scraping Indian personal data must ensure it is either fully anonymized or obtained with lawful processing grounds.
Q:What are the penalties for non-compliance by AI startups?
Fines under the DPDP Act can reach up to ₹250 Crore per incident, adjudicated directly by the Data Protection Board of India (DPBI).
Q:Are synthetic datasets exempt from DPDP Act?
Yes, fully synthetic datasets containing no traces of actual personal data or identifiable individuals fall outside the purview of the DPDP Act.