DPDP Act sets new guardrails for India's Al ecosystem

India's data law reshapes the foundations of Al by enforcing trust, clarity, and responsible innovation across every layer of its evolving digital ecosystem.

- BY JASPREET SINGH

The Digital Personal Data Protection Act (DPDPA) is a significant milestone in India's digital transformation journey, establishing a comprehensive legal framework for safeguarding personal data.

By defining clear rules for data usage, privacy protection, and technology-enabled compliance, the Act is poised to strengthen India's Al mission by fostering greater trust, accountability, and innovation across the rapidly expanding Al ecosystem.

Enacted in August 2023, the DPDPA is India's first holistic legislation governing the protection of digital personal data. It outlines the principles and requirements for how organisations collect, process, store, and transfer the personal data of Indian citizens.

The Act grants individuals, the “data principals”, rights such as consent, correction, erasure, and grievance redressal, while simultaneously placing obligations on organisations or data fiduciaries to ensure lawful data processing, maintain adequate safeguards, and report data breaches in a timely manner.

PROVISIONS FOR DATA PRIVACY AND AI

For Al companies, the DPDPA's rules on consent and lawful processing require that personal data used for training or model development be collected with explicit consent or on a legal basis. This ensures that Al systems do not rely on datasets obtained without user awareness or approval.