DPDP Rules and AI tools: a privacy checklist for Indian businesses

If your team pastes customer emails into a chatbot, runs leads through an AI scoring tool or lets an AI assistant summarise support tickets, you are processing personal data, and India's Digital Personal Data Protection (DPDP) Act applies to it. The good news is that the main obligations under the DPDP Rules, 2025 are scheduled to apply from 13 May 2027, so there is still time to get AI use in order. The less good news is that AI tools are often where personal data leaks out of a business without anyone noticing.

This guide sets out the timeline as it stands at the time of writing (November 2026) and a practical checklist for using AI tools with customer data. It is general information, not legal advice: for your specific situation, speak to a qualified lawyer.

The DPDP timeline at a glance

The DPDP Act was passed in August 2023. The government notified the DPDP Rules in November 2025 with a phased start, summarised by law firms including Hogan Lovells as follows:

One thing to watch: in early 2026 the Ministry of Electronics and Information Technology (MeitY) consulted industry on proposals to shorten parts of this timeline. At the time of writing, published guidance still points to May 2027 for the core obligations, but check for new notifications before you plan around that date.

Penalties are significant. According to the government's own explainer, failing to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore, and failing to report a breach or breaching obligations relating to children up to ₹200 crore each.

Why AI tools need special attention

Under the Act, your business is usually the Data Fiduciary: you decide why and how personal data is processed. An AI vendor that processes data on your behalf is generally a Data Processor. Unlike the GDPR, the DPDP Act does not place obligations directly on processors. Responsibility stays with you, and you are expected to make sure your processors comply, typically through a contract.

That matters for AI because so much use is informal. A sales executive on a free chatbot account, a browser extension that reads your inbox or an automation that sends form submissions to a model API can each move personal data to a third party without a contract, a retention limit or a record of what was shared.

A checklist for using AI with personal data

1. 1 List every AI tool in use. Include chat assistants, meeting note-takers, browser extensions, CRM add-ons and automations. Ask teams what they actually use, not just what was approved.
2. 2 Map what personal data goes into each. Names, phone numbers, emails, order history, call recordings, CVs and support conversations all count. Note whether any of it could relate to children.
3. 3 Check the account type and terms. Business and API plans from major AI vendors usually offer different data-use and retention terms from free consumer accounts. Confirm in writing whether your inputs are used to train models, how long they are kept and where they are stored.
4. 4 Put a contract in place. Use the vendor's data processing agreement or business terms, and keep a copy. Free personal accounts rarely give you the controls you need as a Data Fiduciary.
5. 5 Minimise before you send. Strip or mask identifiers before data reaches the model where the task allows it. A model summarising complaint themes rarely needs phone numbers.
6. 6 Update your notices. The Rules require a clear, standalone notice explaining the specific purposes for which personal data is collected. If AI processing is one of those purposes, say so in plain language.
7. 7 Set retention rules. Decide how long prompts, transcripts and AI outputs containing personal data are kept, and switch off history or logging you don't need.
8. 8 Plan for rights requests. Individuals can ask to access, correct or erase their data, and the government's explainer says requests must be answered within 90 days. Know which AI tools hold data you would need to find or delete.
9. 9 Add AI to your breach plan. If an AI tool or its vendor is involved in a breach, you still need to inform the Board and affected people. Law firm summaries of the Rules describe a prompt initial report followed by a detailed report within 72 hours.
10. 10 Write a one-page AI use policy. Say which tools are approved, what data may never be pasted in, and who to ask. Short policies get read.

Common AI uses and what to check

Security safeguards for AI workflows

The Rules describe reasonable security safeguards such as encryption, masking or tokenisation, access controls, monitoring and backups. For AI workflows, that translates into a few concrete habits:

• Use company accounts with single sign-on rather than personal logins.
• Store API keys in a secrets manager, not in spreadsheets or automation notes.
• Limit which staff can connect AI tools to your CRM, inbox or helpdesk.
• Keep logs of what automations send to AI services, and review them occasionally.
• Remove access for leavers from AI tools as well as email.

The safest personal data in an AI workflow is the data you never sent.

Frequently asked questions

Is it legal to use ChatGPT or similar tools with customer data in India?

The DPDP Act does not ban it. It requires lawful processing for a stated purpose, reasonable security and accountability for any vendor you use. In practice that points to business accounts with clear data terms rather than free personal accounts.

Does the DPDP Act apply to small businesses?

Generally, yes. The Act has no general size threshold, although it allows the government to relax some provisions for notified classes such as start-ups, so check whether any notification covers you. The heavier duties, such as independent audits and impact assessments, apply to organisations notified as Significant Data Fiduciaries.

Do we need customer consent to use AI on their data?

It depends on your lawful basis and purpose. Where you rely on consent, your notice should cover the purposes the data is used for, including AI processing where that is part of it. A lawyer can confirm what applies to your case.

What happens on 13 November 2026?

The rule on consent manager registration is scheduled to take effect. Most businesses won't act on this directly, but it is a reminder that the main deadline is about six months away.

Need help with AI and data protection?

We build AI automations with data minimisation, access controls and logging designed in from the start, and we can review existing workflows to see where personal data goes. See our AI automation services, our guide to adding an AI chatbot to your website, or get in touch about an AI workflow review.

Sources: PIB backgrounder: DPDP Rules, 2025 notified, Hogan Lovells: India's DPDP Act brought into force, King Stubb & Kasiva: DPDP compliance deadlines, S.S. Rana & Co.: MeitY proposal to shorten the DPDP timeline