India's DPDP Rules and your AI features

India's Digital Personal Data Protection Act was passed in August 2023. The rules that make it work were notified in November last year, and the government gave organisations eighteen months to get ready, in two stages. The first stage arrives next month, when the provisions on consent managers come into effect. The bigger one comes in May 2027, when most obligations on businesses start to apply.

Seven months sounds like plenty. For a business that has added AI to its customer service, sales or operations over the past two years, it is less than it looks, because AI tends to spread personal data into places nobody mapped.

What happens in November

Consent managers are companies, which must be based in India and registered with the Data Protection Board, that give people one place to give, review and withdraw consent across many businesses. From November, they can start registering. As of August, though, the Board's chairperson and members had not yet been appointed, so the practical timing could slip.

For most businesses this changes nothing on day one. It is the sign that the system is being built, and that from May 2027 customers will have easier ways to see and withdraw the consents they have given you.

What applies from May 2027

The main obligations on businesses, which the law calls data fiduciaries, include:

• A standalone, plain-language notice that lists the personal data you collect and the specific purpose for each item, with consent that is as easy to withdraw as it was to give. Consent buried in general terms and conditions will not do.
• Reasonable security safeguards, such as encryption or masking, access controls, and logs kept for at least a year so breaches can be detected and investigated.
• Breach reporting: affected people must be told without delay, in plain language, and the Data Protection Board must be informed, with a detailed report within 72 hours.
• Answering people's requests to access, correct, update or erase their data within 90 days.
• Verifiable consent from a parent before processing a child's data, with limited exceptions such as healthcare and education.
• A published contact for data protection questions.

Larger businesses designated as Significant Data Fiduciaries have further duties, including audits and impact assessments. The penalties are serious: up to ₹250 crore for failing to protect data, and up to ₹200 crore for failing to report a breach or for breaking the rules on children's data.

Where AI makes this harder

Most of these rules are familiar to anyone who has dealt with privacy law elsewhere. AI adds a few complications that are easy to miss.

Chat and call records are personal data. Every conversation with your WhatsApp bot, website assistant or voice agent may contain names, phone numbers, addresses, health details or order history. Those transcripts and recordings need the same notice, security and retention rules as anything in your CRM.

Copies multiply. A single customer message may end up in your chat platform, your AI provider's logs, an analytics tool, a monitoring dashboard and a search index built for your assistant. When that customer asks you to erase their data, every one of those copies counts, including the vector database many AI assistants use to look things up.

Purpose matters. Data collected to answer a support question is not automatically available to train or tune a model, profile customers for marketing, or feed a new AI feature. If you plan to use it that way, your notice needs to say so, and you may need fresh consent.

Your AI vendors process data for you. Under the Act, you remain responsible for what the companies processing data on your behalf do with it. Check each AI provider's terms on retention, training and security, and put a proper contract in place.

The work worth starting now

1. Map where personal data goes in every AI feature: what is collected, which systems and vendors receive copies, and how long each keeps it.
2. Rewrite your notices in plain language, listing each item of data and why you collect it, in English and in the languages your customers use.
3. Set retention limits for chat transcripts, call recordings and AI logs, and delete what you no longer need.
4. Build one erasure process that reaches every copy, including AI logs and search indexes, and test it with a dummy customer.
5. Turn off training on your data wherever your AI providers allow it, and get written terms.
6. Write a breach plan: who decides, who informs customers, who tells the Board, and how you meet 72 hours.
7. Check whether your product is used by children, and if so, how you will get verifiable parental consent.

None of this needs to wait for May. Most of it is good practice that makes AI features safer and cheaper to run anyway, and larger customers often ask about it before they sign. Starting now also means the work can be spread over months instead of crammed into the last few weeks before the deadline.

This article is a practical overview, not legal advice. For decisions specific to your business, especially in health, finance or education, talk to a lawyer who works on data protection.