DPDP Act 2023

The DPDP Act 2023 is India's first comprehensive personal-data law. It applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. It introduces the roles of Data Fiduciary (the organisation deciding why and how data is processed) and Data Principal (the individual), and establishes a Data Protection Board to hear complaints and impose penalties.

Core obligations include obtaining clear, specific consent or relying on a listed legitimate use, collecting only what the stated purpose needs, keeping data accurate and secure, deleting it when the purpose ends, and honouring individuals' rights to access, correction and erasure. Additional duties apply to children's data and to organisations designated as Significant Data Fiduciaries. Detailed rules under the Act are notified by the Ministry of Electronics and Information Technology.

For AI systems the practical questions are: does the training or retrieval corpus contain personal data, was it collected for this purpose, can you delete an individual's data on request, and where is it processed. DPDP is not the same as GDPR, though the concepts overlap; it has its own definitions, consent mechanics and enforcement body.

• Compliance officer: the Act makes purpose limitation and deletion rights enforceable, which directly constrains how AI corpora are built and retained.
• CTO / Head of Engineering: deletion requests must reach vector indexes, fine-tuning datasets and logs, not just the primary database.
• Founder / CEO: penalties are imposed by the Data Protection Board on the organisation, so accountability sits with leadership.
• HR head: employee data used in HR copilots or analytics falls under the same consent and purpose rules.
• Product manager: consent flows and privacy notices become part of the product surface, not a legal afterthought.

The Act exists because India lacked a single enforceable standard for personal-data handling as digital services and AI scaled across the country. It gives individuals defined rights and gives organisations a clear set of duties with a regulator behind them. For AI teams it solves an ambiguity: whether customer data can be reused for model training, retrieval or analytics without fresh consent. The trade-off is engineering cost. Purpose tagging, retention limits and deletion across every derived store add work to a project, but they are far cheaper to build in from the start than to retrofit after a complaint.

• A lender mapping which fields in its KYC pipeline are personal data and restricting model access to only those needed for the stated purpose.
• A D2C brand building consent capture into its WhatsApp personalisation flow before using purchase history for recommendations.
• An ed-tech platform applying verifiable parental consent rules before processing learner data for adaptive paths.
• A hospital defining retention periods for AI-generated summaries of patient interactions and deleting them on schedule.
• A SaaS company adding a deletion workflow that purges a user's records from vector indexes and conversation logs, not just the user table.

Standard / regulationA statute you comply with rather than a skill you hire. Eazyware designs AI systems with consent capture, purpose limits and deletion paths built in, delivered through Private Agentic AI and the security practices described on our security page.

Eazyware service that covers it: Agentic AI Solutions (self-hosted). Starting prices are on the pricing page.