Does Your Company’s AI Usage Comply with India’s IT Act and DPDP Act?

On 13 November 2026, the second phase of India’s Digital Personal Data Protection Act (DPDPA) will begin. This marks a crucial period for businesses to officially notify various obligations on consumer data usage, data retention strategy, cloud security and digital information disposal.

As businesses integrate AI into their operations, they must also assess how these technologies collect, access, analyse and process personal data.

A McKinsey survey of 1,993 companies across 101 countries found that 88 per cent of respondents used AI in at least one business function in 2025. Similarly, the NASSCOM market report states that approximately 87 per cent of enterprises in India use artificial intelligence (AI) solutions. These figures highlight the growing adoption of AI across commercial operations and the need for companies to understand how these technologies interact with personal data.

Types of AI used in commercial operations

A NASSCOM report published in September 2026 highlights how businesses are moving beyond static, single-prompt AI models towards adaptive, agentic, and resilient systems designed to support complex, high-stakes operations.

Businesses that rely on cloud infrastructure may also integrate AI platforms and software into their operations. Based on their functionality and deployment models, businesses generally use two types of AI solutions.

As companies develop proprietary AI platforms and digital data tools, they must establish robust frameworks to protect their systems against cyberattacks and mitigate legal exposure arising from data breaches.

While India’s Digital Personal Data Protection (DPDP) Act and Rules provide a comprehensive framework for the lawful processing and use of digital personal data in business operations, companies must also consider other applicable regulatory requirements, including those under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules.

CLICK HERE: Deepfake, Content Labelling & Safe Harbour Risks for Global Platforms: India AI Regulations

Why it is important to secure your digital data

Businesses increasingly rely on AI platforms to improve productivity and automate routine operations. Employees use these tools for activities such as image generation, translation, content summarisation, data analysis, and workflow automation. However, greater reliance on AI also increases the risk of exposing confidential business information, proprietary data, and personal information.

AI-related data leakage occurs when sensitive or confidential information becomes accessible to unauthorised parties. Such incidents can arise at different stages of the AI lifecycle, including data collection, model development, training, deployment, and day-to-day use. Vulnerabilities in connected applications, application programming interfaces (APIs), and cloud infrastructure can further expose business data to cyberattacks, unauthorised disclosure, theft, or misuse.

Financial consequences of inadequate data security

IBM’s Cost of a Data Breach Report 2026 highlights the growing economic impact of cyber incidents around the world, particularly those involving AI.

– Rising AI-driven attacks: AI-driven attacks increased by 56 per cent compared with the previous year’s study. These attacks added an average of US$1 million to the cost of each breach.

– Higher global breach costs: The global average cost of a data breach rose by 12 per cent, reaching nearly US$5 million.

– Security gaps in AI infrastructure: As per the IBM report findings, approximately one in five organisations reported an AI-related breach.

Country-wise Cost of Data Breach (Value in USD Million)
S no.	Country/region	2026	2025
1	United States	11.50	10.22
2	Middle East	8.00	7.29
3	Benelux	7.37	6.24
4	Canada	5.20	4.84
5	Germany	4.93	4.03
6	LATAM	4.65	3.81
7	United Kingdom	4.17	4.14
8	Italy	4.12	3.44
9	ASEAN	4.12	3.67
10	France	4.05	3.73
11	Japan	4.01	3.65
12	South Africa	3.04	2.37
13	South Korea	3.03	2.84
14	Australia	2.96	2.55
15	India	2.79	2.51
16	Brazil	1.41	1.22

Source: Cost of Data Breach Report 2026, IBM

Regulatory obligations for companies using AI under India’s IT Act

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, introduce specific requirements for handling synthetically generated information under the Information Technology Act, 2000. These amendments primarily address intermediaries that enable users to upload, publish or share digital content. They do not impose a blanket set of AI-use obligations on every company that deploys AI in its business operations.

The amended rules define ‘synthetically generated information’ as audio, visual or audio-visual content that a computer resource artificially or algorithmically creates, generates, modifies or alters to make it appear real, authentic or true.

It must be noted that the rules exclude certain routine or good-faith activities, including formatting, technical corrections, accessibility improvements, translation and document preparation, provided these activities do not materially alter or misrepresent the underlying content or create false documents or electronic records.

Implications for companies using AI

Companies that use AI for internal activities such as research, translation, document preparation, summarisation and presentations do not automatically fall within the Significant Social Media Intermediaries (SSMIs) SSMI-specific declaration and labelling requirements.

However, firms that operate intermediary platforms or social media services must assess whether they fall within the relevant regulatory categories and implement the corresponding due diligence measures. Other companies should consider the amendment when they create, modify or distribute AI-generated content, particularly where such content could involve impersonation, misrepresentation or unlawful use.

The 2026 amendments therefore focus on intermediary accountability and safeguards for synthetically generated information rather than regulating every business application of AI.

Regulatory obligations for companies using AI under the DPDP Act

India’s Digital Personal Data Protection (DPDP) Act, 2023, does not establish a separate regulatory framework specifically for artificial intelligence. However, its provisions apply when companies use AI systems to process digital personal data, including information relating to customers, employees and other identifiable individuals. The DPDP Rules, 2025, specify the safeguards and operational requirements that Data Fiduciaries must implement.

Companies using AI for customer profiling, automated analytics, personalised services, recruitment or employee management must therefore ensure that their processing activities comply with the following requirements.

1. Obtain valid consent and explain the purpose of processing

Under the DPDP Act, companies must process personal data for a lawful purpose and rely on a permitted basis under the Act. Where they rely on consent, they must obtain consent that is free, specific, informed, unconditional and unambiguous through a clear affirmative action by the individual.

Rule 3 of the DPDP Rules, 2025, requires Data Fiduciaries to provide a clear and independent notice explaining the following:

• Categories of personal data the company intends to process.
• Specific purpose of processing and the goods, services or uses that the processing will enable.
• How individuals can withdraw consent, exercise their rights and raise complaints.

Companies should ensure that their notices cover relevant AI-enabled processing activities. For example, if a business uses customer information to generate personalised recommendations or analyse purchasing behaviour, its stated processing purposes should cover those activities.

2. Implement security safeguards for AI-related data processing

Rule 6 requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches. These requirements also cover processing undertaken on their behalf by data processors, including third-party service providers.

The prescribed safeguards include the following:

• Encryption, masking, obfuscation or tokenisation of personal data
• Access controls for computer resources used by the company and its data processors
• Logs, monitoring and periodic reviews to identify unauthorised access
• Data backups and measures to maintain processing continuity
• Contractual provisions requiring data processors to implement security safeguards
• Technical and organisational measures to support effective compliance

Companies should apply these safeguards to AI applications that process personal data, including tools used by employees and systems integrated into business operations.

3. Maintain accountability when engaging third-party AI providers

Companies often engage external AI developers, cloud service providers and technology vendors to process personal data on their behalf. Under the DPDP framework, a data fiduciary remains responsible for complying with its obligations when it engages a data processor.

Businesses should review their arrangements with AI vendors and establish appropriate contractual safeguards. These agreements should address data security, access permissions, processing responsibilities and applicable compliance requirements.

For example, a company that uses an external AI platform to analyse customer records should determine whether the provider processes personal data on its behalf and ensure that the relevant contractual obligations cover that activity.

4. Assess algorithmic risks and conduct periodic audits

The DPDP Rules impose additional obligations on Significant Data Fiduciaries (SDFs). Under Rule 13, an SDF must conduct a Data Protection Impact Assessment (DPIA) and an audit at least once every 12 months to assess compliance with the Act and the Rules.

An SDF must also exercise due diligence to verify that its technical measures, including algorithmic software used to host, display, upload, modify, publish, transmit, store, update or share personal data, are unlikely to pose risks to the rights of Data Principals.

SDFs that use AI-enabled algorithms or automated systems to process personal data must consider these requirements when assessing the impact of their technical systems on individuals’ data protection rights. These additional obligations apply to entities notified or classified as SDFs; they do not establish a universal annual AI audit requirement for every company.

5. Follow data retention and erasure requirements

Rule 8 requires Data Fiduciaries covered by the specified classes and purposes in the Third Schedule to erase personal data after the prescribed period expires, unless they need to retain it to comply with applicable law.

The Rules also require Data Fiduciaries to retain personal data, associated traffic data and processing logs for at least one year for the purposes specified in the Seventh Schedule, subject to applicable legal requirements.

Companies should establish retention and deletion controls for personal data used in AI applications. They should review whether such information remains stored in AI platforms, datasets, training environments or associated processing systems after the original purpose has been fulfilled. 

ALSO READ: Does Your Company Require Cyber Insurance to Comply with India’s DPDP Law?

Preparing for AI-related data protection compliance

Businesses should begin by identifying the AI tools used across their operations, the personal data those tools process and the third-party providers that can access or retain that information. They should then assess their privacy notices, consent mechanisms, vendor agreements, security controls, retention policies and breach-response procedures against the applicable requirements.

Companies that operate intermediary platforms must separately assess their obligations under the amended IT Rules.

Effective AI governance in India require companies to maintain oversight of how their systems process personal data and to establish appropriate controls throughout the data lifecycle. This will help them manage regulatory and security risks as they expand their use of AI.