AI governance in India: DPDP Act, audit trails, access control
Indian companies using AI on personal data must meet DPDP Act duties on consent, security, logs and breach notice, with most DPDP Rules in force from May 2027.
Short answer: If your AI systems touch personal data about people in India, the Digital Personal Data Protection (DPDP) Act, 2023 applies to them: you need valid consent or another lawful basis, reasonable security safeguards, logs kept for at least a year, and breach notices within set timelines. The DPDP Rules, 2025 were notified in November 2025 and most company duties apply from May 2027, so the practical work is to put role-based access control, a complete audit trail and human approval of AI actions in place now.
This article is a practical overview for technology and operations teams, not legal advice. Check your specific obligations with a qualified lawyer.
What is the DPDP Act and does it apply to AI?
The Digital Personal Data Protection Act, 2023 is India's main law on digital personal data. It sets out who is responsible for personal data, what they must do, and what rights individuals have.
Three terms come up constantly:
- Data Principal: the person the data is about.
- Data Fiduciary: the organisation that decides why and how the data is processed. If you run an AI system on customer or employee data, you are usually the Data Fiduciary.
- Data Processor: a company that processes data on the fiduciary's behalf, such as a software or cloud vendor.
The Act does not mention AI models specifically. It does not need to. Whenever a model, agent, chatbot or analytics pipeline processes digital personal data, the Act's duties apply to that processing. A support agent that reads customer tickets, a model that scores job applicants, and a camera system that identifies people are all in scope.
India has also published separate, non-binding guidance on AI. On 5 November 2025, the Ministry of Electronics and Information Technology (MeitY) released the India AI Governance Guidelines, built on seven principles it calls "sutras": Trust, People First, Innovation over Restraint, Fairness & Equity, Accountability, Understandable by Design, and Safety, Resilience & Sustainability. These shape expectations, but the DPDP Act is the binding law for personal data.
When do the DPDP Rules take effect?
The DPDP Rules, 2025 were published in the Gazette of India as G.S.R. 846(E), dated 13 November 2025. The Rules themselves set three phases:
| Phase | What comes into force | When |
|---|---|---|
| 1 | Rules 1, 2 and 17–21: definitions and the Data Protection Board | On publication, 13 November 2025 |
| 2 | Rule 4: registration and duties of Consent Managers | One year after publication (November 2026) |
| 3 | Rules 3, 5–16, 22 and 23: notices, security, breach notice, retention, rights, children's data and the rest | Eighteen months after publication (May 2027) |
In January 2026 there were reports that MeitY was considering shortening the eighteen-month window to twelve months. As of October 2026, public trackers had found no notification making that change, so May 2027 remains the date in the Rules. Check for updates before relying on any date, because this can change by notification.
Eighteen months sounds like a long time. It is not, if you count the work: finding where personal data sits, fixing consent flows, adding logging, rewriting vendor contracts and training staff.
What does the DPDP Act require on consent?
Under Section 6, consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action." It covers only the specified purpose and only the personal data necessary for that purpose.
Some practical points for AI projects:
- Purpose matters. Data collected to deliver an order is not automatically available to train or prompt a marketing model. If you want a new use, check whether your existing consent or another lawful basis covers it.
- Notice comes first. Before asking for consent, you must give a notice describing the data and the purpose, how to exercise rights, and how to complain to the Data Protection Board.
- Withdrawal must be easy. People can withdraw consent at any time, and doing so must be as easy as giving it. Your systems need a way to stop using that person's data afterwards, including in AI pipelines.
- Children need parental consent. The Act treats anyone under 18 as a child, and processing their data requires verifiable consent from a parent or lawful guardian.
The Act also allows some processing without consent for "legitimate uses," such as certain employment purposes and medical emergencies. Whether a specific AI use falls within those is a legal question to settle early.
What duties does a Data Fiduciary have?
The Act and Rules set out duties that map directly onto how you build and run AI systems.
Reasonable security safeguards (Rule 6). At minimum, the Rules list:
- Security measures such as encryption, obfuscation, masking or tokenisation of personal data.
- Measures to control access to the computer resources used for processing.
- Visibility of who accessed personal data, "through appropriate logs, monitoring and review," so unauthorised access can be detected and investigated.
- Measures such as backups so processing can continue after an incident.
- Keeping those logs and personal data for one year to support detection and investigation, unless another law requires otherwise.
- Contract terms that require your Data Processors to take reasonable safeguards too.
- Technical and organisational measures to make sure the safeguards are actually followed.
Breach notification (Rule 7). When you become aware of a personal data breach, you must tell each affected person, without delay, what happened, the likely consequences, what you are doing and what they can do. You must also tell the Data Protection Board without delay, and send a detailed report within 72 hours of becoming aware, unless the Board allows longer on a written request.
Retention and erasure (Rule 8). You must keep personal data, associated traffic data and logs of processing for at least one year from the date of processing, for the purposes in the Rules' Seventh Schedule, and then erase them unless another law needs them. For certain classes of businesses listed in the Third Schedule, data must be erased after a set period of inactivity, with at least 48 hours' notice to the person first.
Grievances (Rule 14). You must publish how people can raise grievances and respond within a reasonable period not exceeding 90 days.
Significant Data Fiduciaries (Section 10). If the government notifies you as a Significant Data Fiduciary, you also need a Data Protection Officer based in India, an independent data auditor, periodic Data Protection Impact Assessments, and periodic audits.
What are the penalties under the DPDP Act?
The Act's Schedule sets maximum penalties per type of breach. Each is an upper limit ("may extend to"), decided by the Data Protection Board after an inquiry.
| Failure | Maximum penalty |
|---|---|
| Not taking reasonable security safeguards to prevent a breach | ₹250 crore |
| Not notifying the Board or affected people of a breach | ₹200 crore |
| Not meeting additional obligations for children's data | ₹200 crore |
| Not meeting Significant Data Fiduciary obligations | ₹150 crore |
| Breach of any other provision of the Act or Rules | ₹50 crore |
The two largest items, security safeguards and breach notice, are exactly the areas where access control and audit logs do the work.
How do access control, audit trails and human oversight fit together?
Good AI governance is mostly good data governance applied to a new kind of user: the model or agent. Three controls carry most of the load.
Access control. Treat an AI agent as a user with its own permissions, never as a superuser. Give it the narrowest role that does the job, and make it act on behalf of a real person whose permissions it cannot exceed. If a sales executive cannot see salary data, an agent working for that executive should not see it either. Keep provider keys and database credentials in a secrets store, encrypted, not in prompts or code.
Audit trail. Rule 6 asks for "appropriate logs, monitoring and review." For AI, a useful log answers five questions for every action: who asked, which data was read, which tool or model ran, what came out, and who approved it. Logs from separate systems that cannot be joined are much less useful in a breach investigation, so aim for one trail across data access, pipelines and AI.
Human oversight. For actions with real consequences, such as sending a customer email, changing a record or filing a ticket, have the agent propose and a person approve. This is also how you make the "Accountability" and "People First" principles in the national AI guidelines concrete: a named person is responsible for each consequential action.
Two AI-specific risks deserve attention:
- Prompts and outputs contain personal data. Retrieved documents, chat history and model outputs can all hold personal data. They need the same access rules, retention and erasure as the source data.
- Erasure must reach derived data. If someone withdraws consent, check whether their data sits in a search index, a cache, a fine-tuning set or saved conversation history.
A practical DPDP checklist for AI systems
Use this as a starting point with your legal and security teams.
| Area | What to do | DPDP reference |
|---|---|---|
| Data map | List every AI system, the personal data it uses, and why | Basis for notices and consent (Sections 5–6) |
| Consent and purpose | Confirm each AI use is covered by consent or a legitimate use | Sections 6–7 |
| Notice | Update privacy notices to describe AI processing in plain language | Section 5, Rule 3 |
| Access control | Give agents scoped roles tied to a real user; review roles quarterly | Rule 6(1)(b) |
| Encryption and masking | Encrypt personal data and secrets; mask fields the model does not need | Rule 6(1)(a) |
| Audit logs | Log data access, model calls, tool calls and approvals in one trail | Rule 6(1)(c) |
| Log retention | Keep processing logs at least one year, then erase unless law requires more | Rules 6(1)(e), 8(3) |
| Human approval | Require sign-off before agents take consequential actions | Accountability, good practice |
| Breach plan | Write and rehearse a plan to notify people and the Board, with a 72-hour detailed report | Section 8(6), Rule 7 |
| Vendors | Put security and retention duties in every Data Processor contract | Rule 6(1)(f) |
| Rights requests | Support access, correction, erasure and withdrawal, including in AI indexes and caches | Sections 11–13, Rule 14 |
| Children | Identify any processing of under-18s' data and set up verifiable parental consent | Section 9, Rule 10 |
Where should a company start?
- Name an owner. One person accountable for DPDP readiness across IT, legal and operations.
- Map AI use. Include the tools staff use informally, not just official projects.
- Fix the two biggest-penalty areas first: security safeguards and breach notification.
- Turn on logging now, so you have a year of history by the time the main duties start.
- Add human approval to any agent that can change data or contact people.
- Review vendor contracts before renewal dates, not after.
How CloudOEngine helps
CloudOEngine puts data connections (databases, files and camera streams), pipelines, the AI runtime, Vision AI and live video in one platform and console, under one permission model and one audit trail. That means access to personal data, pipeline runs and AI actions are controlled and recorded in the same place, rather than in separate tools whose logs cannot be joined.
Governance is included, not upsold: tenant isolation, role-based access, audit logs and per-tenant encrypted secrets come as standard.
AI agents in CloudOEngine run real tools, such as filing a ticket, and every step and tool call is traced and inspectable. With Autopilot, triggered agents follow approval rules, so a person approves an action in the app or through an email approve link before it runs. That gives you a clear record of what the agent proposed, who approved it and what happened.
CloudOEngine does not replace legal advice or your own DPDP programme. It gives your teams a single, controlled place to run data and AI work so that the evidence your programme needs already exists. CloudOEngine is built in Bengaluru, India.
Book a demo · See the data layer
Frequently asked questions
When do the DPDP Rules come into force?
The DPDP Rules, 2025 were published in the Gazette on 13 November 2025. Rules on the Data Protection Board applied immediately, Consent Manager registration applies after one year (November 2026), and most duties on companies apply after eighteen months (May 2027).
Does the DPDP Act apply to AI systems?
The Act does not regulate AI as such, but it applies whenever an AI system processes digital personal data. If your model, agent or analytics pipeline uses data about identifiable people, the same consent, security, retention and breach duties apply.
How quickly must a personal data breach be reported under the DPDP Rules?
The Rules require a company to inform affected individuals and the Data Protection Board without delay, and to send the Board a detailed report within 72 hours of becoming aware of the breach, unless the Board allows longer on a written request.
How long must logs be kept under the DPDP Rules?
The Rules require personal data, traffic data and logs of processing to be kept for at least one year from the date of processing for specified purposes, and security logs to be kept for one year, unless another law requires something different.
What is the maximum penalty under the DPDP Act?
The highest penalty in the Act's Schedule is up to ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach. Failing to notify a breach can attract up to ₹200 crore.
Is this article legal advice?
No. It is a practical overview for technology and operations teams; confirm your obligations with a qualified lawyer.
Sources
- Digital Personal Data Protection Rules, 2025 — Gazette notification G.S.R. 846(E) (MeitY)
- The Digital Personal Data Protection Bill, 2023 — PRS Legislative Research
- DPDP Act 2023, Section 6: Consent (statutory text)
- DPDP Act 2023, Section 10: Significant Data Fiduciaries (statutory text)
- DPDP Act 2023, The Schedule: penalties (statutory text)
- DPDP Act and Rules timeline and status tracker
- MeitY unveils India AI Governance Guidelines (The Tribune, November 2025)