India · Binding law
DPDP Act compliance for AI systems in India
India's Digital Personal Data Protection Act, 2023 governs how organisations process digital personal data. The DPDP Rules, 2025, notified in November 2025, bring most obligations into force on 13 May 2027. AI systems that make or support decisions about people sit squarely inside it: data used for those decisions must be accurate and complete, and Significant Data Fiduciaries face impact assessments and audits.
What the DPDP Act asks of AI systems
The obligations most relevant to bias, risk, and accountability, summarised from the Digital Personal Data Protection Act, 2023 (India).
- Sec. 4–6Lawful processing and consent
- Process personal data only for a lawful purpose, with consent or a recognised legitimate use.
- Sec. 8(3)Accuracy for decisions
- Ensure completeness, accuracy, and consistency when personal data is used to make a decision that affects the Data Principal.
- Sec. 8(5)Security safeguards
- Reasonable security safeguards to prevent personal data breaches.
- Sec. 10Significant Data Fiduciaries
- Data Protection Impact Assessments, periodic audits, and a Data Protection Officer based in India.
- Rule 13(3)Algorithmic due diligence
- Significant Data Fiduciaries must verify that technical measures, including algorithmic software, used to host, store, transmit, or share personal data are not likely to pose a risk to Data Principals’ rights.
Evidence FairMind helps you produce
FairMind links technical evidence to DPDP Act obligations for a human reviewer to accept. It is not legal advice and does not decide compliance.
- An inventory of AI systems that process personal data, with owner and purpose
- Data quality and bias evaluations tied to the decisions each system supports
- Impact assessment records with reviewer sign-off and open risks
- Audit-ready exports that show what was tested, what failed, and what was fixed
DPDP Act questions
Does the DPDP Act apply to AI models?
Yes, whenever an AI system processes digital personal data of individuals in India. The Act does not single out AI, but its accuracy, purpose, and safeguard duties apply to any processing an AI system performs.
What are the penalties under the DPDP Act?
Once the relevant provisions commence on 13 May 2027, the Data Protection Board can impose penalties of up to 250 crore rupees for failing to take reasonable security safeguards. Other breaches carry lower caps.
How does FairMind help with DPDP compliance?
FairMind keeps the technical evidence for each AI system (evaluations, findings, remediation, and reviewer decisions) in one record you can hand to your DPO or auditor. It does not provide legal advice.