An HR executive pastes a candidate’s CV into a chatbot. A support team runs complaints through an AI summariser. Each is processing of digital personal data under India’s Digital Personal Data Protection Act, 2023. The DPDP Act and AI meet at a simple point: the Act never mentions artificial intelligence, yet its duties apply to any tool an employer uses on people’s data.
This piece sets out what the Act and the Digital Personal Data Protection Rules, 2025 require of an employer that lets staff use AI tools, and when those duties start.
When the duties apply
The Rules were notified on 13 November 2025 (G.S.R. 846(E)), and the government announced them the next day in a PIB release that describes an 18-month phased compliance timeline. A separate notification of the same date (G.S.R. 843(E)) brought the provisions on definitions and the Data Protection Board of India into force at once. The Consent Manager provisions follow one year later. The core duties of a data fiduciary, including the grounds for processing, notice, security safeguards and breach intimation, and the penalty schedule, start eighteen months after publication.
That gives employers a window, not an exemption. The obligations below are already fixed in the text; what remains is the date they bite. For the wider policy picture, see our explainer on India’s AI governance guidelines.
Who is responsible: the employer, not the AI vendor
Under the Act, the organisation that decides why and how personal data is processed is the data fiduciary. An AI provider that processes data on its behalf is a data processor. Section 8(1) is blunt: the data fiduciary is responsible for complying with the Act “in respect of any processing undertaken by it or on its behalf by a Data Processor”, irrespective of any agreement to the contrary.
Section 8(2) adds that a fiduciary may involve a processor in offering goods or services to people “only under a valid contract”. In practice, an enterprise AI subscription with written data-processing terms fits that model far better than staff signing up to free consumer chatbots on their own.
A lawful ground for each use
Section 4 allows personal data to be processed only for a lawful purpose and on one of two grounds: the person’s consent, or a “legitimate use” listed in section 7. Consent under section 6 must be free, specific, informed, unconditional and unambiguous, and limited to the data necessary for the specified purpose.
For staff data, the most relevant legitimate use is section 7(i): processing “for the purposes of employment or those related to safeguarding the employer from loss or liability”, with examples such as preventing corporate espionage and protecting trade secrets. The Act does not say whether a particular AI use, such as screening CVs or summarising performance reviews, falls within “purposes of employment”. Employers will have to judge each use on its facts until the Data Protection Board or the courts say more.
Customer and supplier data is a separate question. If customers gave consent for a specified purpose, feeding their data into an AI tool for an unrelated purpose is not covered by that consent. Rule 3 requires consent notices to give an itemised description of the personal data and the specified purpose of processing, so a new AI use may mean a new notice.
Accuracy when AI shapes a decision
Section 8(3) matters most for AI. Where personal data is likely to be “used to make a decision that affects the Data Principal”, the fiduciary must ensure its completeness, accuracy and consistency. A model’s summary of an employee’s record, or its ranking of applicants, is exactly the kind of output that can feed such a decision. Checking that output against the underlying record is a legal duty, not only good practice; our guide on checking an AI answer against its sources sets out a practical method.
Security safeguards and breaches
Section 8(5) requires reasonable security safeguards, including for processing done by a processor. Rule 6 lists the minimum:
| Rule 6 safeguard | What it means for AI tools |
|---|---|
| Encryption, obfuscation, masking or tokens | Mask names, phone numbers and account details before text reaches a model where the task allows it |
| Access control | Limit who can connect AI tools to HR, CRM or document systems |
| Logs, monitoring and review | Keep records of who sent what data to which tool |
| Log retention of one year | Retain those logs and related data for a year unless another law says otherwise |
| Contract terms with processors | Put security obligations into the AI vendor’s contract |
Source: Digital Personal Data Protection Rules, 2025, rule 6(1).
If personal data leaks, for instance through a misconfigured AI integration, section 8(6) and rule 7 require notice to each affected person without delay, describing the breach, its likely consequences and the steps they can take. The Board must be told without delay and given detailed information within seventy-two hours of the fiduciary becoming aware of the breach, or a longer period if the Board allows it.
Section 8(7) also requires the fiduciary to erase data once the purpose is served or consent is withdrawn, unless the law requires retention, and to make its processor erase the data too. Employers should know whether their AI provider keeps prompts and files, and for how long.
Cross-border processing and public data
Many AI tools run on servers outside India. Section 16 takes a negative-list approach: the central government may, by notification, restrict transfers to particular countries or territories. It also preserves any other Indian law that sets stricter limits on transfers, so sector rules still apply.
Section 3 also keeps out of the Act’s scope personal data that the person has made publicly available, or that someone is legally required to publish. That exclusion is narrow: it covers what the person chose to make public, not everything an AI tool can find about them.
Penalties
The Schedule to the Act sets maximum penalties per breach. Failing to take reasonable security safeguards can attract up to ₹250 crore. Failing to notify the Board or affected people of a breach can attract up to ₹200 crore. Breaches of other provisions can attract up to ₹50 crore.
A short checklist for employers
- List the AI tools staff actually use, including free ones, and the kinds of personal data that go into them.
- Move business use to tools with a written contract that covers security, retention and deletion.
- Record the lawful ground for each use: consent, the employment legitimate use, or another listed ground.
- Require a human check of AI output before it is used in decisions about people.
- Mask or remove identifiers where the task does not need them, and keep usage logs.
- Add AI integrations to the breach response plan, with the seventy-two-hour Board timeline in mind.
Sources
Digital Personal Data Protection Act, 2023 (sections 3, 4, 6, 7, 8, 16 and the Schedule), Gazette of India, 11 August 2023, as hosted by MeitY. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) of 13 November 2025 (rules 1, 3, 6 and 7), and commencement notification G.S.R. 843(E) of the same date. PIB release “Government notifies DPDP Rules to empower citizens and protect privacy”, 14 November 2025. Documents consulted on 13 October 2026.
