India Deleted the Legal Basis Your AI Pipeline Runs On
Most US SaaS companies train, personalise, and analyse on a legitimate-interests footing borrowed from GDPR. India's data protection regime does not offer that footing. With the DPDP rules notified and the compliance clock running, that is not a drafting nuance — it is a hole in the lawful basis for every Indian record in your training set.
The Law, Briefly
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection statute. It sat largely dormant for two years because it delegated nearly all operational detail to rules that had not been made. Those rules are now notified, with a phased runway that brings the substantive obligations into force in stages rather than on a single date.
It is a short act by GDPR standards and it is not an AI law. It never uses risk tiers, never mentions model training as a category, and imposes no conformity assessment. It reaches AI the way privacy law always reaches AI: by governing the personal data that goes in and the decisions that come out.
Why a US-Only Company Is In Scope
The Act applies to processing of digital personal data outside India where it is connected with offering goods or services to individuals within India. That is the familiar targeting test, and it produces the familiar result.
- You have Indian paying customers using an AI feature — in scope
- Your free tier has meaningful Indian signups — in scope
- You price in INR or run India-targeted marketing — clearly in scope
- Your Indian usage came in through a global English product — still in scope
You are the data fiduciary. Your users are data principals. Your subprocessors — including your model vendor, if it processes on your behalf — are data processors, and you stay accountable for what they do.
The Four Obligations That Land on AI Features
Consent That Is Specific, Itemised, and Withdrawable
Consent must be free, specific, informed, unconditional and unambiguous, given for a stated purpose, and limited to the data necessary for it. Notice must accompany it in plain language and be available in English and the scheduled Indian languages. Critically, withdrawal must be as easy as giving consent — which means an AI feature relying on consent needs a real off switch, not a support ticket.
Purpose Limitation Your Training Pipeline Will Violate
Consent is scoped to the purpose you named. 'Deliver the service you signed up for' does not silently include 'train our models on your content.' If you want Indian customer data in a training corpus, that is a separate purpose requiring its own itemised notice and consent — and a withdrawal that actually removes the data from future processing.
Erasure That Reaches the Model
Data principals can demand correction and erasure, and a fiduciary must erase personal data when consent is withdrawn or the purpose is no longer served, unless retention is legally required. This is the obligation that quietly breaks AI architectures: deleting a row from Postgres is easy, and demonstrating that the same person's data is not still influencing a fine-tuned model is not. Design retention so training corpora are rebuildable from a source of truth you can actually delete from.
Breach Notification Without a Materiality Filter
The Act requires notifying both the Data Protection Board and each affected data principal of a personal data breach, with the rules setting the timing and content. There is no GDPR-style 'unlikely to result in a risk' escape hatch to lean on. For AI products, remember that prompt-injection exfiltration and over-broad retrieval permissions are personal data breaches, not merely quality bugs.
DPDP Is Not GDPR With Different Nouns
- •Your data inventory and processing map
- •Subprocessor list and vendor contract discipline
- •DSAR intake and identity verification flow
- •Security controls and breach runbook
- •Retention schedules, if they are real
- •Legitimate interests — no equivalent basis exists
- •Child threshold is 18, not 13 or 16
- •Penalties are fixed rupee ceilings, not % of turnover
- •Consent notices must be offered in scheduled Indian languages
- •No standalone right to data portability or to object as GDPR frames them
- •A consent manager institution with no GDPR analogue
The Children's Data Trap
This is where US products fail most predictably. American consumer software is built around COPPA's age line of 13, and privacy engineering is designed to that number. India draws the line at 18 and requires verifiable parental or guardian consent below it, plus restrictions on tracking, behavioural monitoring, and targeted advertising to children.
For an AI product with any teen usage — study tools, creative tools, chat assistants, anything with a school channel — the practical question is not "do we have parental consent flows?" but "do we know which of our Indian users are 16?" Most products cannot answer that, and the answer is not a checkbox that says "I am over 18."
A Practical Order of Operations
- Measure Indian exposure. Count Indian accounts, Indian traffic, and INR revenue. Most teams have never pulled this number.
- Find every processing purpose currently resting on legitimate interests. That list is your India gap, item by item.
- Separate training from service delivery. If Indian data feeds a model, give it its own itemised notice and consent — or exclude Indian records from the corpus.
- Make withdrawal real. A user-facing toggle that stops future processing and triggers deletion, not an email address.
- Fix the age line. Decide whether under-18 Indian users exist and, if so, build verifiable guardian consent or block the cohort.
- Write the memo. One page: our scope, our lawful bases, our conclusion on Significant Data Fiduciary designation, and why. That page is what an Indian enterprise buyer asks for.
Frequently Asked Questions
Can we just exclude Indian users from AI training and move on?
Often that is the cheapest compliant answer, and it is a legitimate design choice. But it only works if your pipeline can actually segregate by data-principal residence at ingest — and if you can prove it did. Teams that discover their corpus has no region column find that exclusion is a bigger project than consent.
Does DPDP restrict where we store Indian data?
The Act allows cross-border transfer by default, subject to the government restricting transfer to specified countries, with sector regulators able to impose stricter localisation. That is a meaningfully lighter posture than earlier Indian drafts, but it is a permission that can be narrowed by notification rather than a guarantee. Do not build an architecture that cannot regionalise if it has to.
We are a B2B tool. Does employee data of an Indian customer count?
Yes. Personal data is personal data regardless of whether the individual is a consumer or your customer's employee. Your customer will typically be the fiduciary for its own workforce data and you the processor — which makes your data processing agreement, your deletion capability, and your breach-notification support the things they will actually audit.
Who enforces this and how active are they?
The Data Protection Board of India adjudicates and imposes penalties. It is a new institution operating under newly notified rules, so an enforcement track record is still forming. Treat the current period as the window to fix architecture cheaply rather than as evidence that nothing will happen.
Does India have an AI act on top of this?
Not a comprehensive one. India has pursued advisories, governance guidelines, and sector-specific direction rather than a horizontal statute, and its stated posture leans pro-innovation. For now, DPDP plus IT-rules obligations and sector regulation is the compliance surface an AI product actually meets in India.
The Missing Basis Is the Whole Story
Every other DPDP obligation has a recognisable GDPR shape you can retrofit. The absence of a legitimate-interests basis does not. It means an entire class of processing your product does silently — improving the model, enriching profiles, scoring behaviour — needs an explicit, withdrawable, purpose-scoped yes from Indian users, or it needs to not happen to Indian data.
That is an architecture decision, and architecture decisions get expensive after launch. It is worth making deliberately now, while India is still a line item on your growth plan rather than a material share of your revenue.
This article is general information about a newly operational regulatory regime, not legal advice. DPDP rules are phased and subject to notification changes — verify current requirements and timelines with Indian counsel before relying on any position described here.