The DPDP Act applies fully to AI workloads in India. The Act does not have a separate carve-out for AI training, AI inference, or AI-driven decisions. Personal data is personal data regardless of which system processes it.
But the operational implications for AI are specific and substantial. AI workloads create four categories of complication that traditional data processing does not — training data consent, inference and erasure propagation, automated decision explainability, and cross-border model hosting. This article walks through each in operational depth.
Four Core Complications for AI Workloads
Complication 1 — Training Data Consent
Using customer personal data to train AI models is processing under the DPDP Act. It requires consent — and consent for service delivery is not consent for AI training, because the Act treats them as different purposes.
The architectural problem is that most Indian enterprises now training AI models have customer datasets that were collected over years, with consent text drafted before AI training was contemplated. Backfilling consent requires systematic outreach or reliable anonymization protocols.
Three viable approaches exist:
- Obtain specific fresh consent for AI training, either as part of consent refresh cycles or at meaningful customer touchpoints.
- Anonymise data sufficiently that it falls outside the DPDP scope — ensuring re-identification risks are scientifically evaluated.
- Rely on legitimate use provisions where they genuinely apply, acknowledging that statutory exceptions are narrowly construed.
Complication 2 — AI Inference and the Right to Erasure
When a Data Principal exercises the right to erasure, what happens to the AI systems that processed their data?
The Act does not require retraining of large foundation models for every individual erasure. But it does require that personal data be removed from storage layers where it is held:
- Vector Databases & Embedding Stores: Personal data embedded into vectors must be removable, requiring architecture to track which embeddings derive from which user records.
- RAG Knowledge Bases: Personal data in retrieval-augmented generation stores must be scrubbed from index documents upon erasure requests.
- Training Corpora: Stored training datasets must purge erased user records to prevent re-incorporation in future retraining cycles.
Complication 3 — Automated Decision-Making and Explainability
When AI makes a decision that significantly affects a Data Principal — credit underwriting, insurance claim adjudication, recruitment screening, fraud detection — the individual has rights to information regarding the basis of the decision.
AI explainability is therefore mandatory in regulated decision contexts. Systems must support decision logging, clear natural-language explanation generation, accessible human review pathways, and transparent communication for adverse determinations.
Complication 4 — Cross-Border AI Model Hosting
Many enterprise AI workloads utilize foundation model APIs hosted outside India (e.g., Azure OpenAI, AWS Bedrock, Anthropic). While DPDP permits cross-border transfers by default, the Central Government retains the power to restrict destinations by notification. Organizations must maintain contingency architecture, including domestic Indian cloud regions and on-premise inference fallback.
The Unified AI Governance Posture
Mature AI governance under the DPDP Act brings privacy, security, and data science teams into a single operational architecture:
- Training Data Inventory: Full register of all training datasets, paired with verified consent metadata and purpose mapping.
- Data Lineage Tracking: Traceability from raw customer records through embeddings to fine-tuned model checkpoints.
- Explainability Infrastructure: Automated generation of meaningful rationales for algorithmic outcomes affecting users.
- AI-Specific DPIA Template: Mandatory impact assessments evaluating model fairness, leakage risks, and regulatory alignment.
The Shift to Make
Stop treating DPDP as a privacy team concern and AI governance as a data science team concern. Start treating AI governance under DPDP as one shared architecture — designed jointly by privacy, security, data science, and engineering.
Indian enterprises that build AI on DPDP-aligned architecture today position themselves for a regulatory environment that will only tighten. Building it right from the start compounds advantages in customer trust, operational resilience, and competitive agility.
