Getting AI systems ready for the DPDP Rules before 13 May 2027

Why 13 May 2027 matters for AI

India’s Digital Personal Data Protection Act 2023 was enacted on 11 August 2023, and the DPDP Rules 2025 were published on 13 November 2025 with phased commencement. The Data Protection Board provisions took effect on publication. Rule 4 on Consent Managers takes effect on 13 November 2026. Rules 3, 5 to 16, 22 and 23 take effect on 13 May 2027. Those bring in notice, security safeguards, breach intimation, retention, children’s data, data principal rights and the Significant Data Fiduciary duties.

The Act does not name AI, but it applies to processing of digital personal data in India, and to processing outside India connected with offering goods or services to people in India. Any AI system that is trained on, retrieves, infers from or decides with personal data is inside it. MeitY’s India AI Governance Guidelines rely on the Act as a main source of accountability for AI, so it is also the law regulators are most likely to reach for when an AI system goes wrong.

That leaves seven months. The order of work below fits the time.

Find the AI and the personal data it uses

Start with an inventory. For every AI system and agent, record its purpose, owner, model and provider, the personal data it uses, where that data comes from and who it is about. Include AI built into products you already license, and staff use of public AI tools, because both are processing on your behalf. The guides to building an AI system register and finding shadow AI cover how.

The inventory answers the first DPDP question for each system, which is whether it processes digital personal data and, if so, for which purpose. Each later step works from that answer.

Check the lawful basis and the notice

Processing needs consent or one of the legitimate uses in section 7. Consent must be tied to a specified purpose, and the notice must explain that purpose clearly and on its own. Two AI patterns cause most of the trouble.

• New purposes for old data. Data collected to service an account and later used to train a model or score customers may fall outside the original purpose. Map each AI use to the purpose the data principal was told about.
• Notices that never mention AI. If an AI system makes or shapes decisions about people, a notice that describes the processing only in general terms will be hard to rely on. Describe what the system does with the data in plain language.

Keep decision data accurate

Section 8(3) requires a data fiduciary to ensure the completeness, accuracy and consistency of personal data likely to be used to make a decision that affects the data principal. For AI that screens applicants, prices risk, flags fraud or prioritises cases, that duty reaches the training data, the input data at decision time and anything the model infers. An AI impact assessment is the natural place to record which decisions a system affects, which data feeds them and how accuracy is checked.

Data principals can also ask to correct, complete, update and erase their data. An AI system needs a way to act on a correction, which may mean re-running a decision or retraining.

Hold AI vendors to processor terms

The data fiduciary stays responsible for processing done by a processor, and a processor may only be engaged under a valid contract. For AI vendors, the contract should say what the vendor may do with your data, including whether it may use it to train its own models, where it is processed, what security safeguards apply, how fast the vendor tells you about a breach and what happens to the data when the contract ends. The vendor AI risk guide lists the questions to ask.

Be ready to detect and report a breach

From 13 May 2027, a data fiduciary that becomes aware of a personal data breach must tell affected individuals without delay and inform the Data Protection Board, with a detailed report within 72 hours. AI systems add new routes to a breach, such as a chatbot that reveals another customer’s data or a prompt injection that pulls records out of a connected system. Cyber incidents also fall under the CERT-In directions of 28 April 2022, which require reporting to CERT-In within six hours. An AI incident process should cover both.

If you may be a Significant Data Fiduciary

A Significant Data Fiduciary must appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out a Data Protection Impact Assessment and an audit every twelve months. Rule 13(3) adds due diligence to verify that technical measures, including algorithmic software, are not likely to pose a risk to data principals’ rights. For an organisation running AI at scale, that turns into a documented assessment of each material AI system and evidence that it was reviewed.

How Aicura supports the work

Aicura is an AI governance platform. Its AI register and discovery build the inventory, data provenance traces which data feeds which system, assessments record the purpose, people affected and risks, and vendor due diligence and incident tracking cover processors and breaches. Aicura does not assess against the DPDP Act itself. It gives you the record the Act’s obligations depend on, and the decisions stay with you.

This page is Aicura’s reading of the DPDP Act and Rules, not legal advice. Read the Act and Rules as published by MeitY and in the Gazette of India.