# AI governance in India: running AI systems and agents under DPDP

Source: https://dpdp.miravlabs.com/services/ai-governance/ · Updated 2026-11-13 · DPDP Ready by Mirav Labs

**Short answer:** The DPDP Act has no AI chapter, but every AI system or agent that uses digital personal data is processing under it. From 13 May 2027, the usual duties apply: a lawful purpose with consent or a legitimate use (sections 4 to 7), security safeguards under Rule 6, erasure and rights. In practice, govern AI in five steps: inventory, assess, guardrails, human oversight, and monitoring with an audit trail.

## In plain words

India has no separate AI law today. But when an AI tool or an AI agent uses personal data, the data protection law applies to it just as it applies to your staff and your software. An agent that can send emails, update records or issue refunds needs clear limits, a person who approves the big actions, and a record of everything it did.

- **13 May 2027** when the main duties start
- **1 year** to keep logs of what systems did with data
- **₹250 crore** maximum penalty for weak security

### What it means for you

- Every chatbot, copilot and agent that sees customer or employee data counts. So do AI features inside tools you already buy.

- You need a good reason to use the data in each tool: the person's permission, or one of the few other uses the law allows.

- If an AI vendor handles the data for you, you are still responsible for what happens to it.

- If an agent sends someone's details to the wrong person, that is a data leak or breach, and you must report it.

- When a person asks you to delete their data, it must go from your AI tools too.

**Example:** A skincare brand in Jaipur uses an agent to answer WhatsApp questions and process returns. It lets the agent look up only the customer's own order, keeps phone numbers out of its logs, and sends every refund to a staff member to approve. Each step the agent takes is recorded.

### What to do

- List every AI tool and agent you use, and the personal data each one sees.

- Check the reason you are allowed to use that data in each one.

- Give each agent only the access it needs, and block personal data it does not need.

- Make a named person approve actions that affect money, records or many customers.

- Record what every agent does, and test it regularly.

The law: sections 4 to 8 and 11 to 13 of the DPDP Act, and Rules 6 to 8 of the DPDP Rules, 2025. Applies from 13 May 2027.

## The detailed guide

## Key takeaways

- There is no AI exemption in the DPDP Act: prompts, retrieval stores, outputs and agent actions that involve personal data are processing.
- An agent that sends, updates or deletes things can cause a personal data breach in seconds, so its permissions need the same care as a staff member's.
- Start with an inventory of every AI system and agent and the personal data each one touches; nothing else works without it.
- Put a named person in front of high-impact actions, and log every agent action so you can show what happened.
- Rule 13(3) algorithmic due diligence applies only to Significant Data Fiduciaries, and none has been notified yet.

Most organisations now run AI in more places than anyone has written down: a support chatbot, a sales copilot, summaries inside the CRM, a document assistant for HR, and increasingly agents that do things rather than just answer. Much of this touches personal data. The DPDP Act does not have an AI chapter, and it does not need one. If a system processes digital personal data, the Act applies to it.

This page explains how the Act reaches AI systems and agents, the extra risks agents bring, and the five-step way we govern them in practice: inventory, assess, guardrails, human oversight, and monitoring with an audit trail. It also sets out how an engagement with us typically runs and what you get at the end.

## Does the DPDP Act apply to AI systems and agents?

Yes, whenever they process personal data. Under section 3 the Act covers digital personal data processed in India, and processing outside India connected with offering goods or services to people in India. Nothing in it carves out automated or AI processing. In an AI system, personal data typically shows up in five places:

- **Inputs:** prompts, uploaded files, call recordings and chat messages.

- **Context:** records an assistant retrieves from your CRM, ticketing system or document store, including vector databases built for retrieval.

- **Training and fine-tuning data:** past tickets, chats or documents used to adapt a model.

- **Outputs:** summaries, drafted replies, scores and recommendations about a person.

- **Actions and logs:** emails an agent sends, records it updates, and the logs of all of it.

Each of these needs a lawful purpose and either [consent or a legitimate use](https://dpdp.miravlabs.com/guides/dpdp-consent/) under sections 4 to 7. Consent under section 6(1) is specific and limited to the data necessary for the stated purpose, so data collected to deliver an order is not automatically available to train a model. In our reading, training is usually a separate purpose that needs its own basis, and your legal counsel should confirm it.

Roles matter too. You are the Data Fiduciary if you decide why and how the data is processed (section 2(i)). An AI provider that processes the data only on your instructions is typically your Data Processor, and section 8(1) keeps you responsible for what it does. If a provider uses your data for its own purposes, such as improving its models, that use needs separate analysis. Our guide to [fiduciaries and processors](https://dpdp.miravlabs.com/guides/data-fiduciary-vs-data-processor/) covers how to tell the difference.

## What changes when an AI agent can act?

An assistant that drafts a reply for a person to send is one level of risk. An agent that sends the reply itself, updates a customer record, calls a payment API or closes a ticket is another. The agent now holds permissions, and anything it can do, it can do wrongly and at scale.

Assistant: suggests

- Reads data and produces text

- A person reviews before anything happens

- Main risks: what it reads and what it writes

- Errors are usually caught before they reach anyone
Agent: acts

- Calls tools: email, CRM, payments, other APIs

- Actions happen without a person in between

- Adds risks: over-broad access, wrong recipients, irreversible steps

- Content it reads can carry instructions that steer it
Under the Act these become concrete. A personal data breach includes unauthorised disclosure, sharing, alteration or loss of access (section 2(u)), so an agent emailing one customer's details to another is a breach. Section 8(6) requires every breach to be intimated to the Board and to each person affected, with a detailed report to the Board within 72 hours under Rule 7. Section 8(3) requires personal data to be complete, accurate and consistent where it is used for a decision affecting the person, which matters when an agent scores, approves or rejects. And section 8(5) security safeguards cover the agent's credentials and tools like any other computer resource.

## How does AI governance work in practice?

We use five steps. They apply to a single chatbot and to a fleet of agents; what changes is depth, not order.

### 1. Inventory every AI system and agent

List every model, copilot, AI feature and agent in use, including AI features switched on inside SaaS tools you already pay for. For each, record the owner, the business purpose, the personal data it touches, the providers involved, where processing happens, and what tools or actions it can use. Without this register you cannot answer an access request under section 11, which includes the identities of the fiduciaries and processors data was shared with, or show where a person's data went after they withdraw consent.

### 2. Assess personal data, lawful basis and risk

For each entry, decide which personal data it really needs, the consent or legitimate use that covers it, and what could go wrong: wrong disclosure, an inaccurate decision about a person, data kept past its purpose, or use with [children's data](https://dpdp.miravlabs.com/guides/dpdp-children-data/) where section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children. Rate the risk, so that the high-risk uses get the strongest controls first.

### 3. Set guardrails

Guardrails are the engineering controls around the model. Give each agent its own identity and only the tools and data scopes it needs. Filter or mask personal data before it reaches a model where it is not needed, and check outputs before they leave. Cap what an agent can do: rate limits, value limits, allowed recipients, no bulk actions without approval. Treat content the agent reads (emails, web pages, documents) as untrusted, so it cannot redirect the agent. These map directly to Rule 6 access control and data protection measures; see our guide to [security safeguards](https://dpdp.miravlabs.com/guides/dpdp-security-safeguards/).

### 4. Put a person in front of high-impact actions

Decide which actions wait for a named person: anything that moves money, changes eligibility or access, deletes or alters records, discloses personal data outside the organisation, or reaches many people at once. The approver should see what the agent wants to do and why, and the approval itself should be recorded. Watch for rubber-stamping: if approvals are near-automatic, either the threshold is wrong or the reviewer needs better context.

### 5. Monitor, evaluate and keep an audit trail

Test outputs regularly against a fixed evaluation set, including tests for personal data leaking into answers, and re-run it whenever a model, prompt or tool changes. Log every agent action: which agent and version, what triggered it, which data it accessed, which tool it called, who approved, and the outcome. Rule 6(1)(c) asks for visibility of access through logs and monitoring, and Rules 6(1)(e) and 8(3) require logs to be kept for one year. Log tokens or internal IDs rather than raw personal data, and settle with your counsel how the one-year retention applies to stored prompts and outputs. For deeper adversarial testing, see [AI red teaming](https://dpdp.miravlabs.com/services/ai-red-teaming/).

## Which DPDP duties matter most for AI?

The table maps the duties that come up most often in AI work to what they mean in practice. Most apply from 13 May 2027.

| DPDP duty | What it means for AI systems and agents | Typical control |
|---|---|---|
| Lawful purpose and consent or legitimate use (s.4 to 7) | Each AI use of personal data needs a basis; training or profiling is often a new purpose | Lawful basis recorded per inventory entry; notices and consent updated where needed |
| Accuracy for decisions (s.8(3)) | Scores, approvals and rejections about a person must rest on complete, accurate, consistent data | Evaluation sets, source checks, human review of adverse decisions |
| Security safeguards (s.8(5), Rule 6) | Agent credentials, tool access, prompts, retrieval stores and logs are all in scope | Per-agent identity, least privilege, masking, logging, one-year log retention |
| Processor contracts (s.8(1), 8(2), Rule 6(1)(f)) | AI providers that process your data on your behalf need a valid contract with security terms | DPDP schedule covering use of data, retention, breach notice and erasure |
| Breach intimation (s.8(6), Rule 7) | An agent's wrong disclosure is a breach; every breach must be intimated | Agent incidents routed into the breach process, with a 72-hour report path |
| Erasure (s.8(7)) and rights (s.11 to 13) | Withdrawn or expired data must leave prompts, retrieval stores, caches and agent memory too | Deletion that reaches AI stores; no personal data trained into models where it cannot be removed |
| Algorithmic due diligence (Rule 13(3)) | Applies only to Significant Data Fiduciaries: check that technical measures, including algorithmic software, do not risk people's rights | Built into the annual DPIA if you are notified as an SDF |

On erasure, the design choice matters most. Personal data held in a retrieval store can be deleted on request; personal data trained into a model's weights generally cannot be removed cleanly. Keeping personal data out of training, and in stores you can delete from, makes [retention and erasure](https://dpdp.miravlabs.com/guides/dpdp-data-retention/) workable.

On Rule 13(3): it is one of the extra duties of a [Significant Data Fiduciary](https://dpdp.miravlabs.com/guides/significant-data-fiduciary/), alongside the annual DPIA and audit. No SDF has been notified yet. For everyone else it is not a legal requirement, though a similar check is a sensible practice for high-risk AI.

## What do India's AI governance guidelines and global frameworks add?

On 5 November 2025, MeitY, under the IndiaAI Mission, released the [India AI Governance Guidelines](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2186639). They set out seven guiding principles (sutras), recommendations across six pillars of AI governance, an action plan over short, medium and long-term timelines, and practical guidelines for industry, developers and regulators. MeitY said its focus remains on using existing legislation wherever possible. For personal data, the existing legislation is the DPDP Act and Rules.

Two international frameworks are also useful for structure:

- **[ISO/IEC 42001:2023](https://webstore.iec.ch/publication/90574)**, published in December 2023, sets requirements for establishing, implementing, maintaining and continually improving an AI management system.

- **The [NIST AI Risk Management Framework (AI RMF 1.0)](https://www.nist.gov/itl/ai-risk-management-framework)**, released on 26 January 2023, is intended for voluntary use and is organised around four functions: Govern, Map, Measure and Manage.

Neither is recognised under the DPDP Act as proof of compliance. They help you run AI governance as a programme, with owners, risk assessment and review. The DPDP mapping in the table above still has to be done for your own systems.

## How does an engagement typically run, and what do you get?

We work as an engineering and privacy team alongside your product, security and legal teams. Your legal counsel decides lawful basis questions; we build and evidence the controls. A typical engagement runs in four phases:

- **Discover.** Interviews with system owners, a review of provider contracts and admin consoles, and a look at API keys and tool integrations to find AI use that was never registered.

- **Assess.** Each AI system and agent mapped to its personal data, lawful basis and risk rating, with gaps listed.

- **Build.** Guardrails, approval steps and logging designed and, where you want, implemented with your engineers.

- **Prove.** Evaluation sets, an evidence pack and a review cadence handed over to a named internal owner.

| Deliverable | What it contains | Who uses it |
|---|---|---|
| AI inventory | Every AI system, feature and agent with owner, purpose, personal data, providers, permissions and risk rating | Privacy, security and product owners |
| DPDP assessment per high-risk use | Data flows, lawful basis questions for counsel, risks and recommended controls | Legal counsel, DPO or privacy lead |
| Agent guardrail design | Per-agent identity and scopes, data filters, action limits, untrusted-content handling | Engineering |
| Human oversight matrix | Which actions need approval, by whom, with what context, and how approvals are recorded | Operations and business owners |
| Evaluation and audit trail spec | Test sets, re-test triggers, log fields, retention settings and review schedule | Engineering and internal audit |
| Provider contract checklist | DPDP terms to raise with each AI provider: use of data, retention, breach notice, erasure | Procurement and legal counsel |

If the inventory shows data quality or access problems underneath your AI plans, our [enterprise data readiness for AI](https://dpdp.miravlabs.com/services/enterprise-data-readiness-for-ai/) work covers that layer. If agents call your own APIs, [API security](https://dpdp.miravlabs.com/services/api-security/) is usually the next step. The full list is on our [services page](https://dpdp.miravlabs.com/services/).

## How to start

- **Count what you run.** Ask each team which AI tools and agents they use, and check SaaS admin consoles for AI features already switched on.

- **Pick the riskiest three.** Usually anything that acts on its own, touches financial, health or children's data, or makes decisions about people.

- **Write down the basis.** For each of those, record the personal data used and ask counsel to confirm the lawful basis.

- **Add approvals and logs.** Put a named approver in front of high-impact actions and start logging agent actions now, so you have a year of history when the Rules apply on 13 May 2027.

- **Fold it into your programme.** AI is one more set of systems in your [DPDP compliance checklist](https://dpdp.miravlabs.com/guides/dpdp-compliance-checklist/), not a separate project.

If you want an engineering team to build the AI inventory and the guardrails with you, [talk to us](https://dpdp.miravlabs.com/#contact).

## Frequently asked questions

### Does the DPDP Act apply to AI?

Yes, wherever an AI system processes digital personal data. The Act does not mention AI, but it applies to any processing of digital personal data in India, and to processing outside India connected with offering goods or services to people in India. Prompts, retrieval stores, model outputs and agent actions that contain or act on personal data are all processing.

### Is there an AI law in India?

There is no AI-specific statute today. MeitY released the India AI Governance Guidelines on 5 November 2025, and said its focus remains on using existing legislation wherever possible. For personal data used by AI, that means the DPDP Act and Rules, alongside sector rules and the IT Act.

### Can I use customer data to train an AI model under DPDP?

Only with a lawful basis for that purpose. Consent under section 6 is specific to a stated purpose and limited to the data needed for it, so data collected to deliver a service is not automatically available for training. In our reading training is usually a separate purpose; confirm the basis with your legal counsel before you use the data.

### Who is responsible when an AI agent makes a mistake with personal data?

The Data Fiduciary that deployed it. Section 8(1) keeps the fiduciary responsible for processing done on its behalf, including by processors such as AI providers, despite any contrary agreement. If an agent discloses personal data to the wrong person, that is likely a personal data breach that must be intimated to the Board and the people affected.

### What is an AI inventory?

A register of every AI system, AI feature and agent your organisation uses, with its owner, purpose, the personal data it touches, its lawful basis, the providers involved, what it is allowed to do and how it is monitored. It is the AI equivalent of a data inventory, and the starting point for every other control.

### Do AI agents need human oversight under DPDP?

The Act does not use the term, but it requires accuracy where data is used for a decision affecting a person (section 8(3)) and reasonable security safeguards (section 8(5)). A named person approving high-impact agent actions is one of the most practical ways to meet both, and it gives you evidence that you did.

### Does ISO/IEC 42001 make you DPDP compliant?

No. ISO/IEC 42001 is a management system standard for AI. It helps you run AI governance in an organised way, with owners, risk assessment and review, but it is not recognised under the DPDP Act as proof of compliance. You still need to map each AI use to the Act's requirements.