AI at WorkIndia's DPDP Act and using AI tools: what a small business should know
If your business handles customers' personal data in digital form, an Indian law applies. Its text is short enough to read. This page quotes the parts that matter when you use AI tools.
This page is general information, not legal advice. We read the Act's text on 14 November 2026. Rules under the Act and the dates on which its provisions come into force are separate: check the MeitY website for the current position and ask a lawyer about your own case.
What the Act is about
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, dated 11 August 2023) provides for the processing of digital personal data in a way that recognises both the right of individuals to protect their personal data and the need to process it for lawful purposes. The Act says that it comes into force on the date that the Central Government appoints by notification, and different dates may be appointed for different provisions. It does not apply to personal data processed by an individual for any personal or domestic purpose.
Words that matter
- Personal data: any data about an individual who is identifiable by or in relation to such data.
- Digital personal data: personal data in digital form.
- Data Fiduciary: any person who alone or with others decides the purpose and means of processing personal data. A shop, a school or an accountant who decides why and how customers' or clients' data is used is in this position.
- Data Principal: the individual the data is about.
- Data Processor: a person who processes personal data on behalf of a Data Fiduciary.
Duties that touch AI use (section 8)
The text of section 8 says, among other things:
- A Data Fiduciary is responsible for complying with the Act for processing done by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary.
- A Data Fiduciary may involve a Data Processor to process personal data on its behalf for offering goods or services only under a valid contract.
- It must protect personal data in its possession or under its control, including data processed by a Data Processor, by taking reasonable security safeguards to prevent personal data breach.
- In the event of a personal data breach, it must inform the Board and each affected Data Principal in the form and manner prescribed.
- It must erase personal data when consent is withdrawn or when it is reasonable to assume that the specified purpose is no longer being served, unless retention is necessary for compliance with a law.
What this means when you paste customer data into an AI tool
The Act's wording suggests several questions, which we put in plain words (this is our reading, not a legal opinion):
- If you paste your customers' or students' personal data into an online AI tool, the company behind the tool may be acting like a processor for you. Is there a valid contract (the business plans of some tools offer one; consumer chat apps may not)?
- You remain responsible for the data you share, even if the tool misuses it.
- Reasonable security safeguards include deciding who may use which tools with which data, and not letting staff paste client data into personal accounts.
- A leak of what you pasted could be a personal data breach with duties to report.
- Keep only what you need for as long as you need it. Old chats that contain customer data are retained data.
A practical approach
- Do not paste personal data into consumer AI chats. Replace names and numbers (see the checklist page).
- If AI must process real client data, use a business plan that offers a data processing contract, and keep a copy of the terms.
- Write a short AI-use policy for your staff (a template is on this site).
- Keep a list of which tools handle which data.
- Have a plan for a leak: who is told, how.
Does the Act apply to me if I only have a small shop?
The Act applies to processing of digital personal data by any person who decides its purpose and means. It has exemptions for personal or domestic purposes and may allow for classes of data fiduciaries to be treated differently through rules. Ask a professional about your case.
Is the Act in force?
The Act itself says it comes into force on a notified date, and different dates may be appointed for different provisions. Check the MeitY website for the current position.
Sources
Read on 13 and 14 November 2026. Pages change; open the original before you rely on a statement.
This is an independent guide. It is not connected with OpenAI, Anthropic, Google, Microsoft or any other AI company; product names belong to their owners. Statements about companies are taken from their own help pages as read on 13 and 14 November 2026. The prompts are our own wording and were not run against every tool. Not legal, financial or professional advice.