India's DPDP Act and AI Training Data: A Guide for Businesses

What the DPDP Act covers

The DPDP Act applies to the processing of digital personal data within India, whether it was collected in digital form or collected offline and later digitised. It also applies to processing outside India if it is connected to offering goods or services to people in India. Personal data means any data about an individual who is identifiable by or in relation to that data.

The Act uses its own vocabulary. The individual is the Data Principal. The business that decides why and how data is processed is the Data Fiduciary. A business that processes data on the fiduciary's behalf is a Data Processor. The Act is enforced by the Data Protection Board of India, which can impose significant financial penalties for breaches.

For most Indian companies thinking about data partnerships, the company will be the Data Fiduciary for its own records, such as customer support history, CRM entries and employee communications. Where an IT services or outsourcing firm processes data on behalf of a client, it is likely acting as a Data Processor, and that data is generally not its own to share.

Consent and legitimate uses

Under the Act, a Data Fiduciary may process personal data only for a lawful purpose, and either with the Data Principal's consent or for certain legitimate uses listed in the Act. Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data necessary for the specified purpose. It must be preceded or accompanied by a notice describing the data and the purpose, and individuals can withdraw consent.

The legitimate uses are narrower than the legitimate interests basis under GDPR. They cover situations such as data voluntarily provided for a specified purpose where the person has not objected, certain employment-related purposes, legal obligations and emergencies. Whether sharing data for AI training fits within any of them depends on the facts, and you should not assume it does.

In practice, this means that for most businesses, using identifiable personal data for a new purpose such as AI training would require fresh consent, which is difficult to obtain at scale for historical records. That is a strong reason to focus on anonymization and on data sources where personal details are incidental rather than central.

Why anonymization matters under the DPDP Act

Because the Act applies to data about identifiable individuals, data that has been properly anonymized so that individuals can no longer be identified is generally understood to fall outside its scope. The Act itself does not set out a detailed anonymization standard, so it is prudent to aim for a robust one: remove direct identifiers, consider indirect combinations that could point to a person, and contractually prohibit re-identification.

Anonymizing data is itself processing of personal data, so it should be carried out in a way that is consistent with the Act. Many businesses will find it simplest to scope data partnerships around sources that are primarily about work rather than people, such as code, engineering history, process documents and resolved tickets, and to anonymize the personal details that appear within them.

Other obligations to keep in mind

Several other parts of the Act are relevant when data is shared with a partner.

• Processors: a Data Fiduciary may engage a Data Processor only under a valid contract, and remains responsible for compliance
• Security: reasonable security safeguards must be in place to prevent personal data breaches, and breaches must be notified to the Board and affected individuals
• Erasure: personal data should be erased once the purpose is served or consent is withdrawn, unless retention is required by law
• Children: processing the data of children requires verifiable parental consent, and certain tracking and targeted advertising is restricted
• Significant Data Fiduciaries: businesses notified as such have extra duties, including data protection impact assessments and audits
• Cross-border transfers: the government may restrict transfers to specified countries by notification

Rules and timelines

The DPDP Act sets out the framework, and the government has notified implementing rules that fill in details such as notice requirements, consent managers and breach reporting, with obligations coming into force in phases. Because timelines and details matter, check the current status of the rules with your legal adviser rather than relying on a general summary.

Sector regulators may also have their own expectations. Banks and payment companies, for example, should consider Reserve Bank of India directions, and other regulated businesses should check their sector rules.

A practical approach for Indian businesses

Momentra Technologies is an Indian company, and its process is built so that these questions can be worked through before any data moves. Your first message to us needs no data at all, only who you are and what you are interested in. The initial value assessment is a discussion. An NDA defining confidentiality, permitted use, retention and security comes before any sample is reviewed. The contract governs scope, permitted use, transfer and processing, and professional anonymization removes or replaces sensitive information before further use. You decide what is in scope.

This guide is general information, not legal advice. The DPDP Act and its rules are new and interpretation is still developing. Consult a qualified Indian data protection lawyer about your specific data and circumstances.