DPDP Act 2023
India's data protection law
and the AI tool you are deciding about
The law is about personal data and the people it belongs to. I am not a lawyer. What I can explain is where your records sit, who can reach them, and what you can show.
It makes where your data sits a business question rather than an IT one. The Digital Personal Data Protection Act 2023 is India's law about personal data and the people it belongs to, and an AI tool is another place that data can go.
I am not a lawyer and this page is not legal advice. Your legal advisor is the person who judges whether you comply, and I will not quote sections at you or promise you compliance. What I can do is tell you exactly where every record sits, which machine reads it and who can reach it, written down, so that your advisor has something real to judge.
It is about personal data
The law is concerned with information about identifiable people: your customers, your staff, your enquiries. Your drawings and your costings matter commercially, and they are a different question.
The business holding it is answerable
If you collected it, you are the one answerable for it, including for what happens when you hand it to somebody else to process. Passing data to an outside tool does not pass on the responsibility.
Consent and purpose are the two words
You asked for the data for a reason, and the person agreed to that reason. Putting the same data into something new is worth a thought before it happens.
Where it sits is the provable part
Many of the hard questions are about location and access: which machine holds it, who can open it, and whether you could produce that answer in writing today.
I can only change the engineering
A legal advisor judges compliance. I build the part underneath, so that the answer to where it went is a machine you own. See what that looks like.
What the law is about, in plain words
The Digital Personal Data Protection Act 2023 is India's law covering personal data, meaning information that identifies a living person. In broad terms it sets out that a business collects such data for a stated purpose, with the person's agreement, keeps it for that purpose, protects it, and is answerable for it. The person it describes has rights over it, including asking what you hold.
That is the shape of it, and it is as far as I will go. The detail, the exemptions, the dates and what applies to your particular business are a lawyer's work. I am describing the law so that the engineering conversation makes sense, nothing more.
I am not a lawyer, and this is not legal advice
I want this on the page rather than in small print. I do not give legal opinions, I do not quote sections, and I will never tell you that a system I built makes you compliant. No builder can honestly say that, because compliance is a question about your whole business and not about one machine.
What I will give you is documentation: a written note of what data the system holds, where that machine physically sits, which people and which accounts can reach it, and what the system did and when. Your legal advisor reads that and forms a view. That division of work is the right way round.
Why AI turned this into a live question
Before AI tools, company data moved in ways an owner could picture: an email, a file on a drive, a report sent to the accountant. A chat window is less visible. Somebody pastes a customer list into it to sort the names, and a copy of that list is now outside the business, under terms nobody in the room has read.
That is why the law and AI are now discussed in the same sentence. The copy you cannot see is the part that matters. The longer version of that is here.
The questions you can answer without a lawyer
These are engineering questions. If you cannot answer them today, that is worth knowing before anybody reads a single section of the law to you.
| Question | Where to look | What a good answer sounds like |
|---|---|---|
| Which AI tools is my team actually using? | Ask them, and look at what is installed and what is being paid for | A named list, with who signed up for each one |
| What personal data has gone into them? | The documents people paste in so the answer makes sense | A short list of record types, with the worst one named |
| Where does that data physically sit now? | The terms of the account, and the provider's own documentation | A country and a company, written down |
| Who can open it? | Your administrator, if there is one, and the provider's staff | A list of people, and a way to remove one of them |
| Could we delete it if somebody asked? | The provider's deletion process, and your own copies | A described process somebody has actually run |
| Who else did we pass it to? | Your own list of tools and outside processors | A list you keep updated, rather than one you reconstruct |
The part I can actually change
If the records sit on a computer in your own office, most of the location and access questions answer themselves. The data is in the building. The model is on the same machine. The list of people who can reach it is a list you wrote. There is no outside provider in the middle whose terms you have to read.
This does not make you compliant and I am not claiming it does. It removes a set of questions you currently cannot answer and replaces them with answers you can show somebody. That is the honest claim. How the machine is set up, and what hardware it needs.
What keeping data in the office does not solve
Keeping records in your own building does nothing about the rest of it. You still asked people for the data for a stated reason. You still have to protect it, answer the person who asks what you hold, and know who you passed it to. A machine on a shelf does none of that for you.
- Consent, and what you told people you would use their data for
- How long you keep records, and deleting them when the reason has ended
- Who in your office may open which records, which is a policy and not a machine
- Everything you already send outside: your accountant, your payroll, your couriers
- What happens when somebody asks you what you hold about them
Built, not described
Questions people ask
Does the DPDP Act mean we cannot use ChatGPT at work?
I am not a lawyer and cannot answer that for your business. What I can say is that the law makes you answerable for personal data you hold, including after you hand it to somebody else to process. That is a reason to be careful about what gets pasted in, and to ask your legal advisor.
Does an on-premise AI setup make us DPDP compliant?
No, and nobody should tell you it does. Keeping records in your own building answers the questions about where data sits and who can reach it. Consent, retention, deletion and the rest of your business are still yours to handle, and your legal advisor judges the whole picture.
Is there a DPDP compliance checklist I can use?
Law firms publish them and some are good. I would not write one, because a checklist from a builder reads like legal advice and is not. Use a lawyer's checklist, and bring them the documentation of where your systems hold data so they have facts to work from.
What does the DPDP Act say about AI specifically?
I will not characterise the text of the law for you. In practice the AI question is the data question: an AI tool is another place personal data can travel to, and you remain answerable for it. Ask your advisor how that applies to the tools you actually use.
Do we have to keep Indian data inside India?
That is exactly the kind of question for a lawyer, and the answer turns on rules that can be updated. Many owners choose to keep records in their own office because it makes the answer simple and provable, whatever the detail turns out to be.
What documentation do you give us for an audit?
A written note of what the system holds, where the machine sits, which accounts and people can reach it, and a log of what the system did. It is a description of the build rather than a compliance certificate, and your advisor decides what it proves.
Next step