India's DPDP Rules reach AI systems on 13 May 2027, and consent managers arrive this November. What to do with customer data in prompts, logs and models

India's Digital Personal Data Protection Act was passed in August 2023 and sat without teeth for two years while the rules that operationalise it were drafted, consulted on and rewritten. The Digital Personal Data Protection Rules, 2025 were notified by MeitY on 13 November 2025 and published in the Gazette the next day. That started a clock, and the clock has three marks on it. The Data Protection Board exists now. Consent manager registration opens twelve months in, around 13 November 2026. Everything else, which is to say every obligation a business will feel, becomes enforceable at eighteen months, on 13 May 2027, and media reports through the year have speculated that the government may pull the second and third marks together.

Every law firm in the country has published a compliance guide, and they cover the same ground: audit your data, rewrite your privacy notice, build a consent flow, appoint a grievance officer, prepare for breach reporting. All correct. Almost none of them mention that the fastest-growing place personal data now flows through a company is a language model, and that an AI system creates copies of personal data in places a data audit built for databases will not look. This guide covers those places.

Where does an AI system hold personal data?

In at least six places, and most companies have inventoried one of them. The first is the prompt: every customer email, ticket, call transcript or document you send to a model contains whatever personal data the customer put in it, and sending it to a model API is processing by a data processor on your behalf. The second is the trace: the logs that observability tools and agent frameworks keep of every run, with the full input, the tool calls and the output, retained by default for as long as the disk lasts. The third is the retrieval index: the vector store that holds embeddings of your documents, from which the original text can often be reconstructed. The fourth is the fine-tuned model, if you trained one on customer interactions. The fifth is agent memory, where a long-running agent writes down what it learned about the people it dealt with. The sixth is the vendor's side: whatever the model provider retains, for how long, and whether it trains on it.

The DPDP Act does not distinguish sensitive personal data from ordinary personal data, which simplifies the classification and raises the bar: a customer's name in a support ticket gets the same protection as their health record. It applies to any digital personal data processed in India and to processing outside India in connection with offering goods or services to people in India, so a model API hosted in Virginia is in scope when the prompt describes a customer in Pune. The Act does exempt personal data the individual made publicly available themselves, which matters for the training-data question and for very little else.

What does each obligation mean for AI systems?

Consent has to be free, specific, informed, unconditional and unambiguous, given for a stated purpose after a notice in plain language. A customer who consented to your processing their support request has consented to that purpose. Whether the same consent covers sending the request to a third-party model for summarisation is a question of whether the notice said so; from May 2027 it should. Whether it covers using the conversation to fine-tune a model is a separate purpose and needs its own line in the notice. The International Bar Association's guidance on the Act recommends privacy notices at each point where a person is likely to enter personal data that may be used for AI training, and that is the right reading. Consent managers, the regulated intermediaries the Rules create, will let individuals manage and withdraw consent across companies through one interface; when they arrive in November, withdrawal will need to reach your model pipeline, not only your CRM.

Security safeguards are the obligation with the largest penalty, up to ₹250 crore. Rule 6 lists the measures a data fiduciary must be able to show: encryption or masking, access control, monitoring and logging to detect breaches, and log retention the Rules set at a year. For an AI system that means encryption in transit to the model provider and at rest for traces and indexes, access control on who can read raw traces, a record of which agent identity accessed which data, and a decision about whether to mask personal data before it reaches the model at all. The PII redaction pipeline we describe in our use cases exists for this: names, phone numbers, account identifiers and addresses replaced with tokens before the prompt leaves your boundary, and restored afterwards where the workflow needs them.

Breach notification under Rule 7 means informing affected individuals and the Board without delay on becoming aware, and filing a detailed report with the Board within 72 hours, with a penalty of up to ₹200 crore for failing to. A prompt injection that exfiltrates customer data through an agent, of the kind we described last week, is a personal data breach. So is a misconfigured trace store readable by the whole company. Your incident process needs to know that an AI system can be the source, and your logs need to be good enough to say what left, about whom, and when, inside 72 hours.

Retention and erasure under Rule 8 require deleting personal data once its purpose is served, with specific inactivity periods for the largest e-commerce, gaming and social media platforms in the Third Schedule, and the right to erasure applies to everyone. This is the obligation AI systems fail most often, because personal data in a trace, an embedding or a model's weights was never scheduled for deletion. The practical answers are a retention period on traces measured in days, redaction before indexing so the vector store holds no identifiers, a design that keeps customer records in the database and only references in the index, and a policy that says fine-tuning uses redacted or synthetic data. Erasing an individual from a fine-tuned model is not something the technology does well, so the rule is to keep individuals out of the training set.

Significant data fiduciaries, a designation the government assigns by volume and risk, carry further duties: an annual data protection impact assessment and audit, and due diligence to verify that the technical measures they use, which the Rules name as including algorithmic software, are not likely to pose a risk to individuals' rights. That is an AI audit requirement in all but name. Companies likely to be designated should assume their model pipelines will need documented risk assessments, and that the evaluation harness is where the evidence comes from.

Cross-border transfer is permitted under the Rules except to countries the central government restricts by order, with the possibility of tighter conditions for significant data fiduciaries. As the Rules stand, sending a prompt to a US-hosted model is lawful. Keep the list of processors and their locations current, because the restriction list can change with a notification, and the sovereign cloud question gets easier to answer when you already know which workloads carry personal data.

Children's data needs verifiable parental consent and a ban on tracking and targeted advertising, with a penalty up to ₹200 crore. An AI tutor, a gaming assistant or any chat product with under-18 users needs age assurance before the first prompt, and a model that infers age from conversation is a tracking system under the Act.

What should a company do in the next six months?

Inventory the six places, then work backwards from May 2027. Start by listing every AI system that touches personal data, which model providers it sends data to, where traces are kept and for how long, what is indexed, what has been trained, and what agents remember. This feeds the same register we recommend for agents generally, and for most companies the list is longer than the CTO expects.

Then, in rough order of payoff: put redaction in front of every model call that carries customer data; set trace retention to the shortest period debugging can live with; rewrite the privacy notice to name AI processing and, separately, any training; sign or update processor terms with every model vendor and record their retention and training positions; add AI systems to the breach playbook; and build erasure so that a request removes the person from the database, the index and the memory store in one job.

Do it now rather than in April, because the consent manager phase in November will surface withdrawal requests before the rest of the regime bites, and because the reported compression of the timeline may make May 2027 an earlier date than it looks. And treat the obligations as an operating standard rather than a project: governance that is a feature of the system survives the audit, and governance that was a document does not.

A caveat, because this is a law and I am not a lawyer. The Rules run to several schedules and the Board's practice will shape what the words mean. Take this as a map of where AI systems create obligations, and take the specific wording to counsel.

Frequently asked

When do the DPDP Rules come into force? The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and commence in three phases. Phase one, immediate, established the Data Protection Board. Phase two, twelve months from notification, around 13 November 2026, brings the consent manager registration framework. Phase three, eighteen months from notification, on 13 May 2027, makes the substantive obligations enforceable: notice and consent, security safeguards, breach notification, retention and erasure, data principal rights and significant data fiduciary duties. Media reports have speculated the timeline may be shortened.

Does the DPDP Act apply to AI models and prompts? Yes. The Act covers any processing of digital personal data, and sending a prompt containing a customer's details to a model API is processing by a data processor on the fiduciary's behalf. Traces, vector indexes, fine-tuned models and agent memory that contain personal data are all within scope, as are transfers to model providers outside India, which the Rules permit except to countries the government restricts. The Act exempts personal data an individual has made publicly available themselves.

What are the penalties under the DPDP Act? The Act sets maximum penalties per violation of ₹250 crore for failing to maintain reasonable security safeguards, ₹200 crore for failing to notify the Board and affected individuals of a personal data breach, ₹200 crore for breaching obligations relating to children, ₹150 crore for a significant data fiduciary failing its additional duties, and ₹50 crore for other non-compliance. Penalties can stack across violations. Individuals who breach their own duties as data principals can be fined up to ₹10,000.

Related reading

• The EU AI Act's transparency rules apply from today. A checklist for chatbots, AI-written text and deepfakes
• Prompt injection defence for AI agents with tools
• Do you need an AI agent control plane?
• On-premise, sovereign cloud, or public cloud for AI: how to choose
• Governance is a feature, not an appendix

The DPDP regime will find personal data in the places an AI system put it, and the companies that pass will be the ones that found it first. Mapping those six places, building the redaction and erasure that clear them, and producing the evidence a Board or an auditor will ask for is the work of a governance engagement.