The DPDP Act does not have a separate section called AI. It applies to personal data, and an AI feature that processes personal data is in scope like any other system.
The practical work is documentation: what data goes in, why, where it is processed, how long it stays and who can see it.
What counts as personal data
Personal data is information about an identifiable person. In an AI workflow that can include a support transcript, a resume, a call recording, a customer email, an account number or a photograph.
Derived data counts too. A summary, an embedding or a classification score can still relate to a person. Do not assume that because the model output is new, it is anonymous.
Consent and purpose
Record the purpose before the feature is built. “Improve customer experience” is too broad to justify a transcript archive. Name the specific use: resolve a support ticket, screen a job application, answer a policy question.
Check the consent basis for the data you already hold. A customer who agreed to service communications may not have agreed to have those messages used to train a model. Separate the purposes.
Processor agreements
The model provider and any retrieval or storage vendor are processors. The agreement should cover the data, the purpose, retention, deletion, subprocessors and security incidents.
If data leaves India, document the location and the safeguard. “The vendor is global” is not an answer to a data residency question.
Retention and deletion
Decide how long prompts, outputs, logs and embeddings are kept. Delete them when the purpose ends, not when the storage bill becomes inconvenient.
Deletion is harder than it looks. A vector index may contain an embedding derived from a deleted record. The deletion process has to cover the source record, the index and the logs.
Automated decisions
If an AI output affects a person’s access to a service, employment or credit, document the role of the model, the human review step and the way a person can ask for a correction.
A human in the loop is not a formality. The reviewer needs the evidence and the authority to change the result.
Documentation checklist
Keep a one-page record for each AI feature: purpose, data categories, lawful basis, vendors, processing location, retention, access roles, human review, and the test evidence for accuracy.
Update it when the model, prompt or data source changes. A document that describes the pilot but not the live system is not useful.
A notice that explains AI use
The privacy notice should say, in plain language, that an AI system helps with a specific task. Name the task, the data used and the vendor category. Avoid vague phrases such as “AI-powered insights” that do not tell a person what is happening.
Explain the human review step. If a model output affects a decision, the notice should say who reviews it and how a person can ask for a correction.
Give a contact route for data questions. A support email that nobody owns is not a route. Name the role or team responsible and the expected response time.
Review the notice when the model, purpose or vendor changes. A notice that describes last year’s pilot is worse than no notice because it creates a false record.
Who owns the record
Name an owner for each AI feature record. The owner is usually the product manager or the business lead, not the legal team alone. Legal can review the wording; the owner has to keep the record current.
Give the owner a review trigger: a model change, a new data source, a vendor change or a new purpose. Without a trigger, the record is written once and forgotten.
Keep the record where the team works. A file in a legal folder that nobody opens is not a control. A short page linked from the feature ticket is more likely to be updated.
FAQ
Does the DPDP Act ban AI processing?
No. It requires lawful processing, purpose limitation, notice, consent where applicable, and safeguards. AI is not exempt and not automatically prohibited.
Do we need consent to use AI on support tickets?
It depends on the purpose and the notice already given. Using a transcript to resolve the ticket is different from using it to train a model for other customers.
What is the first document to create?
A feature-level record of purpose, data, vendors, retention and human review. It becomes the basis for notices, contracts and audits.
For implementation support, see DPDP Act compliance cost, custom software development and AI app development cost.
