AI systems are hungry for personal data — for training, personalisation and automated decisions. The DPDP Act applies whenever that data is personal, and the Rules add a specific duty for large players to vet their algorithms.
Personal data in, DPDP applies
Using customer data to train or run a model is processing. You need a lawful basis (usually consent), a matching notice, and data minimisation — don't feed a model more personal data than the purpose needs.
Algorithmic due diligence for SDFs
The Rules require Significant Data Fiduciaries to ensure the algorithmic software they deploy — including AI — does not pose a risk to Data Principals' rights. In practice: test for bias, unfair outcomes and leakage, and document it.
Automated decisions and transparency
Where AI drives decisions that affect people (credit, pricing, eligibility), be transparent about it, keep a human check where stakes are high, and be able to explain and correct outcomes through your rights process.
Training data and retention
Personal data used for training still has a purpose and a retention limit. Anonymise where you can (see anonymisation vs pseudonymisation), and erase what you no longer need.
An AI checklist
- Lawful basis and notice for personal data in training and inference.
- Minimise and, where possible, anonymise.
- Bias and risk testing; document it (DPIA for high-risk).
- Human oversight for consequential decisions.
How DPDP Bridge helps
DPDP Bridge helps you govern AI on personal data — basis and notice, minimisation, DPIAs and algorithmic due-diligence records that satisfy the Rules. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.