Does the DPDP Act apply when employees use ChatGPT or other AI tools at work?

Yes, whenever the prompt or upload contains digital personal data, such as a customer's name and phone number or a candidate's resume. Your company is the data fiduciary and stays responsible, even if the employee used a personal account. Approve specific tools under a business contract and tell staff which data they may and may not enter.

When do the DPDP Rules 2025 come into force?

In three phases from their Gazette publication on 13 November 2025. Institutional provisions, including the Data Protection Board, applied at once. Consent Manager registration follows one year after publication. The main duties on notice, consent, security, breach intimation, erasure, children and data principal rights apply 18 months after publication, in May 2027.

Do we need employee consent to process staff data with AI tools?

Not always. Section 7 of the Act allows processing without consent for employment purposes, such as payroll or protecting the employer from loss. The use must still serve that employment purpose, and you still owe security, accuracy and erasure duties. Uses beyond employment, such as marketing with staff photos, need a separate basis.

Can Indian companies use AI tools that store data outside India?

Generally yes. Section 16 lets the government restrict transfers to specific countries by notification, rather than requiring all data to stay in India. Check whether any restriction applies, whether sector rules from regulators such as RBI add limits, and what the vendor's contract says about storage location and retention.

What are the penalties under the DPDP Act?

The Schedule to the Act sets maximum penalties per breach of duty. Failing to keep reasonable security safeguards can attract up to ₹250 crore. Failing to report a breach, or breaking the duties on children's data, can attract up to ₹200 crore. Breaking the extra duties of a significant data fiduciary can attract up to ₹150 crore, and breaching any other provision up to ₹50 crore. The Data Protection Board decides the amount.

Is there an exemption for startups and small businesses?

The Act has no automatic exemption based on company size. It allows the government to notify certain data fiduciaries, including startups, as exempt from some duties, such as the duty to give notice. Unless a notification covers you, assume the full Act applies and plan your compliance work to finish before May 2027.

DPDP Act and AI Tools: What Indian Companies Must Check First

Yes, the DPDP Act applies the moment an employee pastes a customer's or colleague's personal data into an AI tool. Your company remains the data fiduciary and answers for what happens to that data. The DPDP Rules were notified on 13 November 2025, and the core duties on notice, consent, security and breaches apply from May 2027, so check your AI use now.

At a glance

Item	Position in October 2026
The law	Digital Personal Data Protection Act, 2023 (Act 22 of 2023)
The Rules	DPDP Rules, 2025, G.S.R. 846(E), dated 13 November 2025
In force now	Definitions, the Data Protection Board, Rules 1, 2 and 17 to 21
From November 2026	Consent Manager registration (Rule 4)
From May 2027	Notice, consent, security, breaches, rights, children (Rules 3, 5 to 16, 22, 23)
Highest penalty	Up to ₹250 crore, for failing to keep reasonable security safeguards

This article is general information, not legal advice. For your organisation's exact position, speak to a lawyer who works on data protection.

Where the DPDP law stands in October 2026

The Act received Presidential assent on 11 August 2023, but most of it waited for rules. On 13 November 2025, the Ministry of Electronics and Information Technology (MeitY) published the Digital Personal Data Protection Rules, 2025 in the Gazette and brought the Act itself into force on a matching phased timetable:

Phase 1, on publication: definitions, the Data Protection Board and procedural rules.
Phase 2, one year after publication: registration and duties of Consent Managers.
Phase 3, 18 months after publication (mid-May 2027): the substance. Notice, consent, security safeguards, breach intimation, erasure, children's data, data principal rights and the penalty provisions.

The government's PIB backgrounder on the Rules describes this as an eighteen-month window for phased compliance. Press reports in early 2026 said MeitY was discussing shorter timelines with industry, mainly for significant data fiduciaries, but we found no amending notification when we checked in October 2026. The notified dates stand, so treat May 2027 as the latest date, not a target.

AI has no separate law in India yet. MeitY's India AI Governance Guidelines, released on 5 November 2025, say the focus is on using existing legislation wherever possible. For personal data, that existing law is the DPDP Act.

Why an AI tool is a DPDP question

The Act covers digital personal data: any data about an individual who can be identified from it. A resume, a WhatsApp chat export, a call recording, a support ticket with a phone number and an Excel sheet of customer names all qualify.

Three ideas from the DPDP Act, 2023 decide how AI tools fit:

You are the data fiduciary. Your company decides why and how the data is processed, so the duties sit with you. Section 8(1) keeps you responsible even when someone else does the processing.
The AI vendor should be your data processor. Section 8(2) lets you use a processor only under a valid contract. An employee's personal free account has no contract with your company at all.
Uploading is processing. Collection, storage, use, sharing and combination are all processing, whether a person or a model does them.

A common mistake is to assume that data found on the internet is fair game. Section 3(c)(ii) excludes personal data made public by the person it relates to, or published under a legal duty. It does not cover data someone else leaked, posted or scraped.

The duties that decide whether an AI use is lawful

Purpose, notice and consent

Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, and limited to the data needed for the stated purpose. If you collected phone numbers to deliver orders, feeding them into an AI tool to build marketing profiles is a new purpose. Rule 3 requires a standalone notice in clear, plain language that itemises the data and the purposes. The Act also gives people the option to read the notice in English or any of the 22 languages in the Eighth Schedule.

Legitimate uses, including employment

Section 7 lists uses that need no consent. Clause (i) covers processing for employment, such as payroll or protecting the employer from loss. It is not a blank cheque: the use must serve that employment purpose, and security and accuracy duties still apply.

Accuracy when AI output drives a decision

Section 8(3) requires complete, accurate and consistent data when it is used to make a decision about a person. AI summaries of resumes, loan files or complaints can drop facts or invent them. Keep a human who checks the source before any decision about a candidate, customer or employee.

Security safeguards and breaches

Rule 6 sets minimum safeguards: encryption, masking or tokens; access control; logging and monitoring; backups; keeping logs for a year; and security clauses in processor contracts. Under Rule 7, you must tell the Data Protection Board and each affected person without delay, then send the Board a detailed report within 72 hours. The Act defines a breach to include unauthorised sharing or use, so a customer list pasted into an unapproved chatbot can count. Cyber incidents may also need reporting to CERT-In; see our guide to the CERT-In directions for IT teams.

Erasure and children

Section 8(7) requires erasure once the purpose is served or consent is withdrawn, unless a law requires you to keep it. Many AI tools keep chat history by default, so check retention settings. For anyone under 18, Section 9 requires verifiable parental consent and bars tracking, behavioural monitoring and targeted advertising aimed at children. Schools, coaching centres and edtech teams using AI on student data should start here.

Where personal data slips into AI tools at work

Most exposure is not a big AI project. It is everyday shortcuts.

Everyday task	Personal data involved	Safer way
Summarising a complaint thread	Names, phones, order details	Approved work tool; remove contact details
Shortlisting resumes	Candidate history	Approved tool, notice to candidates, human decides
Transcribing sales calls	Voices, account details	Check where audio is stored and for how long
Cleaning a customer sheet	Bulk records	Mask or tokenise first, or use a sample
Replying to a chat export	Third parties' messages	Strip other people's details first

HR is a hotspot because it handles resumes, appraisals and medical leave. Our guide on AI for HR teams in India covers hiring policy in more depth.

A checklist before you approve any AI tool

Run every tool, including the free ones staff already use, through these questions:

Is personal data needed at all? Many tasks work as well on anonymised or synthetic data.
Is there a business contract? You need terms that make the vendor your processor, not a personal sign-up.
Are your inputs used to train models? Get the answer in writing. Consumer and business plans often differ.
Where is data stored, and for how long? Section 16 allows transfers abroad except to countries the government restricts by notification, so check for any restriction.
Who can see what? Require single sign-on and multifactor authentication, and review shared chats and workspaces.
Are there audit logs? Rule 6 expects logs kept for at least one year.
Does the use match your notice? If not, update the notice or drop the use.
Is there human review for decisions about people?
Does your breach plan cover AI misuse? Name who informs the Board and affected people, and practise the 72-hour report.
Is children's data blocked or covered by parental consent?
Have staff been trained, and is there a written AI use policy?
Is the decision recorded? Keep a simple register of approved tools and permitted data.

Vendor documentation answers several of these. For example, Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models in Microsoft Copilot, formerly Microsoft 365 Copilot. For tenants that signed up in India, Microsoft also lists India among the countries with data residency commitments for Copilot interaction content. Read the equivalent pages for every tool you approve. Our Microsoft 365 Copilot rollout guide covers permissions cleanup before switching it on.

A plan from now to May 2027

Now to December 2026: find the AI already in use. Ask each team which tools they use and what data goes in. Move work data off personal accounts and approve one or two tools with proper contracts.

January to March 2027: fix the paperwork and settings. Update privacy notices to name AI-assisted purposes. Sign processor terms, set retention periods, switch on audit logs and apply sensitivity labels or data loss prevention where your platform supports them.

April to May 2027: test and train. Run a breach drill built around an AI incident. Publish the contact details of a person who answers data questions (Section 8(9)), set up grievance redressal (Section 8(10)) and train every employee who touches personal data. Significant data fiduciaries have extra duties, including an annual data protection impact assessment and a check that their algorithmic software does not put people's rights at risk.

How CertTulen Academy can help

CertTulen Academy runs live, MCT-led training for Indian teams. IT and compliance staff who manage Microsoft 365 can start with Security, Compliance and Identity Fundamentals (SC-900), which covers Microsoft Purview sensitivity labels, data loss prevention and audit, the controls that keep personal data out of the wrong prompts. For everyone else, AI Fluency: AI Capabilities and Limitations builds the judgement to know what an AI tool should never see. We also run private cohorts for companies. Contact us for a batch that suits your team.