Why in the News
India’s Digital Personal Data Protection (DPDP) Act, 2023 does not deal with the use of personal data to train Artificial Intelligence (AI) models. Meta, Amazon and Google already train their AI models on users’ data, so the gap weakens the constitutional right to privacy that the Supreme Court upheld in 2017.
What does the DPDP Act cover, and what does it leave out?
- DPDP Act: It is now the general purpose law regulating how citizens’ data is used, like a rulebook for anyone who collects personal information.
- Phased start: The DPDP Rules were notified in November 2025. Some provisions on consent and safety take effect only in 2027.
- Public and inferred data excluded: The Act does not apply to publicly available data or to inferred data. Inferred data is what can be drawn from a person’s location, affiliations or images, such as emotions, movements or behaviour.
- The takeaway: The data AI can most easily scrape and analyse sits outside India’s main privacy law.
How did the earlier law treat sensitive data?
- IT Act regime: The Information Technology (IT) Act, 2000 and its 2011 Rules regulated sending “sensitive personal data” abroad. The recipient had to protect it to Indian standards, and transfer needed a lawful contract or consent.
- Criminal penalty: Unauthorised disclosure of listed sensitive data, such as financial, health, sexual orientation or biometric data, carried up to three years’ imprisonment or a ₹5 lakh fine.
- Gaps in the old Rules: They did not cover names, addresses, phone numbers, caste, religion, political affiliations or browsing history, nor data scraped from social media.
- No sensitive category now: The DPDP Act puts all personal data in one bucket, so passwords and health conditions get the same protection as a name, a step back from the earlier law.
How does AI training put privacy at risk?
- Regurgitation: AI models can repeat personal data they memorised during training. Querying a model with “anonymised” data, stripped of names, can pull out those details, identify individuals and build their profiles.
- Profiling from public data: AI methods can extract sensitive information about a person from generic, publicly available information.
- Scale in India: India is the world’s largest market for Facebook and Instagram, so these risks reach more Indian users than users anywhere else.
Why not simply ban AI training on Indian data?
- Innovation cost: AI can boost productivity, and indiscriminate regulation can slow innovation and growth.
- Bans backfire: Stopping data export, or keeping personal data out of AI training, can leave the AI that serves Indians less inclusive, less efficient and more biased.
- Use-case hub: India is set to become the world’s main hub for putting AI to practical use, with corporate giants, small businesses and non-profits deploying it.
- Development versus privacy: Faster development and stronger privacy pull in different directions, so India has to choose a balance between them.
Challenges
- No right to object: Even after the substantive provisions take full effect in May 2027, Indian users cannot object to AI training on their public data.
- EU contrast: Meta gives users in the European Union (EU) an opt-out from AI training that Indian users do not have.
- Narrow right to be forgotten: The right to have one’s data erased covers only data a user consented to give, and its reach over inferred information is unclear.
- Research exemption: The Union government has not yet prescribed its conditions, so AI training framed as research can escape the Act.
Way Forward
- Cover AI training: Apply the DPDP Act to AI training data, with a right to object and protection for scraped and inferred data.
- Stronger right to erasure: Make companies tell users of every entity that holds their data.
- Clear research exemption: Clarify whether AI training falls under the research exemption by default.
- Sensitive data category: Create a sensitive data category with stricter rules on use and processing.
Conclusion
India’s privacy law governs how organisations collect personal data but not how AI models learn from it. How quickly amendments, Rules or judgments close that gap will decide how strong the constitutional right to privacy remains.
What is the Right to Privacy?
- Recognition: In K.S. Puttaswamy v. Union of India, the Supreme Court held privacy to be a Fundamental Right under Article 21, intrinsic to dignity, liberty and autonomy.
- Informational privacy: It protects personal data, medical records and online footprints.
- Proportionality test: A restriction on privacy must be sanctioned by law, serve a legitimate aim and be proportionate to that aim.
Matching Previous Year Question
“[2024, GS3, 10 marks] Describe the context and salient features of the Digital Personal Data Protection Act, 2023”
