Short answer
Under India's DPDP Act, personal data used to train or run an AI system needs consent or a legitimate use, unless an exclusion applies. Data the person made public themselves is outside the Act (Section 3(c)(ii)), and research or statistical processing can be exempt under Section 17(2)(b) and Rule 16, but only if the data is not used for decisions about specific individuals.
Key takeaways
- Consent or a legitimate use is the default basis for personal data in AI systems.
- Data a person made public themselves falls outside the Act; scraped data made public by others does not automatically.
- The research exemption needs the Second Schedule standards and ends if the model makes decisions about individuals.
- Core obligations, including Rule 16, apply from 13 May 2027.
Why AI teams in India need to care now
A model can only be as lawful as the data it learned from. Under the Digital Personal Data Protection Act, 2023, every use of personal data needs a basis, and training, fine-tuning, evaluation and inference are all uses. The DPDP Rules, 2025 bring the core obligations into force on 13 May 2027, so datasets being built now will be judged by those rules.
Timeline
DPDP dates that matter for AI datasets
- DPDP Rules notifiedData Protection Board provisions in force.
- Core obligations applyNotice, consent, security, breach reporting and Rule 16 (research standards).
The four routes for personal data in AI
| Route | Where it comes from | Key condition | Good fit for |
|---|---|---|---|
| Consent | Section 6 | Free, specific, informed, unambiguous; can be withdrawn | Personalisation using your own users' data |
| Legitimate use | Section 7 | Only the listed situations, such as data the person voluntarily gave for a specified purpose | Narrow internal uses tied to the original purpose |
| Publicly available data | Section 3(c)(ii) | Made public by the person themselves, or by someone under a legal duty to publish it | Limited; check how each record became public |
| Research and statistics | Section 17(2)(b), Rule 16, Second Schedule | Meets the Second Schedule standards and is not used for decisions about specific individuals | Model research and aggregate analysis, not production decisioning |
Public data is narrower than it looks
The exclusion covers personal data that the individual made public, or that someone was legally required to publish. A web scrape mixes both with data other people posted about the individual, which the exclusion does not obviously cover. Keep a record of where each dataset came from and why you believe it falls inside the exclusion; commentators expect regulators to read this exclusion narrowly for large-scale AI training.
The research exemption has conditions
Section 17(2)(b) lets the Act's main obligations fall away for research, archiving or statistical purposes, but only when the processing follows the standards in the Second Schedule to the Rules and the data is not used to take a decision specific to a data principal. A model trained under this route and then used to score applicants, set credit limits or flag individuals moves outside it.
How this fits an ISO 42001 AI management system
An ISO/IEC 42001 AI management system already expects you to know the data behind each AI system and to assess its impact on individuals. Add the DPDP lawful basis as a field in your AI system inventory and as a question in your AI system impact assessment, so a single review covers both.
Checklist
DPDP checks for an AI dataset
0 of 7 done
This article explains the statute and Rules as published. How the Data Protection Board applies these exclusions to AI has not been tested yet; take legal advice on high-risk datasets.
Frequently asked questions
Does the DPDP Act apply to publicly available personal data used for AI training?
Not if the data was made public by the person it relates to, or by someone under a legal obligation to publish it (Section 3(c)(ii)). Other public data, such as information posted about someone by others, is not clearly covered by that exclusion.
Can AI training rely on the DPDP research exemption?
Only within its conditions: the processing must meet the Second Schedule standards under Rule 16, and the data must not be used for decisions specific to an individual. Production models that decide about people fall outside it.
Sources
- Digital Personal Data Protection Act, 2023: Section 3, DPDPA.com (Act text)
- Research exemption under the DPDP Rules (Rule 16), Lakshmikumaran & Sridharan
- Publicly available data under the DPDP Act: the limits of exemptions in AI-driven processing, Law School Policy Review
- Digital Personal Data Protection Rules, 2025 notified, Press Information Bureau, Government of India