AI governance
Using personal data to train AI under India's DPDP Act
AI teams in India need a lawful basis for every piece of personal data a model learns from. Public data, research and consent each work differently under the DPDP Act and Rules.
active
AI management systems move into audit scope
Organisations building or deploying AI are being asked for the same evidence discipline they already apply to information security. ISO/IEC 42001 gives auditors a certifiable management-system baseline, and customer questionnaires increasingly ask for it.
Our coverage
AI governance
AI system impact assessment under ISO 42001: a worked example
ISO 42001 asks you to assess how an AI system could affect people and society, not only your organisation. This worked example uses a CV-screening model.
AI governance
ISO 42001: first steps for an AI management system
ISO/IEC 42001 applies management-system discipline to AI. If you already run an ISO 27001 ISMS, most of the scaffolding exists.
Related coverage: DPDP Rules phased rollout
India compliance
DPDP Rules timeline: which obligations apply when
India's DPDP Rules, 2025 phase in over 18 months. The Data Protection Board is already running; consent managers start in November 2026 and core obligations in May 2027.