The DPDP Act and AI agents: a compliance guide for Indian enterprises
India's Digital Personal Data Protection Act is now being phased in through the DPDP Rules 2025. AI agents read, combine and act on personal data at speed, so they need to be designed for the Act from the start. This guide sets out the dates, the obligations that matter most for agents, and the controls that satisfy them.
When do the DPDP Act's main obligations apply?
The DPDP Rules 2025 were notified in November 2025 with a phased rollout. Provisions setting up the Data Protection Board applied at once, consent manager rules follow after 12 months, and most obligations on data fiduciaries apply after 18 months, in May 2027.
Updated October 2026
- Law
- Digital Personal Data Protection Act 2023 and the DPDP Rules 2025
- Regulator
- Data Protection Board of India
- Key dates
- Board provisions from November 2025; consent managers from November 2026; most fiduciary obligations from May 2027
- Penalties
- Up to ₹250 crore for failing to take reasonable security safeguards
- Sector overlays
- RBI FREE-AI framework for financial services; SEBI CSCRF; IRDAI guidelines; CERT-In 6-hour incident reporting
What the rules mean for AI agents
| Requirement | What it means for your AI agents |
|---|---|
| Notice and consent | Agents use personal data only for the purposes in the notice. Tag data with its consented purpose and have the agent check it before acting. |
| Purpose limitation and retention | Set retention for agent memory, vector stores, prompts and logs, and delete data once the purpose is served. |
| Reasonable security safeguards | Give each agent its own identity with least-privilege access, encrypt data, apply guardrails against prompt injection and keep access logs. |
| Breach notification | Monitor agent activity, alert on unusual data access and run an incident playbook that covers notice to the Board and affected people. |
| Rights of data principals | Make sure personal data held in agent memory, embeddings and logs can be found, corrected and erased on request. |
| Children's data | Block agents from processing children's data unless verifiable parental consent is in place. |
| Significant data fiduciaries | Run data protection impact assessments and audits, and check that algorithmic software, including agents, does not put people's rights at risk. |
Nine things to have in place
- List every agent, copilot and AI tool that touches personal data.
- Map each agent's data to the purpose in your consent notice.
- Set retention rules for agent memory, embeddings and logs.
- Give every agent its own identity and least-privilege access.
- Test agents against prompt injection and data leakage before go-live.
- Log agent actions and keep access logs available for review.
- Rehearse a breach that starts with an agent, including the CERT-In 6-hour report.
- Prepare a rights-request process that reaches AI data stores.
- If you may be a significant data fiduciary, plan the DPIA and audit now.
From rules to agents in production
Governed agents
A four- to eight-week pilot with the controls in this guide built in.
Agentic AI development →Security and red teaming
Agent inventory, guardrails, prompt-injection testing and runtime protection.
AI security →Evidence and governance
Policies, logs and reports that answer regulators, auditors and boards.
AI governance →Frequently asked questions
Does the DPDP Act mention AI?
Not by name. It applies to any digital processing of personal data, so AI agents that use personal data must meet the same notice, consent, security and rights obligations as any other system.
Do AI agents need separate consent?
Not separate consent as such, but the agent may only process personal data for purposes the person consented to or another lawful use. If an agent uses data for a new purpose, you need a fresh basis.
How does RBI's FREE-AI framework relate to the DPDP Act?
FREE-AI is RBI's framework for responsible AI in financial services, published in August 2025. It sits alongside the DPDP Act: banks and other regulated entities need both privacy compliance and AI governance.
How long do we have?
Most obligations apply from May 2027. Agent programmes started today will be live by then, so it is cheaper to build the controls in now than to retrofit them.
Sources
- MeitY: Data protection framework
- S.S. Rana & Co: MeitY notifies final DPDP Rules 2025
- Hogan Lovells: India's DPDP Act 2023 brought into force
- KPMG: RBI FREE-AI committee report
- CERT-In
- OWASP Top 10 for LLM Applications (OWASP GenAI Security Project)
This guide is general information, not legal advice. Check the official texts and take legal advice for your situation.
Talk to us about The DPDP Act and AI agents
Get a free consultation from our AI, data and security specialists. Honest advice, clear options and a reply within 6 hours.
Request a callback
Free consultation. Our team replies within 6 hours.