# The DPDP Act and AI agents: a compliance guide for Indian enterprises India's Digital Personal Data Protection Act is now being phased in through the DPDP Rules 2025. AI agents read, combine and act on personal data at speed, so they need to be designed for the Act from the start. This guide sets out the dates, the obligations that matter most for agents, and the controls that satisfy them. ## Key facts - **Law:** Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 - **Regulator:** Data Protection Board of India - **Key dates:** Board provisions from November 2025; consent managers from November 2026; most fiduciary obligations from May 2027 - **Penalties:** Up to ₹250 crore for failing to take reasonable security safeguards - **Sector overlays:** RBI FREE-AI framework for financial services; SEBI CSCRF; IRDAI guidelines; CERT-In 6-hour incident reporting ## What the rules mean for AI agents - **Notice and consent:** Agents use personal data only for the purposes in the notice. Tag data with its consented purpose and have the agent check it before acting. - **Purpose limitation and retention:** Set retention for agent memory, vector stores, prompts and logs, and delete data once the purpose is served. - **Reasonable security safeguards:** Give each agent its own identity with least-privilege access, encrypt data, apply guardrails against prompt injection and keep access logs. - **Breach notification:** Monitor agent activity, alert on unusual data access and run an incident playbook that covers notice to the Board and affected people. - **Rights of data principals:** Make sure personal data held in agent memory, embeddings and logs can be found, corrected and erased on request. - **Children's data:** Block agents from processing children's data unless verifiable parental consent is in place. - **Significant data fiduciaries:** Run data protection impact assessments and audits, and check that algorithmic software, including agents, does not put people's rights at risk. ## Readiness checklist - List every agent, copilot and AI tool that touches personal data. - Map each agent's data to the purpose in your consent notice. - Set retention rules for agent memory, embeddings and logs. - Give every agent its own identity and least-privilege access. - Test agents against prompt injection and data leakage before go-live. - Log agent actions and keep access logs available for review. - Rehearse a breach that starts with an agent, including the CERT-In 6-hour report. - Prepare a rights-request process that reaches AI data stores. - If you may be a significant data fiduciary, plan the DPIA and audit now. ## FAQ ### Does the DPDP Act mention AI? Not by name. It applies to any digital processing of personal data, so AI agents that use personal data must meet the same notice, consent, security and rights obligations as any other system. ### Do AI agents need separate consent? Not separate consent as such, but the agent may only process personal data for purposes the person consented to or another lawful use. If an agent uses data for a new purpose, you need a fresh basis. ### How does RBI's FREE-AI framework relate to the DPDP Act? FREE-AI is RBI's framework for responsible AI in financial services, published in August 2025. It sits alongside the DPDP Act: banks and other regulated entities need both privacy compliance and AI governance. ### How long do we have? Most obligations apply from May 2027. Agent programmes started today will be live by then, so it is cheaper to build the controls in now than to retrofit them. ## Sources - [MeitY: Data protection framework](https://www.meity.gov.in/data-protection-framework) - [S.S. Rana & Co: MeitY notifies final DPDP Rules 2025](https://ssrana.in/articles/meity-notifies-final-digital-personal-data-protection-rules-2025/) - [Hogan Lovells: India's DPDP Act 2023 brought into force](https://www.hlc.com/en/publications/indias-digital-personal-data-protection-act-2023-brought-into-force-) - [KPMG: RBI FREE-AI committee report](https://kpmg.com/in/en/insights/2025/08/rbi-free-ai-committee-report-on-framework-for-responsible-and-ethical-enablement-of-artificial-intelligence.html) - [CERT-In](https://www.cert-in.org.in/) - [OWASP Top 10 for LLM Applications (OWASP GenAI Security Project)](https://genai.owasp.org/llm-top-10/)