India's DPDP Act 2023 and AI tools at work: the basics

India's Digital Personal Data Protection Act 2023, usually called the DPDP Act, sets the rules for handling digital personal data in India. If your company holds personal data about customers, patients, students or staff, it applies to you. And if your people paste some of that data into AI tools, the Act is part of the picture.

This post explains the basics in plain terms, with a focus on AI use at work. It is general information, not legal advice. For decisions about your own company, speak to a lawyer who works on data protection.

The main roles

• Data principal: the person the data is about. A customer, a patient, an employee.
• Data fiduciary: the organisation that decides why and how personal data is processed. Usually your company.
• Data processor: an organisation that processes personal data on behalf of a data fiduciary. A software provider, including an AI tool provider used for company work, may fall into this role depending on the arrangement.
• Data Protection Board of India: the body set up under the Act to handle breaches and complaints and to decide penalties.

Duties that matter for AI use

The Act places several duties on data fiduciaries. These are the ones most relevant when staff use AI tools:

• Processing for a lawful purpose, generally with the person's consent or for certain legitimate uses the Act lists. Pasting a customer's details into a tool for an unrelated purpose sits awkwardly with this.
• Giving notice: people should be told what personal data is collected and why.
• Reasonable security safeguards to prevent a personal data breach. Unmanaged use of AI tools with personal data is hard to describe as a safeguard.
• Responsibility for processors: the data fiduciary remains responsible for what a processor does on its behalf, and should engage processors under a valid contract.
• Telling the Board and affected people about a personal data breach.
• Erasing personal data when it is no longer needed for the purpose, unless the law requires keeping it.

What this means in practice

The Act does not mention AI chatbots by name. It does not need to. The questions it raises are the ordinary questions of data protection, applied to a new kind of tool:

1. Do we know which AI tools receive personal data from our staff?
2. For each one, is there a contract that fits a processor relationship, or is it a personal account with consumer terms?
3. Have we told staff which personal data may go into which tool, and recorded that they agreed?
4. Would we notice if personal data went somewhere it should not, and do we know what to do next?

A company that can answer those four questions is in a far better position than one that cannot, whatever the details of its legal obligations turn out to be.

Staff data is personal data too

Discussions of the Act often focus on customers, but employees are data principals as well. Salary sheets, leave records, performance notes and ID documents all count. HR and managers using AI tools for writing and analysis are just as likely to paste personal data as a support team is, and the same rules should apply to them. Make sure the examples in your policy include staff data, not only customer data, so nobody assumes internal information is exempt.

Practical first steps

• List the AI tools in use and which kinds of data go into each. A register is the simplest form.
• Restrict personal data to tools on business terms with a data processing agreement, or keep it out of AI tools entirely.
• Write the rule into your AI-use policy, with examples that use Indian identifiers people recognise: Aadhaar numbers, PAN, mobile numbers.
• Decide what counts as an incident and who handles it, so a mistaken paste is dealt with quickly and recorded.
• Review the arrangement with your adviser once the obligations relevant to you are in force.

If you are starting from nothing, begin with the AI-use policy; most of the other steps follow from it.

In Openn Shield

Openn Shield does not make a company compliant with the DPDP Act, and no tool can. It helps with the records: a register of AI tools with the data each is allowed, a Personal data and AI tools policy template with versioned agreements, a risk register, and a scanner that checks text in the browser for Aadhaar numbers (with their checksum), PAN, Indian mobile numbers and email addresses before someone pastes it elsewhere. Read how Shield handles your own data.