DPDP Act and AI governance in India, explained for business leaders

India's AI governance rests on guidelines and existing law. MeitY's India AI Governance Guidelines of 5 November 2025 are guidelines, not law. The binding data rules come from the DPDP Act, 2023: its Rules, notified in November 2025, start most duties eighteen months after publication, around May 2027, with penalties of up to Rs 250 crore.

Which AI rules actually bind an Indian business in 2026?

The guidelines set expectations but do not bind, which leaves existing law as the enforceable part. The most relevant is the Digital Personal Data Protection Act, 2023, which Parliament enacted on 11 August 2023. Its Rules were published in the Gazette of India in November 2025 as G.S.R. 846(E), and PIB states they were notified in November 2025, giving full effect to the Act.

Full effect does not mean every duty is live. Under the Rules, Rules 1, 2 and 17 to 21 came into force on publication. Rule 4 (registration of Consent Managers) comes into force one year after publication, and Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication. Counting from the November 2025 Gazette, most obligations therefore begin around May 2027. The Act is therefore not yet fully enforceable, and Rs 250 crore is a ceiling, not a fine in force today.

PIB's backgrounder of 17 November 2025 gives the maximum penalties under the Act. These run up to Rs 250 crore for failure to maintain reasonable security safeguards, and up to Rs 200 crore for failure to notify the Data Protection Board or affected individuals of a breach (and for violations of children's data obligations). Other violations carry up to Rs 50 crore. These are ceilings, not fixed fines.

Some duties already apply. CERT-In's Cyber Security Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporates and government organisations to report listed cyber incidents within 6 hours of noticing them. They also require organisations to keep ICT system logs for a rolling 180 days within Indian jurisdiction. This section describes what the texts say and is not legal advice. A specific use of an AI tool is a question for the organisation's legal counsel.

What do India's AI governance guidelines ask of organisations?

On 5 November 2025, MeitY unveiled the India AI Governance Guidelines under the IndiaAI Mission. The framework has seven guiding principles, which it calls Sutras, recommendations across six pillars of AI governance, and an action plan with short, medium and long-term timelines.

Two features matter to a manager. The first is the existing-law-first stance: because the focus is on using existing legislation wherever possible, many practical duties may come from existing law such as the DPDP Act, whose Rules start mostly in 2027. The second is the expectation of responsible, accountable use of AI inside organisations, which gives a business a reference point when it writes its own policy.

A generative tool that drafts text raises issues of data and accuracy. An agent that takes actions raises further questions about approvals and limits. What agentic AI is and how AI differs from generative AI cover the definitions.

Where does the DPDP Act meet everyday AI use?

The Rules are written for personal data in general, and the link to AI is practical: an AI tool is one more place where personal data can sit, travel or leak. Rule 6 requires Data Fiduciaries (the organisations that decide why and how personal data is processed) to apply reasonable security safeguards. These include encryption, obfuscation, masking or virtual tokens, access controls, logs and monitoring to detect unauthorised access, backups, and retention of such logs and personal data for one year.

Rule 7 deals with breaches. A Data Fiduciary must inform the Data Protection Board of a personal data breach without delay, and give updated, detailed information within 72 hours of becoming aware of it, or within a longer period the Board allows. It applies once Rule 7 commences, eighteen months after publication.

PIB adds that Significant Data Fiduciaries must conduct independent audits and carry out impact assessments, and that the Data Protection Board will be fully digital, with four members and appeals to the Telecom Disputes Settlement and Appellate Tribunal. Those audit and assessment duties create work for privacy and governance teams at large organisations.

Consider what this means in a team. If staff paste customer records into a public AI tool, personal data has moved to a system the organisation may not control, and the questions are who approved it, what the tool retains and how an incident would be detected and reported. Logging, access control and breach reporting are the Rules' answers for personal data generally. How they apply to a particular tool is for counsel to decide.

What is shadow AI, and how much AI training do staff get?

Shadow AI is the use of AI tools at work that the organisation has not approved, and surveys show it is already common. A preliminary MIT NANDA report of July 2025 found only 40% of companies had bought an official LLM subscription, while workers at over 90% of surveyed companies reported regular use of personal AI tools for work. The report draws on interviews at 52 organisations, a survey of 153 senior leaders and 300+ public initiatives, so it indicates a pattern, not an Indian count. For adoption figures that are specific to India, see what enterprise AI adoption in India means for managers.

BCG's 2025 survey of over 10,600 workers in 11 countries found 54% would use AI tools even if not authorised. Only 25% of frontline workers say their leaders give enough guidance, and only 36% of employees feel adequately trained. In Naukri's AI at Work survey of 16 July 2026, 77% of professionals use AI at work at least sometimes, but only 35% say their employer actively provides AI training.

Training time makes a difference: BCG's 2025 survey found employees who receive five or more hours of training are more likely to become regular AI users. BCG's 2026 survey found 66% of regular frontline users get limited or no guidance on what to do with the time AI saves them.

What should an internal AI policy cover, and which governance skills do employers ask for?

An internal policy can state six items in plain words, each tied to a risk described above:

1. Which AI tools are approved, and how staff obtain access, so that official tools compete with personal ones.
2. Which categories of data may go into which tool, with personal data treated under the Rules above.
3. Who checks AI output and when a person must approve before anything is sent or acted on.
4. How an incident is reported, and who is told first, given the CERT-In and DPDP clocks.
5. How much training staff receive, and whether it uses real team tasks.
6. Who owns the policy and reviews it as tools change.

Gartner predicted on 25 June 2025, as reported by W.Media, that more than 40% of agentic AI projects will be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls. Incident readiness is thin. ISACA's 2026 global State of Cybersecurity survey of more than 1,800 professionals, published on 22 September 2026, found only 8% of organisations conduct regular AI-specific response exercises, and 48% of respondents either do not know whether AI incident playbooks exist or say they do not. How a team tests an AI tool before approving it is covered in how to test an AI tool you built.

Governance now appears in leadership job descriptions. A US Databricks posting for a Director, Marketing Strategy and AI Transformation, updated on 6 October 2026, asks for AI governance and adoption guardrails covering quality, risk, data privacy and responsible use. IBM's 2026 CEO study found 85% of respondents say all functional leaders must become technology experts in their domain. What the chief AI officer role asks for covers those postings in more detail.

The table maps each governance expectation to the evidence and its limit.

Where a taught programme fits

Some leaders prefer a structured course to assembling a policy from scratch. The AI Officer Programme is a live online programme by Vishlesan i-Hub Foundation, IIT Patna, delivered with Masai, for working managers and senior professionals, covering generative AI, agentic AI, AI governance and responsible AI without requiring coding. Its modules include Responsible AI, Governance and AI Business Models, where topics such as India's DPDP Act sit. The eligibility is minimum 1 year of full-time work experience, currently working in an organisation, and no coding background required. It grants no IIT Patna degree, credit or alumni status.

Frequently asked questions

Is the DPDP Act already in force for AI use?

Only partly. Rules 1, 2 and 17 to 21 took effect on publication in November 2025, and Rule 4 follows after one year. Rules 3, 5 to 16, 22 and 23, which hold most duties, come into force eighteen months after publication, around May 2027. The Rs 250 crore figure is a maximum under the Act, not a fine in force today.

What is the DPDP compliance checklist for AI tools?

The Rules do not give an AI checklist. Rule 6 lists safeguards: encryption, masking or tokens, access controls, logs and monitoring, backups and one-year retention. Rule 7 requires breach intimation to the Board without delay and detailed information within 72 hours. A team can map each AI tool against those duties and ask legal counsel about gaps.

Are India's AI governance guidelines legally binding?

No. MeitY unveiled them on 5 November 2025 as guidelines under the IndiaAI Mission, with seven Sutras, six pillars and an action plan. Its Secretary said the focus is on using existing legislation wherever possible, so the enforceable duties currently come from laws such as the DPDP Act, not from the guidelines themselves.

What is shadow AI at work?

Shadow AI is staff using AI tools the organisation has not approved. A preliminary MIT NANDA report of July 2025 found workers at over 90% of surveyed companies used personal AI tools regularly, while only 40% of companies had bought an official LLM subscription. BCG's 2025 survey found 54% of employees would use AI even if not authorised.

Who is responsible for AI governance in a company?

Ownership can sit with a business leader. Databricks' October 2026 US marketing leadership posting puts governance guardrails inside a business leader's remit, and IBM's 2026 study found 85% of respondents say all functional leaders must become technology experts in their domain.

Next step

The AI Officer Programme, Vishlesan i-Hub IIT Patna page sets out the curriculum and how to apply.