Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsTraining and running models on personal data raises consent, purpose and minimization questions the Act takes seriously.
In short
Using personal data to train or run models is processing like any other: it needs a lawful basis, it is bound by the purpose it was collected for, and Section 11 gives individuals a summary of their data and processing, not a right to the model's logic. Penalties reach ₹250 crore.
What changes for this sub-sector.
Personal data used to train models needs consent or a valid legitimate use, not just availability.
Data collected for one purpose cannot quietly become training data for another without a fresh basis.
Prefer anonymised or synthetic data; strip identifiers you do not need.
Be able to describe how personal data feeds a model and its outputs.
Plan how access, correction and erasure requests are handled where data has fed a model.
Foundation-model and data providers are processors; contract for their handling.
Niche guides for this area, each naming the specific regulation.
Fix the lawful basis for training data first, then minimise.
The readiness check surfaces basis, purpose and transparency gaps in AI use.
Take the readiness check →Consultant-led and partner-backed.