Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment
SaaS & Technology · AI & ML · Foundation models

The DPDP Act for Foundation Models

Training and serving large models on personal data raises lawful-basis, purpose and cross-border questions the Act takes seriously, with no settled AI rule yet.

In short

There is no dedicated Indian AI statute yet, so foundation-model providers work under the DPDP Act general rules: personal data used to train or serve models needs a lawful basis, is bound by its original purpose. Large providers are likely SDF candidates once designation begins. Penalties reach ₹250 crore.

Core impacts

What changes for this niche, and the specific rule it turns on.

Lawful basis for training data

Personal data used to train models needs consent or a valid legitimate use, not mere availability on the web.

Purpose limitation

Data collected for one purpose cannot silently become training data for another without a fresh basis.

Minimize and de-identify

Prefer anonymised or synthetic data; strip identifiers you do not need.

Access, not explanation

Individuals can get a summary of their personal data and processing under Section 11; the Act creates no standalone right to a model's logic. SDF designation would add algorithmic due-diligence duties.

Cross-border training

The DPDP cross-border default is permissive, but design for a future Section 16 restriction or an SDF localisation direction.

Common questions

Short, cite-able answers, mirrored in FAQPage schema.

Is there an AI-specific law in India for foundation models?
Not yet. Foundation models are governed by the DPDP Act general rules, plus sectoral rules where they apply.
Can we train a model on personal data scraped from the web?
Not on availability alone. Training on personal data needs a lawful basis under the Act, and purpose limitation still applies.
Are AI providers Significant Data Fiduciaries?
Not automatically. Large AI providers are likely candidates, but SDF status requires a Government notification under Section 10, which has not yet been issued.

Where to start with AI

Fix the lawful basis for training data and purpose limits first.

Stage 1

Learn

Understand the rules for your niche.

Stage 2

Assess

See where you stand and find gaps.

Stage 3

Prepare

Map data, notices and consent.

Stage 4

Implement

Put safeguards in place.

Stage 5

Monitor

Review and stay compliant.

Check your model data pipeline.

The readiness check flags basis, purpose and cross-border gaps in AI use.

Take the readiness check →