Imagine asking a company to delete your data, and they actually do it. Your account, gone. Your photos, gone. Your search history, gone. Now imagine that same data was also used to train an AI model six months earlier. The account is deleted. The model still remembers you.
That is not a hypothetical. It sits close to the centre of an unresolved tension inside India's Digital Personal Data Protection Act, 2023, a law that finally started coming into force in November 2025, right as the country's AI boom hit full speed. The timing was either perfect or terrible, depending on who you ask.
A Law Arriving in Three Acts
The DPDP Act received presidential assent in August 2023, but Parliament built it to switch on in stages rather than all at once. Phase one, covering the establishment of the Data Protection Board of India, took effect on November 13, 2025, alongside the DPDP Rules that finally spelled out how the Act would actually work. Phase two, covering the Consent Manager framework meant to let people manage their permissions across apps from one place, arrives on November 13, 2026. Phase three, the substantive obligations most businesses actually have to comply with, including consent requirements and breach notification, lands on May 13, 2027.
In practical terms, 2026 is the in-between year. The law exists. Most of its teeth do not, yet.
The Board That Wasn't There
That gap became very literal in April 2026. A petitioner named Parth Sharma approached the Madhya Pradesh High Court's Indore Bench, challenging Meta's decision to discontinue end to end encryption on Instagram, arguing it violated the right to privacy the Supreme Court recognised in the Puttaswamy judgment. The Union of India's counsel raised an objection: Section 18 of the DPDP Act had already created a dedicated Board to hear exactly this kind of grievance, so the petitioner needed to go there first.
The Court agreed, directing the petitioner to file with the Board within seven days, with the Board expected to issue a reasoned order within fifteen. There was just one problem. At the time, the Data Protection Board of India had no appointed Chairperson and no appointed Members. It existed in the Act, and in the Rules, and nowhere else. MeitY only opened applications for the Board's leadership the following month, in May 2026, with appointments following through June. For a stretch of nearly seven months, India's data protection law had a statute, a set of rules, and a regulator that, functionally, was not there.
So What Does the Act Actually Do?
Strip away the phased timeline and the Act is built around a fairly simple idea. Companies that decide why and how personal data is processed, called Data Fiduciaries in the Act's language, need a lawful basis to do it, usually consent obtained through a clear notice rather than buried in fine print. You, the Data Principal, get a matching set of rights: to know what data a company holds on you, to correct it, to withdraw consent, and to ask for it to be erased once it is no longer needed for the purpose you agreed to. Fiduciaries have to report data breaches to the Board and to affected users, and the largest ones, classified as Significant Data Fiduciaries, face extra obligations including impact assessments and mandatory audits. Penalties for serious violations run up to two hundred fifty crore rupees per instance.
None of this is unusual by global standards. It reads like a close cousin of the GDPR's basic architecture. What makes the Indian version interesting right now is what it collides with.
Now Add AI
MeitY's own India AI Governance Guidelines, released days before the DPDP Rules in November 2025, made a deliberate choice: rather than draft a separate AI law, India would lean on the DPDP Act and existing frameworks to govern AI, with targeted fixes where gaps appear. The Guidelines themselves flagged exactly where those gaps sit, and they map onto three fairly specific collision points.
| The gap | Why it matters |
| Training data and consent | The Act's exemption for data "voluntarily made public" sets a high bar. Most of what large language models are trained on, scraped broadly from across the internet, was not made public specifically for AI training, and consent for that specific purpose was never really obtained. |
| Purpose limitation | Data collected for one purpose, say completing an online purchase, cannot simply be repurposed to train a company's AI model without fresh, specific consent. For companies sitting on years of accumulated user data, that is a real audit problem, not a theoretical one. |
| The erasure problem | The right to erasure assumes data can actually be removed. A trained model generally cannot selectively "unlearn" one person's contribution without expensive retraining, which leaves an open question nobody has fully answered. |
The Guidelines do not resolve any of this. They recommend that greater clarity be brought to how consent and purpose limitation apply to AI systems, which is regulatory language for we know this is a problem and we are working on it. Expect this to be one of the more closely watched corners of Indian tech policy through 2027.
Your Rights, in Plain English
Whatever stage the Act is in, some of these rights are worth knowing regardless.
- You can ask any company holding your data what they have and why.
- You can ask them to correct it if it is wrong.
- You can withdraw consent you previously gave, at any time, as easily as you gave it.
- You can ask for your data to be erased once the purpose it was collected for no longer applies.
Companies are not always required to comply immediately, and the enforcement mechanism is still finding its feet, but the rights themselves are not aspirational. They are written into the Act.
Why This Should Matter to You
If you use basically any digital service in India, and at this point that is nearly everyone, this law already governs how your data is supposed to be handled, even during a phase where enforcement is soft. If you build or deploy AI products, the training data question is not going away, and "we scraped it from the open internet" is a weaker defence under Indian law than it might feel. And if you are simply trying to understand where Indian tech regulation is heading, the DPDP Act is turning out to be the single most consequential document in the room, precisely because it was not written with AI in mind and is now being asked to govern it anyway.
The Board finally has people in it. The Consent Manager framework is due within months. The heavier obligations arrive in May 2027. Somewhere in between, a genuinely hard question is still sitting unanswered: once a machine has learned something about you, what does it actually mean to make it forget.
A law built for spreadsheets and databases is now being asked to police something that does not delete the way a spreadsheet does. How that gets resolved will shape what privacy even means in India's AI decade.
BRB Legal's Technology & Privacy desk tracks developments like these as they unfold.
This article is for general information only and does not constitute legal advice. For advice on a specific situation, please consult a qualified professional.
This article is for general information and states the law as at 8 September 2026. It is not legal advice. For advice on your situation, contact the firm. Published by BRB Legal.
