DPDP Act vs GDPR: Why Data Privacy Is Becoming a Foundational Layer of AI Governance
Updated: 5 days ago
A short conversation about India's Digital Personal Data Protection (DPDP) Act with a retired Chartered Accountant recently got me thinking about a much bigger question: Are organisations truly prepared for the data privacy implications of AI? What began as a discussion about regulation soon led me to reflect on how AI systems collect, process, retrieve and share personal information, often across multiple platforms and services. With generative AI and agentic systems becoming part of everyday business operations, data privacy is no longer just a legal discussion. It is becoming a fundamental part of how we design, deploy and govern AI.
India's DPDP Act, 2023, and Europe's General Data Protection Regulation (GDPR) share a common objective: protecting individuals' personal data while enabling its legitimate use. Both frameworks emphasise transparency, purpose limitation, data minimisation, security and accountability. However, they differ in scope and implementation. GDPR provides a broader framework for personal data processing, including several lawful bases beyond consent, rights such as data portability and objection, and specific obligations for certain organisations. India's DPDP framework focuses on digital personal data and establishes its own approach to consent, individual rights, organisational responsibilities and enforcement. India's DPDP Rules were notified in November 2025, with obligations being introduced in phases. For organisations operating across India and Europe, compliance with one framework does not automatically guarantee compliance with the other.
The implications become more significant when we introduce generative AI and agentic systems. Consider an enterprise AI assistant connected to a company's SharePoint documents, customer database and internal business applications. It may retrieve personal information, send context to a language model, invoke external tools and retain interaction logs for debugging. Every step introduces potential privacy considerations. Was the information collected for a compatible purpose? Does the organisation have a valid legal basis for processing it?
Is personal information being shared with an external model provider? Are prompts and responses being retained longer than necessary? Can an individual's request to exercise their data rights be handled appropriately? Deploying an AI model does not remove an organisation's existing legal responsibilities. Instead, AI introduces additional data flows that must be understood, controlled and documented.
This is why data protection is increasingly becoming a policy-level and architectural change in AI adoption. Organisations need clear policies governing which AI tools employees may use, what information can be submitted, how third-party providers process data, and when human approval is required. At the engineering level, this translates into role-based access, data minimisation, redaction of personal information, encryption, retention policies and audit trails. Retrieval-augmented generation (RAG) systems should enforce access permissions when retrieving documents rather than relying on the language model to decide what a user can see. Agentic workflows should operate with least-privilege access, while observability platforms should avoid unnecessarily capturing personal information in prompts, traces and logs. Organisations must also assess whether a Data Protection Impact Assessment or another formal risk assessment is required for their processing activities. These controls help translate regulatory obligations into practical engineering decisions.
Ultimately, the DPDP Act and GDPR represent more than compliance milestones. They reflect a transition towards a digital economy in which trust, accountability and responsible data use are essential to sustainable innovation. Organisations that treat privacy as a final checklist may find themselves redesigning AI systems after deployment or restricting use cases that could have been designed more responsibly from the beginning. Those that integrate privacy into data pipelines, model selection, prompt design, agent permissions and deployment governance can build systems that are easier to scale and govern. The objective is not to slow down AI adoption; it is to make that adoption sustainable. The future of enterprise AI will not be defined only by how intelligent a model becomes, but also by how responsibly an organisation uses the data that makes it intelligent.
References and further reading
This article explores the general policy and engineering implications of data protection regulations and is not legal advice.
Comments