India's Digital Personal Data Protection Act 2023 applies whenever an AI agent processes digital personal data of people in India. The organisation running the agent is the data fiduciary: it needs consent or a legitimate use, must give notice, keep data accurate where it drives decisions, protect it, report breaches, erase it when its purpose ends, and protect children's data.
What does the DPDP Act require, in plain words?
The Digital Personal Data Protection Act 2023 governs the processing of digital personal data. It names the person the data is about the data principal, the organisation that decides why and how data is processed the data fiduciary, and anyone processing on the fiduciary's behalf a data processor. In substance, a data fiduciary must:
- process personal data only with the data principal's consent or for certain legitimate uses the Act lists;
- give a clear notice describing the data and the purpose when seeking consent;
- make it as easy to withdraw consent as to give it;
- ensure completeness, accuracy and consistency of data used to make decisions about the data principal or shared with another fiduciary;
- take reasonable security safeguards to prevent breaches;
- notify breaches to the Data Protection Board the Act establishes and to each affected data principal;
- erase data once consent is withdrawn or the purpose is no longer served, unless the law requires retention;
- run grievance redressal and publish a contact for data questions;
- obtain verifiable parental consent for children's data and avoid tracking, behavioural monitoring and targeted advertising directed at children.
Fiduciaries designated as significant carry more duties, such as impact assessments and audits. Rules made under the Act set further detail and timing; check which provisions apply to you now.
Who does it apply to?
Any organisation processing digital personal data in India, and organisations outside India processing such data in connection with offering goods or services to people in India. That reaches Indian banks, insurers, hospitals and online retailers, and foreign firms serving Indian customers.
Sector regulators add their own expectations: RBI for banks and payments, SEBI for securities, IRDAI for insurance. The sector picture for two industries is set out in AI agents for compliance teams in healthcare in India and in e-commerce in India.
What changes when an agent processes the data?
Four duties take a sharper form with agents.
Purpose and consent at the agent level. Consent covers specified purposes. An agent that can read a customer's whole history will tend to use it for whatever task it is doing. If the purpose of a capability is not covered by consent or a legitimate use, the agent should not have the data. Consent mechanics are covered in DPDP Act consent and AI agents.
Accuracy when agents decide. The accuracy duty applies to data used to make decisions about the data principal. Agents often create new data, such as a summary or an inferred income, that then drives a decision. That derived data must meet the same standard.
Erasure reaching agent stores. When consent is withdrawn, erasure must reach conversation histories, summaries and retrieval indexes the agent keeps, not only the core database.
Children. An agent that personalises recommendations or content is a form of behavioural monitoring. If children use the service, that capability needs to be switched off for them.
How do you meet the Act when agents process personal data?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Consent or legitimate use | Each agent capability mapped to a consent purpose or a listed legitimate use | Purpose map per capability |
| Notice | Notices describe agent processing in plain language, in the languages offered | Notice text and versions |
| Withdrawal of consent | Withdrawal stops agent access to the data and triggers erasure | Withdrawal records and access changes |
| Accuracy of decision data | Agent-derived data used in decisions traceable to sources and reviewable | Records linking derived data to sources |
| Security safeguards | Least-privilege agent access; protected credentials; injection testing | Access reviews and test results |
| Breach notification | Agent incidents assessed for personal data breach | Breach assessments and notifications |
| Erasure | Deletion reaches agent memory, summaries and indexes | Erasure logs across stores |
| Children's data | Personalisation and tracking capabilities disabled for children | Capability configuration and age checks |
| Grievance redressal | Agent may triage grievances; resolution stays with staff | Grievance register |
The fiduciary's overall obligations, including when it uses a vendor's agent, are covered in DPDP Act data fiduciary duties for AI agent deployers.
What will the Board or an auditor ask?
- What personal data does each agent use, and on what ground?
- Do your notices tell people that agents process their data?
- When a customer withdraws consent, which agent stores do you clear?
- How do you know agent-derived data used in decisions is accurate?
- Do any agents personalise content for users who may be children?
- Where is the model run, and has the government restricted transfers to that country?
What does the Act not cover?
It does not regulate AI systems as such, and India has no AI-specific statute in force. It does not cover non-digital personal data or most personal data the data principal has made public. It does not replace sector rules from RBI, SEBI or IRDAI. And it permits transfers outside India except to countries the government restricts, so check that list before choosing where a model runs. For the cross-border view, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme gives each agent capability its own sources, so data reaches an agent only for the purpose that capability serves. Every fact carries its provenance and every action is filed, which helps show the accuracy of data used in decisions and find every place an agent used a person's data when they withdraw consent.
Questions people ask
Is the model provider a data processor under the DPDP Act?
Usually, if it processes personal data on the fiduciary's behalf. The fiduciary remains responsible and should engage it under a valid contract.
Does an agent's inference count as personal data?
If it relates to an identifiable individual, yes. Inferences used in decisions also fall under the accuracy duty.
Can an agent rely on legitimate uses instead of consent?
Only where the use fits one the Act lists. Many commercial agent tasks will need consent, so map each capability rather than assuming.