India's Digital Personal Data Protection Act 2023 makes every data fiduciary answerable for how personal data is processed, including by AI agents acting for it. Staff who brief, supervise and approve agents must be trained to keep agents within the consent given, check accuracy before data drives a decision, spot breaches, and handle data principals' requests and grievances properly.
What does the DPDP Act ask of staff who work with agents?
The DPDP Act governs digital personal data in India. In substance, a data fiduciary, the organisation that decides why and how personal data is processed, may process it only for a lawful purpose, with the person's consent or for certain legitimate uses the Act lists. Consent must be free, specific, informed and unambiguous, preceded by a notice explaining what is collected and why, and as easy to withdraw as to give.
The fiduciary must take reasonable security safeguards to prevent breaches, notify breaches to the board the Act establishes and to affected people, and erase data once the purpose is served. Where personal data is likely to be used to make a decision that affects the person, or disclosed to another fiduciary, the fiduciary must make reasonable efforts to ensure it is complete, accurate and consistent. That accuracy duty bears directly on agents.
People, called data principals, have rights to information about processing, to correction and erasure, to grievance redressal and to nominate someone to act for them. Children's data needs verifiable parental consent, and tracking or targeted advertising aimed at children is restricted. Fiduciaries the government designates as significant carry extra duties, including a data protection officer based in India, independent audits and periodic impact assessments. Rules made under the Act fill in detail and timing.
The system side is covered in the DPDP Act and AI agents in India.
Who does it apply to?
The Act applies to processing of digital personal data within India, and to processing outside India connected with offering goods or services to people in India. Data processors acting for a fiduciary, such as an agent platform or model provider, must be engaged under a valid contract; the fiduciary stays responsible.
Sector regulators add their own layer. The RBI supervises banks and many lenders and payment firms; SEBI covers securities markets; IRDAI covers insurers. Each expects regulated firms to protect customer data and to stay accountable for technology they use.
Staff in scope include customer service and collections teams supervising agents, operations staff releasing agent actions, product and data teams choosing agent sources, grievance officers, and anyone handling breach response. For a sector view, see what AI agent training organisations in India need.
What competence does the Act imply when agents act?
Consent scope. Consent covers specific purposes. Staff who add a source to an agent, such as transaction history for a cross-sell agent, must check whether the original consent covers the new use. If not, they need fresh consent or a listed legitimate use.
Accuracy before decisions. When an agent's output feeds a decision about a person, such as a loan limit or a collections step, the fiduciary must take reasonable steps to ensure the data is accurate. Supervisors must check the agent's facts against sealed records from the system of record, and treat the customer's declared information and external documents with appropriate care.
Withdrawal and erasure. When a person withdraws consent, agents must stop using their data for that purpose. Staff must know how withdrawal reaches agent sources, and that agent summaries and records may need erasing too.
Breach recognition. An agent that sends a statement to the wrong person, or reveals another customer's data in a reply, has caused a breach. Staff must recognise it and report it at once so the fiduciary can notify.
Grievances and rights. Customers can ask what data is held and how it was used. Staff must know that agent records fall within scope, and how to answer within the time the rules set.
Children's data. Agents serving consumer platforms must not profile or target children. Staff configuring agents must know the age checks in place.
Depth helps assign responsibility. An agent reading data at depth 1 creates privacy risk through what it sees. One drafting messages at depth 2 creates risk through what a person sends. One acting at depth 3, such as updating a customer's address, creates accuracy risk. Moving money is depth 4 and held for a person.
How do you meet the Act and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Lawful purpose and valid consent | Each agent source mapped to a consent purpose or listed legitimate use | Source register with purposes |
| Accuracy for decisions | Supervisors trained to verify agent facts before decisions | Sample review results |
| Security safeguards | Approved agents only; processor contracts; least access | Contracts; access reviews |
| Breach notification | Staff trained to recognise agent-caused breaches and report | Training records; incident log |
| Withdrawal and erasure | Withdrawal flows to agent sources and records | Configuration tests; erasure logs |
| Rights and grievances | Agent records included in request handling | Request and grievance records |
| Record of processing | Every agent verdict filed with sources used | Append-only decision record |
What will the regulator or an auditor ask?
- What personal data does each agent use, and on what consent or legitimate use?
- How do you ensure agent-supplied facts are accurate before a decision?
- Show us training records for staff who supervise agents.
- How would you know an agent caused a breach?
- How does consent withdrawal reach agents?
- What contracts govern your agent and model providers?
For banks, the question of whether they can use AI agents before staff are trained arises early in any review.
What does the Act not cover?
It does not apply to personal data made publicly available by the person or under a legal duty, or to non-digital data that is never digitised. It does not regulate AI fairness as such. It does not replace RBI, SEBI or IRDAI requirements for regulated firms. And it does not prescribe training content. Comparable regimes differ in detail; Australia's Privacy Act and staff training shows another model. The guide to AI literacy and certification covers the general approach.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy teaches people to run governed agents on the real product, with module tests set in the learner's own industry and role. Foundations covers data, ownership and trust; the Operator track covers human review and keeping knowledge current. For a team getting started, the free readiness assessment for up to 25 people shows scores by concept and the first agent to start with.
Questions people ask
Is an agent platform a data fiduciary or a processor?
Usually a processor, acting under your instructions. You remain the fiduciary and are responsible for its processing.
Does the accuracy duty apply to every agent output?
It applies where data is likely to be used for a decision affecting the person or disclosed to another fiduciary. Those outputs need checking.
Do significant data fiduciaries need special training?
They carry extra duties, including a data protection officer and independent audits. Training for staff overseeing agents should be deeper and better evidenced.