By Mr. Chintan Shah, Founder, DPDPGuard.ai
India is living through two revolutions at once. The first is an artificial intelligence boom that is reshaping how companies build products, sell to customers, and make decisions. The second is the arrival of a real, enforceable data protection law after years of waiting. The question business leaders are now asking is simple: can a country racing to lead the world in AI adoption also become a country that data principals trust with their personal information? The answer will depend less on the technology itself and more on how quickly organisations rebuild their data governance around it.
India’s AI Momentum Is Real and Accelerating
The numbers make the scale of adoption hard to miss. According to Deloitte’s State of AI in the Enterprise report for 2026, 40% of Indian respondents report “significant or full” AI usage inside their organisations, compared with a global average of roughly 28%, and India ranked first among surveyed countries on how actively AI is used in strategic decision-making. At-scale deployment is strongest in product development (62%), strategy and operations (56%), marketing and sales (55%), and supply chain (48%), meaning AI has moved well past the pilot stage in the functions that touch customer data most directly.
This builds on an earlier trend. IBM’s Global AI Adoption Index found that 59% of large Indian enterprises (over 1,000 employees) had AI actively in use, the highest share among surveyed countries. Adobe’s 2025 AI and Digital Trends India survey of 345 executives found that 23% of Indian businesses were already showing measurable ROI from generative AI, the highest figure in Asia-Pacific, driven largely by faster content production and productivity gains. Separately, India now has 958 million active internet users, which magnifies how much personal data now flows through AI-powered systems daily.
Where AI Quietly Leaks Personal Data
Much of the risk isn’t dramatic hacking — it’s ordinary employees using AI tools without realising what they’re exposing. A sales executive pasting a customer contact list into a public generative AI tool to draft a personalised outreach email has just moved that data outside the company’s control, with no audit trail and no consent basis. A support team feeding chat transcripts containing names, phone numbers, or health details into an AI summarisation tool to “save time” is doing the same thing. This kind of unsanctioned use — often called shadow AI — is exactly the blind spot regulators are watching, and it rarely shows up on a compliance checklist until something goes wrong.
DPDP Meets AI: India Steps Up
India’s Digital Personal Data Protection Act, 2023 has moved from paper to practice. The Ministry of Electronics and Information Technology notified the DPDP Rules, 2025 on 13 November 2025, along with the formal constitution of the Data Protection Board of India. Implementation is staggered across three notified milestones — 14 November 2025, 14 November 2026, and 14 May 2027. Different provisions of the Rules come into force at these stages, including the Board’s establishment, Consent Manager registration, and the provisions governing substantive compliance and penalties. With the November 2026 milestone approaching, businesses that treated the Rules as a distant deadline need to start preparing now. Penalties for serious violations can reach ₹250 crore, a figure regulators and legal analysts have repeatedly flagged as a reason boards can no longer treat data governance as a back-office issue.
The law is deliberately principle-based rather than prescriptive, giving organisations flexibility in how they comply, but that flexibility cuts both ways. Companies must still demonstrate, not just claim, accountability for how personal data is collected, processed, and secured — and the compliance runway is shorter than it looks once AI systems are added to the picture.
Where the Friction Actually Shows Up
The cost of getting this wrong is rising fast. IBM’s 2026 Cost of a Data Breach Report puts the average breach cost in India at a record ₹25.5 crore, up 15.9% from ₹22 crore the year before, with the average incident now compromising close to 39,500 records. Notably, 26% of malicious breaches in India in 2026 were AI-generated, and “shadow AI” — unauthorised or unmonitored AI use — added an average of ₹1.79 crore to breach costs where it was present. Organisations with extensive AI-driven security and governance paid meaningfully less than those without it, underlining that AI is now as much a risk-reduction tool as a risk source. Meanwhile, only 37% of firms have introduced special access controls around their AI use, leaving a wide gap between adoption speed and governance maturity.
The SME Reality: Compliance Without a Legal Team
For large enterprises, this is a matter of scaling existing governance functions. For SMEs and startups — who make up the bulk of India’s digital economy but rarely have a dedicated privacy or legal team — DPDP compliance can feel out of reach. In practice, it doesn’t need to be. A smaller company can start with a simple, living register of what personal data it collects and where it flows (including through AI tools), a written policy on which AI tools staff are permitted to use with customer data, and basic consent capture built into existing sign-up or CRM flows rather than a separate legal project. This is also where the broader privacy-tech and compliance-automation space is proving useful: platforms such as DPDPGuard.ai are built to help smaller teams operationalise these requirements — automating data mapping, consent tracking, and breach-notification workflows — without needing to hire a compliance department from scratch.
The Way Forward: What to Start Today
India’s businesses have proven they can adopt AI faster than almost anywhere else in the world. Turning that speed into lasting trust means acting now, not after the November 2026 deadline. A practical starting checklist:
- Map your data flows first — know what personal data exists, where it’s stored, and which AI tools touch it, before deploying anything new.
- Set clear rules for AI tool use — define which AI tools employees can and cannot use with customer or employee data, and close the shadow AI gap.
- Build consent and access controls into the AI pipeline — not as a bolt-on after deployment.
- Prepare for enforcement milestones — align internal timelines to the 14 November 2026 and 14 May 2027 dates rather than treating them as distant.
- Use automation where you lack in-house expertise — compliance platforms can shoulder the operational load for smaller teams without dedicated legal resources.
Businesses that integrate the DPDP Act into their AI designs — rather than treating it as a legal afterthought — are the ones that will turn India’s AI success story into sustained, trustworthy innovation. Platforms such as DPDPGuard.ai.ai help businesses operationalise DPDP compliance by simplifying data mapping, consent management, compliance monitoring, and breach-response workflows.
Covered By: NCN MAGAZINE / DPDP
If you have an interesting Article / Report/case study to share, please get in touch with us at editors@roymediative.com , roy@roymediative.com, 9811346846/ 9625243429
