Authored By: Ananya Kumar
Government Law College, Kozhikode
ABSTRACT
The swift evolution of generative artificial intelligence models has revealed significant regulatory tensions within India’s data protection framework, particularly the incongruence between non-linear machine learning processes and the Digital Personal Data Protection (DPDP) Act[1], 2023. This paper conducts a thorough doctrinal examination of this operational conflict, concentrating on the legal obstacles related to big-data acquisition, public web-scraping, and the training of neural networks. It illustrates that the Act’s inflexible, purpose-specific, and consent-driven structure as outlined in Section 6 presents both functional and legal challenges for technology developers who rely on public datasets, while simultaneously exposing corporations to severe statutory penalties of up to ₹250 crore due to Section 8’s accuracy and erasure requirements. In particular, the article assesses the computational difficulties associated with fulfilling user deletion requests within fully trained neural networks, where the physical extraction of data is mathematically impractical, thereby underscoring the discord between strict statutory interpretation and the realities of software engineering. Additionally, this paper investigates a significant gap in corporate governance stemming from the complete legislative absence of a data principal’s right to contest automated decision-making, which renders consumers vulnerable to unregulated algorithmic profiling in critical areas such as employment and credit assessment. Ultimately, the paper proposes actionable risk-mitigation strategies for corporate legal teams—such as the adoption of multi-tiered consent mechanisms and structured Data Protection Impact Assessments (DPIAs) in accordance with Section 10—and offers a legislative framework for standardizing AI auditing regulations under the Data Protection Board of India to effectively align corporate innovation with legal accountability.
Keywords:- Digital Personal Data Protection Act 2023, Artificial Intelligence, Machine Learning, Corporate Compliance, Automated Decision-Making, Data Fiduciary, Machine Unlearning.
INTRODUCTION : THE CORPORATE FRONTIER OF ALGORITHMIC DATA.
Nowadays tech companies are rushing to develop powerful Artificial Intelligence models. But AI is nothing without data. To train these systems, the developers must collect massive amounts of information from the internet. But as these companies gather data they run into a major roadblock: India’s strict new data privacy law[2]. Under the Digital Personal Data Protection (DPDP) Act, companies have to face heavy responsibilities. If a corporate entity mishandles data or breaks the rules, the penalties are massive- reaching up to 250 crores[3] for a single violation. For corporate lawyers advising tech companies, data privacy is no longer just a technical issue; it is a major financial risk.
The difference between Indian laws and western laws is what causes this crisis. In the European Union[4], the law allows companies to use “legitimate interest” and train AI. This means that European firms can train algorithms with public internet data without asking each individual for their permission. India’s DPDP Act on the other hand relies heavily on individual consent. A company cannot touch or process commercial data unless the user gives direct permission except for a few exceptions.
This setup creates a huge legal gap. Because the DPDP Act demands for strict permission, it makes the standard AI training required almost next to impossible. It is not realistic to expect a tech developer to get individual permission from millions of internet users prior to scraping their data. Another major flaw of the law is that it completely leaves out a person’s “Right to Object to Automated Decision-Making”. This means that Indian citizens are left with no protection against biased algorithms that profile them or reject them for jobs and loans while tech corporations are struggling with legal liability for collecting data. Ultimately a dual crisis is created by the DPDP Act by forcing a strict consent system while failing to protect users from automated decisions. The crisis is that it exposes Indian AI developers to massive fines while leaving citizens completely unprotected from algorithmic systems.
THE STATUTORY HURDLE : THE CONSENT PROBLEM IN AI TRAINING
The Illusion of Informed Consent:-
To understand how the Digital Personal Data Protection (DPDP) Act, 2023 limits machine learning, one must examine the strict regulations on text and data ingestion through traditional legal interpretation. According to classic Indian law, textbooks on Statutory Interpretation[5] state that when a statute’s language is clear, the legislative intent should be understood from the straightforward meaning of the words. Section 6(1)[6] of the DPDP Act reflects this literal strictness. It clearly requires that any valid consent from a data principal must be “free, specific, informed, unconditional, and unambiguous with a clear affirmative action”.
For companies creating generative technology, these combined legal requirements create a structural challenge. An artificial intelligence system, particularly a large language model (LLM), functions by processing vast datasets collected from the public web to identify semantic patterns and linguistic structures. From a compliance standpoint, a developer cannot reasonably meet the demands of Section 6(1) while gathering data from the web. It is both functionally and legally impossible to provide clear, plain-language notices in various regional languages to millions of internet users before their random public comments, blog posts, or digital traces are included in a training process. Since the consent must be “specific” to a certain purpose, the unpredictable and open-ended way an AI uses data later fundamentally breaches the strict purpose-limitation rules established in the Act’s text.
The Zero-Exemption Reality:-
Many early tech developers mistakenly believe that the data available online is a free and unregulated treasure that they can use. Although Section 3(c)(ii)[7] of the DPDP Act completely excludes personal data that data principals have voluntarily made public from the applicability of the Act , this does not mean that businesses can freely mine or extract data without restrictions.[8] Traditional corporate laws and tort principles stress that the way data is used is of utmost importance. For instance, if someone shares their name, job, and location for a specific networking purpose, a third-party business cannot just assume they have the right to scrape that information and use it to train a commercial algorithm.
Additionally, using simple anonymization as a legal defense doesn’t hold up under strict corporate scrutiny. Data processing guidelines indicate that anonymization is seldom permanent, especially with advanced computing. When a trained AI model analyzes large amounts of contextually related public data, it might unintentionally re-identify a person through its results. If a synthetic output corresponds to a recognizable individual without a clear and traceable consent process, the broad exemption falls apart. For corporate fiduciaries, this potential for real-world re-identification poses a significant compliance risk, leading to serious legal consequences under the stringent enforcement provisions of the Act.
III.AUTOMATED DECISION-MAKING AND THE CORPORATE GOVERNANCE GAP
The regulatory omission:-
Even though the data collection rules in the Digital Personal Data Protection (DPDP) Act, 2023, are very rigid and strict, there is a gap regarding automated data processing. The lack of a “Right to object to automated decision making” is a major key element that is missing. Modern data privacy laws like the European Union’s General Data Protection Regulation (GDPR) in Article 22[9], individuals are protected from decisions made solely by automated processes[10] that have legal or significant effects. However, this protection is completely ignored by the Indian laws. The omission of this safeguard creates a structural imbalance, leaving the subsequent algorithmic exploitation of collected data largely unchecked.
The corporate impact:-
Business and individual rights have been adversely affected because of the lack of the regulations. In today’s day and age companies are not self sufficient when it comes to improving efficiency and reducing costs and are heavily reliant on AI. Banks also use automated systems to assess credit risk; insurance firms use AI to set premiums and reject claims; and large companies depend on automated systems to manage high-volume hiring.
The Compliance Nightmare of Data Erasure:-
The convergence of automated systems with conventional data protection responsibilities presents a significant compliance dilemma under Section 8 of the DPDP Act. According to Section 8(3)[11], a Data Fiduciary is obligated to guarantee the accuracy and completeness of personal data utilized in decision-making processes that impact the data principal. Additionally, Section 8(10)[12] stipulates the complete erasure of personal data upon the revocation of consent or once the designated purpose of processing has been achieved.
For organizations employing deep learning models and intricate neural networks, these two provisions pose a practical impossibility. When a machine learning model undergoes training, individual user data is not merely organized in a tidy database; rather, it is fragmented, vectorized, and intricately woven into millions of interconnected algorithmic weights. Should an individual invoke their right to erasure as per the Act, the corporation encounters a technical conundrum. It is computationally unfeasible to extract or “delete” a specific individual’s data points from a fully trained neural network without engaging in a prohibitively costly procedure known as “machine unlearning.” If the algorithm continues to produce outputs that are influenced by that individual’s historical data, the corporation remains in a state of ongoing violation of its Section 8 erasure obligations. This fundamental discrepancy between the explicit language of the law and the practical realities of neural network engineering places corporate fiduciaries in a precarious position, caught between unavoidable statutory non-compliance and substantial financial risk.
RISK MITIGATION & CORPORATE BEST PRACTICES
Drafting AI-Specific Consent framework:-
It is important for corporate attorneys to abandon conventional, blanket privacy policies to shield and protect clients from the legal liabilities imposed by Section 6 of the DPDP Act, 2023. Considering the fact that Section 6 explicitly requires consent to be specific, informed, and unequivical, a singular ‘agree to terms’ checkbox will not withstand regulatory examination if the data collected is subsequently utilized for machine learning purposes. Corporate firms must therefore shift from this to a dynamic, multi-tiered consent framework. This structure distinguishes routine operational data processing, such as transaction execution or user account management, from subsequent algorithmic training.
In constructing this framework, legal advisors should guide technology development teams to create modular user interfaces. The front-end design must separate consent: a user who uploads their financial or professional information should be able to consent to the immediate primary service without being compelled to permit their data to be used for training the platform’s proprietary generative models.
Moreover, to fulfil the informed requirement stipulated by the law, the notice must clearly articulate the processing in straightforward, understandable language. It should detail that the data will be utilized in neutral networks, clarify whether it will produce synthetic outputs, and provide a straightforward, one-click option for users to retract their consent. By structuring consent as a series of distinct, clear choices rather than a take-it-or-leave-it proposition, companies can uphold a transparent, legally defensible audit trail for every piece of data entering their AI systems.
Implementing Data Protection Impact Assessments (DPIA):-
For corporate firms identified under section 10 of the DPDP Act as “Significant Data Fiduciaries”, compliance with regulations demands a more thorough approach. Section 10(2)(c)[13] requires these large data processors to perform a formal Data Protection Impact Assessment (DPIA) to assess risks before initiating any major data processing. When a corporate client uses self-learning algorithms, the DPIA must specifically tackle the compliance issues related to automated networks.
A solid and justifiable DPIA framework for AI implementation should concentrate on three main areas:
First, the legal team, in collaboration with tech engineers, needs to carry out detailed sourcing audits to pinpoint the exact origins of all training datasets. It must be confirmed by the DPIA that any data obtained from the web or commercial databases does not include personal identifiers without a clear, documented consent history. If any unconsented personal data is found in the training set, the model must be immediately isolated to avoid a widespread compliance failure.
Second, the company should implement controls for bias and accuracy. To meet the accuracy requirements of Section 8(3), the DPIA must record how the company evaluates the training data for bias. If an AI model is utilized for critical decisions such as hiring or credit assessments, the evaluation must demonstrate how the dataset reflects minority groups to ensure that the final automated results do not lead to illegal discrimination or arbitrary profiling.
Third, the DPIA must provide a clear technical plan for managing user deletion requests as outlined in Section 8(10). Since removing an individual’s data from a fully trained neural network is mathematically challenging and costly, the DPAI should suggest alterative technical methods. These may include advanced cryptographic techniques, localized data masking, or regular model retaining.
Fiduciaries do not only merely avoid penalties by conducting a thorough and proactive DPIA under Section 10, but also create a solid record of legal compliance. This record acts as a strong defense if the Data Protection Board of India audits the company’s AI systems.
CONCLUSION : RECONCILING INNOVATION WITH COMPLIANCE
The evolution of the regulatory framework:-
As India positions itself as a global tech leader, its regulatory framework needs to evolve far beyond the outdated models. The Digital Personal Data Protection (DPDP) Act, 2023, is an important initial step in safeguarding digital rights, but it currently views data processing as a simple transaction. In today’s world of neural networks, data processing is complex, dynamic, and ongoing. For India’s regulatory system to stay effective, it must shift from a strict consent-based model to a flexible, outcome-oriented approach. If the law does not adapt, the heavy fines of up to ₹250 crore could unintentionally hinder local tech startups, leaving the field open only to wealthy corporations that can handle high compliance costs. The government must understand that protecting privacy does not mean stopping algorithmic advancements; it means creating laws that guide how algorithms function instead of trying to control their learning process.
Standardizing AI Auditing under the Data Protection Board:-
To fill this regulatory void without stifling corporate innovation, the Data Protection Board of India (DPBI) should take an active stance. Instead of waiting for algorithmic issues to arise and then imposing hefty fines, the DPBI should create a standardized national framework for AI Auditing.
This auditing standard should be based on three main principles:
- Transparency and Explainability: The DPBI must require companies using high-risk algorithms to keep thorough records of their training data, testing methods, and safety measures.
- Independent Compliance Certifications: Similar to financial audits, companies that use algorithmic decision-making should have annual third-party technology audits to ensure their models are free from systemic bias and do not process data without consent.
- Technical Deletion Standards: The Board is required to establish distinct, legally permissible alternatives to the physical erasure of data from neural networks—such as machine unlearning protocols or differential privacy—thereby providing corporate fiduciaries with a feasible and compliant pathway forward.
By implementing standardized auditing regulations, India has the potential to foster a stable regulatory framework. Corporate entities will benefit from a definitive compliance roadmap, safeguarding them against unforeseen liabilities while also protecting citizens from unregulated algorithmic profiling. In conclusion, a well-organized auditing framework under the DPBI guarantees that corporate advancement does not compromise legal responsibility, enabling India to cultivate a digital future that is both remarkably innovative and legally sound.
REFERENCE(S):
Primary Sources:- Statutes and Legislation
- Digital Personal Data Protection Act, 2023, No. 40, Acts of Parliament, 2023 (India).
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), 2016 O.J. (L 119) 1.
Primary Sources:- Judicial Decisions
- hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022).
- Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
- Rechtbank Den Haag [District Court of The Hague], 5 Feb. 2020, ECLI:NL:RBDHA:2020:865 (State of the Netherlands v. Stichting Nederlands Comité voor Juristen voor de Mensenrechten) (Neth.).
Secondary Sources:- Books & Treaties
- SINGH, JUSTICE G.P., PRINCIPLES OF STATUTORY INTERPRETATION (14th ed. 2016).
[1] Digital Personal Data Protection Act, 2023, No. 40, Acts of Parliament, 2023 (India).
[2] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
[3] Digital Personal Data Protection Act, 2023, § 33 read with Schedule, No. 40, Acts of Parliament, 2023 (India).
[4] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), art. 6(1)(f), 2016 O.J. (L 119) 1.
[5] JUSTICE G.P. SINGH, PRINCIPLES OF STATUTORY INTERPRETATION 45-47 (14th ed. 2016).
[6] Digital Personal Data Protection Act, 2023, § 6(1), No. 40, Acts of Parliament, 2023 (India).
[7] Digital Personal Data Protection Act, 2023, § 3(c)(ii), No. 40, Acts of Parliament, 2023 (India).
[8] hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022).
[9] General Data Protection Regulation, supra note 3, at art. 22.
[10] Rechtbank Den Haag [District Court of The Hague], 5 Feb. 2020, ECLI:NL:RBDHA:2020:865 (State of the Netherlands v. Stichting Nederlands Comité voor Juristen voor de Mensenrechten) (Neth.).
[11] Digital Personal Data Protection Act, 2023, § 8(3), No. 40, Acts of Parliament, 2023 (India).
[12] Digital Personal Data Protection Act, 2023, § 8(10), No. 40, Acts of Parliament, 2023 (India).
[13] Digital Personal Data Protection Act, 2023, § 10(2)(c), No. 40, Acts of Parliament, 2023 (India).
