Authored By: Alima Azmiya
KLE Law College, Bengaluru
INTRODUCTION
As of July 2026, the Delhi High Court has not yet ruled on the legal status of AI training data under Indian law. During that month, it refused the request for an injunction against OpenAI over the use of ANI news content to train ChatGPT.[1] According to the court, the training process is prima facie protected as fair dealing under the Copyright Act. On one level, it was a simple copyright battle, but that battle completely left out something else. What happens when a model’s dataset isn’t a public archive of news, say, but a private dataset of personal information; one that the company keeps secret precisely because a competitor would be able to reverse engineer its sourcing or curation strategy from it?
Similar to many other jurisdictions, India does not have a trade secrets statute; what little trade secrets protection exists comes from breach of confidence and contract law.[2] In the meantime, the DPDP Act, 2023 grants each data principal the right to inquire of a company which personal data it holds and why.[3] One can place a training dataset with personal data between those two rules, and the confidentiality interest of companies would run head-on into the statutory right of a person to know, and nothing in Indian law says who wins that fight. To put it simply, India’s trade secrets protection is built entirely around private relationships and contractual obligation. As such, it was never built to confront or withstand a transparency statute like the DPDP Act. This mismatch creates a real, not merely theoretical, problem that can be addressed.
The sections that follow set out both legal regimes, examine the conflict against existing case law, look at how the European Union and United States have addressed similar tensions, and close with a proposal for bridging the gap.
THE LEGAL FRAMEWORK
Trade Secret Protection in India
In India, there is no separate law available, which protects trade secrets. The courts created a defense against the unauthorized use of confidential information through the equitable doctrine of breach of confidence. The doctrine regarding confidence breach accomplishes most of the tasks. Contract supplies a second layer through NDAs, though Section 27 of the Indian Contract Act, 1872 voids any clause restraining a person from working in their trade, barring a sale of goodwill.[4] Customer databases can pick up copyright protection too, as literary works.[5] Section 72A of the IT Act, 2000 adds a thin criminal layer for disclosure obtained under contract.[6] All of this ties protection entirely to relationships: it stops an employee who received confidential information from misusing it, but does nothing to a stranger who obtains the same information some other way, and grants no right good against the world the way a patent does.
The DPDP Act’s Transparency Architecture
The DPDP Act flips that logic, placing standing obligations on every data fiduciary and matching rights on every data principal, regardless of relationship. Section 11 lets a data principal ask for a summary of their data, how it is processed, and who it has been shared with. Section 12 adds rights to correction and, in some cases, erasure.[7] Section 8 requires processing only for the stated purpose.[8] None of this distinguishes a routine administrative record from a company’s most valuable commercial dataset.
A partial relaxation applies to research, archiving, and statistical processing, provided no decision gets made about a specific person.[9] Model training arguably qualifies, but even where the exemption applies, it only removes notice and consent requirements; access and correction rights survive it. A separate carve-out removes data people have already made public, taking much scraped content out of the Act, but it does nothing for data a company purchases or collects directly, precisely the category most likely treated as a trade secret.[10]
III. CASE LAW ANALYSIS
Every reported Indian confidentiality dispute has turned on the relationship between the two parties, not on what the information actually was. American Express Bank Ltd. v. Priya Puri is the clearest example: the Delhi High Court refused to stop a former employee from using customer information she had come across during her job, holding that publicly ascertainable customer details did not amount to a trade secret, and weighing heavily the employee’s right to earn a living.[11] The court was asking whether the information was truly secret and whether stopping her would unfairly limit her freedom to work, not whether businesses generally deserve to keep such information confidential.
Bombay Dyeing & Manufacturing Co. v. Mehar Karan Singh set out a multi-factor test instead, looking at how widely known the information was outside the business, what steps were taken to guard it, and how much effort went into developing it.[12] The Excise Tribunal in Indian Farmers Fertiliser Cooperative Ltd. v. Collector of Central Excise arrived at something similar.[13] All of these tests share an assumption, that the dispute is between a business and someone who once stood inside it, usually a departing employee. None of them was built for the case where the outsider isn’t trying to steal anything, but is instead a person whose own data sits inside the compilation, asking a straightforward question under a statute Priya Puri and Bombay Dyeing never anticipated.
CRITICAL EVALUATION
This is not a drafting oversight, it is the collision of two doctrines built on entirely different assumptions. Breach of confidence governs many types of relationships. It was never intended to bind a person not party to that relationship. A data principal seeking a Section 11 summary was never the developer’s employee, contractor, or counterparty. It is not open to the developer to rely on breach of confidence against them. The reason is because breach of confidence requires precisely the relationship that does not exist here Consequently, the developer must rely on the trade secret status itself for any protection. In India, the threshold question of whether a trade secret could survive a statutory right exercised by the data principal rather than by a competitor seeking to misappropriate the information has never arisen.
Contrastingly, in jurisdictions where the data protection statute itself creates room for trade secrets, a developer has something to point to. In this case, the absence of anything means that the disclosure occurs without any counterbalance. A data principal who is adamant or who acts in concert with others could compel a developer to disclose sufficient information about the sourcing of a dataset to eviscerate whatever confidentiality it possessed, without a defence on that basis.
That too has another, perverse effect. The Trade Secrets Law of India does not offer protection from the entire world, it only binds a specific party who received the information under an obligation of confidence. Therefore, the safest route for a developer is to stay clear of the DPDP Act altogether by using already-public data without any use of data licensed or collected from users. That rewards the sourcing method hardest to regulate, while penalizing the more transparent approach the Act was meant to encourage.
COMPARATIVE PERSPECTIVES
The EU’s GDPR takes this tension on directly. According to Article 15(4), the rights of individuals cannot be exercised if it affects adversely the rights of others, and Recital 63 specifically refers to Trade Secrets.[14] The CJEU does not treat this as a free pass, but as a genuine balancing act. In an Advocate General opinion in a credit scoring dispute, a company may be able to resist disclosure of a trade secret only on showing a real threat to it. Even then, it will not be able to refuse all disclosure.[15] The Trade Secrets Directive of the EU backs this up assigning trade secret their own definition and standing, outside of any contract.[16]
The US arrives at the same place differently. The Defend Trade Secrets Act establishes a federal claim that is distinct from an employment relationship.[17] The CCPA’s access provisions do not require disclosure of trade secrets, although the business must substantiate the validity of the claim.[18] Both systems do not regard trade secrecy as an automatic right. It is rather an interest companies can assert and defend against a request. Indian law lacks precisely that: a developer who can raise a named interest, and someone who is properly positioned to weigh it.
PROPOSALS FOR REFORM
The fix does not need to be sweeping. The Digital Personal Data Protection Rules could be amended to build a qualified trade secret exception into Section 11, closer to the EU’s proportionality model than the flatter US approach. Three things would make that work. First, let a fiduciary withhold or redact parts of an access summary where disclosure would expose a genuine trade secret, using the same factors Bombay Dyeing already applies, so the standard is homegrown rather than borrowed. Second, put the burden on the fiduciary to prove the claim before the Data Protection Board, the way the CCPA does, so the exception cannot swallow the right itself. Third, require disclosure of the category and general purpose of the data even where the exception applies, so Section 11 keeps its substance while only the genuinely sensitive detail stays shielded.
VII. CONCLUSION
The ANI case showed Indian courts are willing to take on hard questions about how AI gets built. However, it only answered the copyright half of the question and not the trade secret half. This opened the gateway to a much harder half. The DPDP Act’s transparency duties being indifferent to relationships at all, Indian trade secret protection relies entirely on relationships between parties. And nothing connects the two when a developer’s confidentiality interest clashes with a data principal’s right to know. This is not just a possibility. The law has a structural feature that shapes its workings. This shapes it in the negative in two critical ways. This is not a hypothetical concern, but a structural feature of the law as it stands, one that leaves genuine confidentiality under-protected while quietly rewarding the least accountable ways of gathering data.
According to the experiences of the EU and the US, a winner need not emerge due to this tension. A narrow exception based on the tests used by Indian courts should allow developers to protect only what really deserves protection and not allow trade secrecy to become a catch-all after the DPDP Act. Until that exception exists, the question in this article’s title stays open, and the answer depends entirely on who moves first: the developer who avoids the Act by sticking to public data, or the data principal who exercises a right the Act currently gives no developer any way to resist.
REFERENCE(S):
Cases
Ani Media Pvt. Ltd. v. Open AI OpCo LLC, CS (COMM) 1028 of 2024 (Del. H.C. July 24, 2026) (order declining interim injunction).
American Express Bank Ltd. v. Priya Puri, (2006) III L.L.J. 540 (Del.) (India).
Bombay Dyeing & Manufacturing Co. v. Mehar Karan Singh, (2010) 112 Bom. L.R. 375 (India).
Burlington Home Shopping Pvt. Ltd. v. Rajnish Chibber, 61 (1996) Delhi L.T. 6 (India).
Indian Farmers Fertiliser Cooperative Ltd. v. Collector of Central Excise, 2007 (116) E.C.C. 95 (India).
Niranjan Shankar Golikari v. Century Spinning & Manufacturing Co., AIR 1967 SC 1098 (India).
Case C-634/21, OQ v. Land Hessen, Opinion of Advocate General Pikamäe, ECLI:EU:C:2022:756 (Oct. 6, 2022).
Legislation
Digital Personal Data Protection Act, 2023, No. 22, Acts of Parliament, 2023 (India).
Digital Personal Data Protection Rules, 2025 (India).
Indian Contract Act, 1872, No. 9, Acts of Parliament, 1872 (India).
Information Technology Act, 2000, No. 21, Acts of Parliament, 2000 (India).
Copyright Act, 1957, No. 14, Acts of Parliament, 1957 (India).
Regulation (EU) 2016/679, 2016 O.J. (L 119) 1 (General Data Protection Regulation).
Council Directive 2016/943, 2016 O.J. (L 157) 1 (EU) (Trade Secrets Directive).
Defend Trade Secrets Act of 2016, 18 U.S.C. § 1836 (2018).
California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100, 1798.185 (West 2024).
Secondary Sources
Future of Privacy Forum, Five Ways in Which the DPDPA Could Shape the Development of AI in India (2024).
Anand & Anand, Trade Secret Protection in India: Law, Enforcement and Remedies (2026).
[1]Ani Media Pvt. Ltd. v. Open AI OpCo LLC, CS (COMM) 1028 of 2024 (Del. H.C. July 24, 2026) (order declining interim injunction).
[2] See Bombay Dyeing & Mfg. Co. v. Mehar Karan Singh, (2010) 112 Bom. L.R. 375 (India); Am. Express Bank Ltd. v. Priya Puri, (2006) III L.L.J. 540 (Del.) (India).
[3] Digital Personal Data Protection Act, 2023, § 11, No. 22, Acts of Parliament, 2023 (India).
[4]Indian Contract Act, 1872, § 27, No. 9, Acts of Parliament, 1872 (India); see also Niranjan Shankar Golikari v. Century Spinning & Mfg. Co., AIR 1967 SC 1098 (India).
[5]Burlington Home Shopping Pvt. Ltd. v. Rajnish Chibber, 61 (1996) Delhi L.T. 6 (India).
[6]Information Technology Act, 2000, § 72A, No. 21, Acts of Parliament, 2000 (India).
[7]Digital Personal Data Protection Act, 2023, § 12, No. 22, Acts of Parliament, 2023 (India).
[8]Id. § 8.
[9]Digital Personal Data Protection Act, 2023, § 17(2)(b), No. 22, Acts of Parliament, 2023 (India); Digital Personal Data Protection Rules, 2025, r. 15 (India).
[10]Digital Personal Data Protection Act, 2023, § 3(c)(ii), No. 22, Acts of Parliament, 2023 (India).
[11]Am. Express Bank Ltd. v. Priya Puri, (2006) III L.L.J. 540, ¶¶ 20-22 (Del.) (India).
[12]Bombay Dyeing & Mfg. Co. v. Mehar Karan Singh, (2010) 112 Bom. L.R. 375, ¶¶ 45-48 (India).
[13]Indian Farmers Fertiliser Coop. Ltd. v. Collector of Cent. Excise, 2007 (116) E.C.C. 95 (India).
[14] Regulation (EU) 2016/679, art. 15(4) & recital 63, 2016 O.J. (L 119) 1 (General Data Protection Regulation).
[15] Case C-634/21, OQ v. Land Hessen, Opinion of Advocate General Pikamäe, ECLI:EU:C:2022:756 (Oct. 6, 2022).
[16] Council Directive 2016/943, 2016 O.J. (L 157) 1 (EU) (Trade Secrets Directive).
[17] Defend Trade Secrets Act of 2016, 18 U.S.C. § 1836 (2018).
[18] Cal. Civ. Code §§ 1798.100(f), 1798.185(a)(3) (West 2024).
