DATA PROTECTION IN THE AGE OF ARTIFICIAL INTELLIGENCE: EXAMINING CONSENT, PRIVACY AND ACCOUNTABILITY UNDER INDIA’S EMERGING LEGAL FRAMEWORK

ABSTRACT 

AI has changed many things, especially the way our personal information is collected, stored, and used. AI can collect and process a huge amount of personal data very quickly. Because of this, an important question arises in India: Is our personal data safe in this AI era? This also raises the question of whether India’s data protection laws are enough for the use of AI. India has the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. It is also important to see whether these laws provide proper consent and accountability. If AI misuses personal data and violates someone’s privacy, who will be responsible? 

The article begins with the landmark case of K.S. Puttaswamy v. Union of India, in which the Supreme Court recognised the right to privacy as a fundamental right under Article 21. It then discusses the development of data protection laws in India, from the Information Technology Act, 2000 to the present DPDP framework. 

The article also considers the implementation of the new framework, including how its rules and provisions are being implemented in different phases. 

The article then focuses on the major problems related to AI, especially consent, privacy, transparency, and accountability. It asks whether a person genuinely gives consent for AI to use their personal data, what happens if personal information is leaked or misused, and whether people can actually understand how AI systems make decisions or process their data. It also looks at who will be responsible if someone’s privacy is violated through AI. 

Finally, the article briefly compares the Indian framework with the GDPR to understand how India and the EU approach personal data protection. It also considers whether India can learn from the GDPR to improve its own data protection framework. Overall, the article argues that the DPDP framework is an important step, but AI is more complex, so concepts like consent and accountability may need further developments. 

1. INTRODUCTION 

Personal data has become very important in today’s digital world, and artificial intelligence (AI) is one of the main reasons for this. Unlike traditional software, AI does not always work on fixed instructions. It learns patterns from the data given to it, and using more data can help it perform better. Because of this, companies, online platforms and even government bodies collect different types of personal data, such as browsing history, location, financial details and biometric information. Facial recognition, recommendation systems, credit scoring, chatbots and voice assistants are some common examples of AI systems that use personal data. 

The use of such a large amount of data has both benefits and risks. AI can be very useful in areas like healthcare, where it can help with faster diagnosis. It can also make government services more efficient and provide more personalised services. However, it can also create serious privacy problems. AI can collect large amounts of information, combine data from different sources and use it in ways that an ordinary person may not fully understand. For example, a person may give their phone number to a food delivery app just to place an order. But they may not know that this information, when combined with other data, could be used to understand their habits and behaviour. 

This issue is particularly important in India because a large number of people use smartphones and the internet every day. People regularly use different apps and online services that may use AI, often without knowing exactly how their personal data is being collected or used. India has also started developing a new data protection system. The Digital Personal Data Protection Act, 2023 has been passed, the Digital Personal Data Protection Rules, 2025 have been notified, and the Data Protection Board of India has been established. However, the main provisions of the Act are being brought into force in stages. This means that India is still developing its data protection system while AI is already growing very quickly. 

The main question of this article is simple: Can ideas like consent, privacy and accountability really protect people when AI can collect, combine and even create information about them? To examine this question, this article looks at the constitutional right to privacy in India, the Digital Personal Data Protection Act, 2023 and its Rules, and the problems that arise when these laws are applied to AI systems. The article mainly focuses on Indian law. The European Union’s General Data Protection Regulation (GDPR) is discussed only for comparison, wherever it helps in understanding India’s approach to data protection. 

2. RESEARCH QUESTIONS 

• Does India’s current data protection framework provide enough protection against the privacy risks caused by AI processing of personal data? 
• Can consent under the DPDP Act, 2023 really be considered meaningful when people do not fully understand how AI systems use and process their personal data? 
• Under the current framework, who is responsible when personal data is misused by AI — the data fiduciary, data processor, AI developer, or someone else? 
• What changes are needed in India’s laws and regulations to better deal with AI-driven processing of personal data?

3. RESEARCH OBJECTIVES 

• To examine the constitutional basis of the right to privacy in India and its relevance to AI-related data processing. 
• To trace the evolution of India’s data protection framework from the Information Technology Act, 2000 to the DPDP Act, 2023 and DPDP Rules, 2025. 
• To critically analyse the consent mechanism under the DPDP framework in the context of AI systems. 
• To identify where responsibility and accountability may break down when multiple parties are involved in an AI-driven data processing chain. 
• To compare India’s approach briefly with the GDPR and to suggest realistic improvements. 

4. RESEARCH METHODOLOGY 

This article follows the doctrinal method of legal research. The research is mainly based on primary sources such as the Constitution of India, the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, relevant judgments of the Supreme Court, government notifications, and official materials issued by the Ministry of Electronics and Information Technology (MeitY). It also uses secondary sources such as academic articles, commentaries, law firm articles and analyses, and reliable reports. These sources have been used to understand the legal framework and different views related to AI and data protection. No interviews, surveys or fieldwork have been conducted for this research. The article is entirely based on books, library materials and reliable legal resources available online. 

5. UNDERSTANDING DATA PROTECTION IN THE AGE OF AI 

Before going further, it is important to understand some basic terms. Personal data means information related to an identified or identifiable person. It can include simple information like a name or phone number, but it can also include an IP address, device ID, or online behaviour that can be connected to a person. Data processing means almost every activity done with personal data, such as collecting, storing, using, sharing, or deleting it. 

AI systems use personal data in a different way from traditional software. Traditional software usually works according to rules given by a programmer. However, AI and machine learning systems are trained using large amounts of data and find patterns from that data. These patterns are then used to make predictions or decisions. This makes AI useful, but at the same time, it also creates difficulties for laws that were mainly made for simpler forms of data processing.

Some important practices related to AI are profiling, automated decision-making, data inference, and biometric technologies. Profiling means using personal data to understand a person’s habits, choices, or possible behaviour. Automated decision-making means when an algorithm makes an important decision about a person, such as approving a loan or selecting someone for a job. Data inference means when AI finds or predicts information that a person never directly provided. 

Facial recognition is another concern because biometric data is directly connected to a person’s physical identity and cannot simply be changed if it is compromised. 

Another important issue is how AI systems are trained. AI models are often trained using large datasets collected from the internet. Sometimes, it is not clear whether the people whose information is included in these datasets actually gave consent for their data to be used. For example, a person may post a photograph or comment online for one purpose without expecting it to later become part of an AI training dataset. 

Therefore, AI does not only increase the amount of personal data being processed; it also changes the nature of privacy risks. The problem is not limited to data being stolen or directly misused. AI can also combine and analyse different pieces of information and reveal something about a person that they never intended to share. 

6. CONSTITUTIONAL RIGHT TO PRIVACY IN INDIA 

Any discussion about data protection in India should begin with the Constitution. For a long time, there was a question about whether the right to privacy was actually a fundamental right. Article 21 of the Constitution protects the right to life and personal liberty. However, earlier cases like M.P. Sharma v. Satish Chandra and Kharak Singh v. State of Uttar Pradesh created doubt about whether Article 21 also included the right to privacy. 

This issue was finally settled in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). A nine-judge bench of the Supreme Court unanimously recognised the right to privacy as a fundamental right under Article 21. The Court also connected privacy with the freedoms under Part III of the Constitution. Although the case was related to the Aadhaar scheme, the Court discussed privacy in a broader way and connected it with human dignity and personal autonomy. The Court also overruled the earlier decisions in M.P. Sharma and Kharak Singh. It held that any restriction on the right to privacy must satisfy the requirements of legality, legitimate aim and proportionality. 

Two parts of this judgment are especially important for this article. First, the Court recognised informational privacy, which means that a person should have control over information related to them. This is important for data protection because excessive or unauthorised collection and use of personal data can also become a constitutional concern. Second, the Court connected privacy with dignity and autonomy. So, privacy is not only about keeping personal information secret; it is also about allowing a person to make choices about their own life without unnecessary interference. 

This becomes even more important with the increasing use of AI. AI can be used for profiling, automated decision-making and large-scale surveillance through facial recognition. These practices can affect a person’s privacy and autonomy. Therefore, the principles laid down in Puttaswamy can provide an important constitutional basis for examining AI-related processing of personal data, especially when the State is involved. However, the DPDP Act does not use exactly the same language. 

7. EVOLUTION OF INDIA’S DATA PROTECTION FRAMEWORK 

India’s data protection laws have developed slowly over time. It is useful to understand the older system first and then look at the new framework that India is bringing into force. 

The Information Technology Act, 2000 was the starting point. The main purpose of this Act was to give legal recognition to electronic records and digital signatures. It was not mainly made for protecting personal data. Data protection was dealt with through Section 43A. Under this section, a company could be made to pay compensation if it failed to follow reasonable security practices while handling sensitive personal data and this caused wrongful loss or gain. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 also provided some protection. These Rules included sensitive data such as passwords, financial information, health information and biometric data, and provided basic requirements related to consent and security. 

However, this older system had many limitations. It mainly applied to companies and did not cover the government in the same way. It also focused more on compensation instead of giving people a complete set of rights and creating a proper regulatory system. It also did not deal with problems like profiling and automated decision-making because these issues were not as common when the rules were made. 

The Digital Personal Data Protection Act, 2023 came after a long process, including the Justice B.N. Srikrishna Committee report and earlier versions of the data protection bill. The Act received Presidential assent on 11 August 2023 and became India’s first comprehensive data protection law covering different sectors. The Act uses terms like “Data Fiduciary,” “Data Processor,” and “Data Principal.” A Data Fiduciary is the person or organisation that decides why and how personal data will be processed. A Data Processor processes the data on behalf of the Data Fiduciary, while the Data Principal is the individual whose personal data is involved. 

Sections 4 to 10 explain the main duties of a Data Fiduciary. These include having a lawful purpose for processing data, giving notice, taking valid consent, allowing consent to be withdrawn, keeping data secure and accurate, and providing special protection for children’s data. Section 10 also provides additional duties for entities known as “Significant Data Fiduciaries.” Sections 11 to 15 provide rights to Data Principals, such as access to information, correction and erasure of data, grievance redressal, and the right to nominate another person in certain situations. Section 16 deals with transfer of personal data outside India, while Section 17 provides certain exemptions. Sections 18 to 26 deal with the Data Protection Board of India, and Section 33 provides penalties for violations.

The Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology on 13 November 2025. These Rules provide more details about how the Act will work in practice. They cover areas such as notices, parental consent for children’s data, Consent Managers and procedures before the Data Protection Board. 

It is important to understand which parts of the DPDP framework are actually in force as of September 2026. The Act is being implemented in different stages. From 13 November 2025, only some provisions came into force, mainly those relating to definitions, the Data Protection Board and certain other provisions. The Board has been established and has started working on its digital system. The provisions relating to Consent Managers are scheduled to come into force in November 2026. However, most of the main provisions, including those dealing with consent, notice, rights of Data Principals and penalties under Section 33, are scheduled to come into force from 13 May 2027. Until then, the older SPDI Rules, 2011 continue to apply to the extent that they have not been repealed. 

Therefore, as of September 2026, India is still in a transition period. The new law and its regulator are already in place, but most of the main duties and rights under the DPDP Act are not yet legally enforceable. This is important to keep in mind when discussing India’s current data protection framework. 

8. CONSENT IN THE AI ERA 

Consent is one of the most important parts of the DPDP Act. Section 4 says that personal data can be processed based on consent or a specified legitimate use. Section 5 requires a clear notice before or along with taking consent. Section 6 says that valid consent should be free, specific, informed, unconditional and unambiguous. It should also be given through a clear action, and withdrawing consent should be as easy as giving it. On paper, these rules provide good protection for users. 

However, the main problem is whether this consent is actually meaningful in real life, especially when AI is involved. When a person opens a new app, they usually see a privacy notice and an “agree” button. Most people simply click agree without reading the whole notice. This does not always mean that people are careless. Privacy notices are often very long and use legal or technical language, which makes them difficult to understand. The problem becomes bigger when AI is used to study behaviour, predict personal information, or use the same data to train future AI models. For example, a person may agree to their data being used to “improve services” without knowing that their conversations or photographs could also be used to train an AI system. 

This is also connected with the idea of “consent fatigue.” It means that people see so many consent notices that they start accepting them automatically. Sometimes, if they do not give consent, they may not be able to use the service properly. In such cases, consent may become more like a formality than a real choice. The DPDP Act says that consent should be “free,” but it is still difficult to know how this will work in practice when many digital services depend on users agreeing to data processing.

Another problem with AI is the use of data for a different purpose later. AI systems often need large datasets for training, and these datasets may contain information collected for different reasons. Once different data is combined or used for training, it can become very difficult for a person to know whether their data is included. It can also be difficult to remove their contribution later. Section 6(4) says that a Data Fiduciary must stop processing personal data when consent is withdrawn. However, this is easier with normal stored data than with an AI model that has already learned from the data. We cannot simply delete a person’s contribution from a trained AI model in the same way we can delete a person’s information from a database. 

There is also a difference in the power between individuals and large technology companies. People may have very little choice when important services like messaging, banking, transport and shopping depend on large digital platforms. Section 7 recognises that consent is not required for every type of processing and includes situations such as following the law, medical emergencies and certain employment purposes. This is useful, but it does not completely solve the problem of whether consent is truly free and informed when it is required. 

This does not mean that consent should be removed. Consent is still an important way of protecting a person’s choice and privacy. However, in the AI environment, consent alone may not be enough. It should be supported by better transparency, proper supervision of high-risk AI processing and privacy protections that do not depend completely on the user understanding every setting. 

9. PRIVACY CHALLENGES CREATED BY AI 

When AI is used to process personal data, many privacy problems can come up. 

The first problem is the huge amount of data that AI systems collect. Big companies and online platforms collect information from millions of people. If a data breach happens, a large amount of information can be leaked at once. The problem is not only that basic information like names or phone numbers may be leaked. AI can also create information about people by studying their data, such as their habits, interests and behaviour. This information can sometimes be more personal than the information they originally shared. 

Another problem is profiling and automated decision-making. AI can study a person and then give them a score or make a decision about them. For example, AI can be used in advertising or while checking whether someone should get a loan. The person may not know why the AI made that decision because they cannot see how the system works. Facial recognition and biometric data are also a concern. Biometric information is connected to a person’s identity. If a password is leaked, we can change it, but we cannot change our face or fingerprints in the same way. 

There is also a risk of re-identification. Sometimes personal data is changed or removed so that it looks anonymous before it is shared. But AI can combine this information with other information available online and may be able to find out who the person actually is. So, simply calling data “anonymous” does not always mean that a person cannot be identified again.

AI can also guess information about a person that they never directly shared. This is called data inference. For example, by studying someone’s online activity, AI may try to guess their health condition, religious beliefs or other sensitive information. The person may never have actually told anyone this information, but AI can still make such predictions from different patterns in their data. 

Another major issue is data scraping for AI training. AI systems need large amounts of data for training. Information that people posted online years ago, such as photos, comments or posts, can sometimes be collected and used for training AI. A person may have shared something online for one reason, but they may never have expected it to be used to train an AI system years later. This raises questions about whether they actually gave consent for this use. 

Cross-border data transfer creates another problem. Section 16 of the DPDP Act allows personal data to be transferred outside India, subject to restrictions that the Central Government may provide. Once the data leaves India, it may become harder for a person or Indian authorities to know how that data is being used or protected in another country. 

Children can face even more privacy risks. They may not understand privacy notices properly or may not know what can happen when AI uses their personal information. Because of this, Section 9 of the DPDP Act provides special rules for children’s data. It requires verifiable parental consent and also restricts behavioural monitoring and targeted advertising directed at children. 

Generative AI has also created some new privacy problems. It can create realistic photos, videos, audio or text using information about a person. This means that someone’s information or identity can be misused even without anyone directly stealing data from a database. The problem can happen because of what the AI itself creates. 

Therefore, AI does not create only one privacy problem. It can make many existing problems bigger at the same time. The main concerns are the huge amount of data collected, the difficulty in knowing how AI uses that data, and the fact that we may not know how personal data will be used in the future. 

10. ACCOUNTABILITY AND RESPONSIBILITY 

The DPDP Act mainly puts the responsibility on the Data Fiduciary because it is the person or organisation that decides why and how personal data will be used. Section 8 requires the Data Fiduciary to make sure that the personal data is accurate, especially when it may be used to make decisions about a person. It also has to take reasonable security measures to protect the data from a breach. If it fails to do this, it can be held responsible. Section 10 also gives some extra duties to Significant Data Fiduciaries. These duties include appointing a Data Protection Officer in India, an independent data auditor and carrying out regular data protection impact assessments. 

This system is easier to understand when only one organisation is collecting and using someone’s data. However, AI makes the situation more complicated. Many different parties can be involved in an AI system. One company may collect the data, another company may develop the AI model, another business may use that model in its own service, and a third-party processor may handle the data. So, if something goes wrong, it can become difficult to decide who should be responsible. For example, if an AI system gives a biased or harmful result because the training data was wrong, it may not be clear whether the responsibility belongs to the company that collected the data, the company that trained the AI, or the company that is using it. 

The DPDP Act allows a Data Fiduciary to use a Data Processor through a valid contract. However, the Data Fiduciary still remains responsible for following the law even when another organisation processes the data for it. This prevents a company from simply saying that another company was handling the data and therefore it is not responsible. But AI can make this system difficult because an AI model may be developed by one company using one dataset and later be sold or licensed to another company for a completely different purpose. 

The Data Protection Board of India is also an important part of the accountability system. It was established from 13 November 2025 and is expected to play a major role in enforcing the DPDP Act when the relevant provisions come into force. Under Section 33, the Board can impose financial penalties after an inquiry. While deciding the penalty, it can consider things such as how serious the violation was, how long it continued and whether the organisation took steps to reduce the harm. The Schedule of the Act provides for high penalties, including up to ₹250 crore for failing to take reasonable security safeguards. Section 32 also allows the Board to accept a voluntary undertaking from an organisation, where the organisation agrees to take certain steps to fix the problem. 

Even with these provisions, AI creates a difficult question: who should actually be held responsible when something goes wrong? To find the answer, it may be necessary to understand how the AI system works, how the training data was collected and how the final decision was made. This can be difficult because AI systems can be technically complicated and their working may not always be easy to understand. 

At present, the DPDP Act does not specifically provide detailed rules for AI risk assessments or algorithmic audits. This does not mean that India’s accountability system is useless. The Data Protection Board can still investigate violations and impose penalties under the Act. However, when many different companies are involved in developing and using an AI system, the present framework may not always clearly show who is responsible. More detailed rules, guidance from the Board or future changes in the law may therefore be needed to deal with these problems. 

11. TRANSPARENCY AND EXPLAINABILITY 

Another problem with AI is that people often do not know what is happening to their personal data. Rights like consent, access to data and correction are helpful only when a person knows how their data is being used. This becomes difficult because many AI systems work like a “black box.” 

Many AI systems, especially deep learning systems, learn from a large amount of data. They find patterns in the data and then use those patterns to give results or make decisions. The problem is that these systems are not always easy for people to understand. Sometimes, even the people who developed the AI may not be able to clearly explain why it gave a particular result. 

This creates a problem with Section 5 of the DPDP Act, which requires the Data Fiduciary to give notice about the personal data being used and the purpose of using it. For example, a notice may say that the data will be used “to personalise your experience.” But a person may still not know what the AI is actually doing with their data or how it is making a particular decision. 

This also affects consent. If people do not understand how their data is being used, it becomes difficult to say that they have given proper and informed consent. The same problem can affect the rights of Data Principals under Chapter III of the Act. A person may know what personal data is being collected, but they may not know what the AI has understood or predicted about them from that data. 

This is why explainability is important. In simple words, it means that a person should be able to get some basic explanation about how AI has used their data or affected a decision about them. The DPDP Act does not give explainability as a separate right, unlike some protections provided under the GDPR. 

It may not always be possible to explain every technical detail of an AI system. Some AI systems are very complicated, and even their developers may not fully understand every step. But people should at least be told what data is being used, why it is being used, and whether AI is making any decision about them. This basic information can make the rights given under the DPDP Act more useful in the AI era. 

12. RIGHTS OF DATA PRINCIPALS 

Chapter III of the DPDP Act gives certain rights to the Data Principal, that is, the person whose personal data is being used. These rights are not unlimited, but they give people more control over their personal information. Section 11 gives a person the right to get information about the personal data being processed, how it is being processed, and the Data Fiduciaries or Data Processors with whom their data has been shared. Section 12 gives the right to correct, complete, update or erase personal data, depending on the purpose for which the data is being used. Section 13 gives a person the right to complain and ask for their problem to be addressed. Section 14 also allows a person to nominate someone who can exercise these rights on their behalf in case of their death or incapacity. At the same time, Section 15 also puts some duties on the Data Principal, such as not making false or unnecessary complaints. 

These rights are an improvement compared to the older Section 43A of the IT Act, where the main remedy was compensation for certain failures in protecting sensitive personal data. However, AI makes some of these rights harder to use in practice. For example, correcting or deleting information from a normal database is quite simple. But if that information has already been used to train an AI model, removing its effect can be much more difficult. The AI may have already learned patterns from that data. In some cases, the model may need to be trained again to properly remove its influence.

There is also a problem with the right to get information under Section 11. A person may be able to find out what personal data is being processed, but they may not know what the AI has inferred or predicted about them. For example, AI may study someone’s online activity and make a prediction about their interests or behaviour. This information was not directly given by the person, but it was created by the AI from their data. 

Grievance redressal under Section 13 gives people a way to complain when something goes wrong. The Data Protection Board can also become involved according to the Act. But there is one basic problem: a person first needs to know that something has gone wrong. If someone does not know that an AI system has made a decision about them, they may not even know that they need to complain or challenge it. 

Therefore, the rights given under the DPDP Act are definitely a step forward, but AI makes their practical use more difficult. These rights need to be supported by better transparency and clearer rules about what happens when personal data has already been used to train an AI model. Otherwise, a right may exist on paper but may be difficult for a person to actually use. 

13. INTERNATIONAL COMPARISON WITH GDPR 

The General Data Protection Regulation (GDPR) of the European Union came into force on 25 May 2018. It is considered one of the important data protection laws in the world, and many countries, including India, can be compared with it. A short comparison can help us understand how India’s approach is different from the European approach. 

Article 5 of the GDPR provides several principles for processing personal data. These include lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and security of data. It also follows the principle of accountability, which means that organisations should be able to show that they are following the rules. The DPDP Act also covers some of these ideas. For example, Section 8(1) says that processing should be limited to what is necessary for the purpose for which the data is being used, while Section 8(3) deals with keeping data accurate. However, the DPDP Act does not bring all these principles together in one place like Article 5 of the GDPR does. 

Another important difference is automated decision-making. Article 22 of the GDPR provides protection against certain decisions made only through automated processing, including profiling, when those decisions can have a serious effect on a person. In some situations, people can also ask for human intervention and an explanation. The DPDP Act does not have a separate provision specifically dealing with automated decision-making. This can be a concern because AI is increasingly being used for things like loans, hiring, insurance and other important decisions. 

There is also a difference in cross-border data transfers. The GDPR has stricter rules when personal data is transferred outside the European Economic Area. It generally requires certain safeguards, such as an adequacy decision or standard contractual clauses. On the other hand, Section 16 of the DPDP Act follows a different approach. It allows data to be transferred to other countries unless the Central Government restricts a particular country through notification. This approach may make it easier for businesses to operate internationally, but it may provide less control over personal data after it leaves India. 

The two laws also have different penalty systems. Under the GDPR, fines can go up to €20 million or 4% of the organisation’s worldwide annual turnover, whichever is higher. Under the DPDP Act, the Schedule provides fixed monetary penalties, which can go up to ₹250 crore for certain violations. Therefore, the way penalties are calculated is quite different under the two laws. 

India does not necessarily need to copy the GDPR completely. However, India can learn from some parts of it. For example, having clearer rules about automated decision-making and putting important data protection principles together more clearly could make the DPDP framework stronger for dealing with AI. At the same time, India’s digital economy is still developing, so following every GDPR requirement may not be practical. India’s decision to have a different system for cross-border transfers is also a policy choice. The main question is whether this balance between business growth and protection of people’s personal data is enough in the long run. 

14. GAPS AND CHALLENGES IN INDIA’S FRAMEWORK 

From the discussion above, some important gaps can be seen in India’s data protection framework. 

The first and most immediate problem is timing. As discussed earlier, most of the important provisions of the DPDP Act are not yet in force as of September 2026. They will come into force in different stages up to May 2027. Until then, people still mainly depend on the older SPDI Rules, 2011, which provide less protection. This is a concern because AI is already collecting and processing people’s data on a large scale. 

The second problem is meaningful consent. The DPDP Act depends a lot on consent and privacy notices. But, as discussed earlier, people may simply click “I agree” without understanding what will happen to their data. The Act does not have specific rules for AI that require companies to explain AI-related data processing in a simpler or clearer way. 

Another problem is lack of public awareness. Giving people rights under the law is not enough if they do not know that these rights exist. Even after the DPDP Act becomes fully applicable, ordinary users will need to understand their rights and know how to use them. At present, there is no strong requirement in the framework for educating people about data protection on such a large scale. 

There is also no separate provision dealing specifically with automated decision-making or a general requirement for AI-specific risk assessments. This is different from the GDPR, which has specific protection related to certain automated decisions under Article 22. There is also uncertainty about how the rights to access, correct and erase data will work when someone’s personal data has already been used to train an AI model. Deleting information from a normal database is easier, but doing the same after an AI model has learned from that data can be much harder. 

Another important concern is the exemptions under Section 17. Some types of processing connected with law enforcement and government activities can be exempted from certain requirements of the Act. This can become especially important when government agencies use AI for things like surveillance or profiling. Such uses can affect people’s privacy, so proper checks and oversight are important. 

Cross-border transfer of data is another area where the protection is relatively limited. Under the DPDP Act, data can generally be transferred outside India unless the Central Government restricts a particular country. While this makes the system easier for businesses, it also means that once data leaves India, there may be less control over how it is protected in another country. 

The protection of children’s data is also an important issue. Section 9 provides special protection for children, including requirements related to parental consent. However, putting this into practice may be difficult because children use online and AI-based platforms regularly, and it can be difficult to properly verify whether consent has actually been given by a parent. 

At the same time, it would not be fair to say that the DPDP Act has no value. It is a major improvement over the older system under Section 43A of the IT Act, which mainly focused on compensation for certain data protection failures. The creation of the Data Protection Board of India is also an important step because India now has a dedicated body with powers to investigate violations and impose penalties. 

Therefore, these gaps do not mean that the whole DPDP framework is weak or useless. The framework is still being developed and implemented. However, it also shows that AI-specific problems were not the main focus when the law was created. These issues may need to be dealt with through future rules, guidance from the Data Protection Board or changes to the law itself. 

15. SUGGESTIONS 

Based on the problems discussed above, some changes can be made to improve India’s data protection framework. 

First, privacy notices under Section 5 should be easier for normal people to understand. Instead of giving users one long notice full of legal language, companies can give a short and simple explanation first and then provide more detailed information for people who want to know more. The DPDP Rules, 2025 have already taken some steps in this direction through Rule 3. This can be made more useful when AI is being used for profiling or making automated decisions. 

Second, India could consider making a specific rule for automated decision-making. People should at least know when an important decision about them has mainly been made by an AI system. India could learn from Article 22 of the GDPR but create rules that suit India’s own needs.

Third, organisations should follow privacy by design and collect only the data that is actually needed. Companies should not collect huge amounts of personal data first and decide later how they want to use it. This is especially important for AI because AI systems often need large amounts of data for training. 

Fourth, the security rules under Section 8 should also be applied carefully to AI training data. AI systems can use very large datasets, which can become attractive targets for hackers. If such datasets are leaked, the damage can be very serious. 

Fifth, India could introduce some kind of AI-specific impact assessment for high-risk AI systems. This could look at problems such as profiling, bias, re-identification and other privacy risks before the system is used. This would be similar to the data protection impact assessment already required in certain cases, but it would focus more on the risks created by AI. 

Sixth, the law should make responsibility clearer when many companies are involved in an AI system. If one company collects the data, another develops the AI and another uses it, an ordinary person may not know whom to contact when something goes wrong. The law should make this responsibility clearer. 

Seventh, there should be more public awareness about data protection. Government bodies like MeitY, the Data Protection Board and civil society organisations can help people understand their rights and how they can use them. Having rights in the law is not enough if people do not know about them. 

Eighth, children’s data needs special attention. Children are spending more time on online platforms and are also exposed to AI-generated content. Therefore, the rules under Section 9 should be properly implemented, and better ways of checking parental consent may be needed. 

Finally, AI is changing very quickly. Because of this, India’s data protection laws should not be treated as something that can be made once and then left unchanged for many years. The framework should be reviewed from time to time so that new AI-related privacy problems can be dealt with before they become bigger issues. 

Overall, India does not need to completely change its data protection system. It needs to keep improving it and make it more suitable for the way AI is developing. 

16. CONCLUSION 

Coming back to the main question of this article, whether India’s data protection framework is enough to protect people’s privacy and provide meaningful consent and accountability in the age of AI, the answer is that India has made a good start, but there is still a lot to improve. 

India now has a strong constitutional basis for the right to privacy because of the Puttaswamy judgment. The DPDP Act, 2023 is also an important step forward because it provides much more protection than the old system under the IT Act. The DPDP Rules, 2025 have also provided more details about how the Act will work, and the creation of the Data Protection Board of India gives India a proper body to deal with violations. These are all important steps and show that India is moving towards a better data protection system. 

However, AI has made some of these rules difficult to apply in real life. Consent, transparency and accountability are not always easy when AI is involved. People may agree to long privacy notices without really understanding how their data will be used. AI systems can also be difficult to understand, which makes it harder for people to know how decisions are being made about them. Accountability can also become confusing when different companies are involved in collecting data, developing AI and using the final system. 

Another important issue is that most of the main provisions of the DPDP Act are still being introduced in stages and will not be fully in force until May 2027. At the same time, AI is already being used and personal data is already being processed on a large scale. This creates a gap between the law and the technology. 

Still, this does not mean that India’s framework has failed. Most of the problems discussed in this article can be improved through better rules, guidance from the Data Protection Board and, where necessary, changes to the Act. India does not need to completely start again. It needs to keep improving the system as new AI-related problems appear. 

Therefore, the DPDP framework should be seen as a strong starting point, not a complete solution. Its real test will come when the main provisions are fully implemented and have to deal with AI technologies that are changing very quickly. India will need to keep updating its approach so that the law can protect people’s privacy even as AI continues to develop.

BIBLIOGRAPHY 

Primary Sources 

• Constitution of India, art. 21. 
• Information Technology Act, 2000, s. 43A. 
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. 
• Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). 
• Digital Personal Data Protection Rules, 2025, notified vide G.S.R. 846(E), 13 November 2025, Ministry of Electronics and Information Technology. 
• Ministry of Electronics and Information Technology, Government of India, Press Note on notification of the Digital Personal Data Protection Rules, 2025 (November 2025). 
• Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1. 
• M.P. Sharma v. Satish Chandra, AIR 1954 SC 300 (referred to and overruled in Puttaswamy). 
• Kharak Singh v. State of Uttar Pradesh, AIR 1963 SC 1295 (referred to and overruled in Puttaswamy). 
• Regulation (EU) 2016/679 (General Data Protection Regulation), arts. 5 and 22. Secondary Sources 
• Fox Mandal, “India’s New Digital Privacy Law: The DPDP Act and Rules Explained” (foxmandal.in). 
• Bhatt & Joshi Associates, “Navigating the Digital Frontier: India’s Personal Data Protection Act, 2023 – Part 3” (bhattandjoshiassociates.com). 
• K&K, “Penalties and Adjudication under the DPDP Act, 2023: Powers of the Data Protection Board and Quantum of Fines” (ksandk.com, 14 October 2025). 
• K&K, “The Data Protection Board of India under the DPDP Act, 2023: Structure, Composition, and Adjudicatory Process” (ksandk.com). 
• MediaNama, “DPDP Bill 2023: Government Exemptions” (medianama.com, August 2023).
• Law Review, Maharashtra National Law University, Mumbai, “India’s Data Protection Odyssey: A Look into the Shortcomings of the DPDP Act, 2023” 

(lawreview.mnlumumbai.edu.in). 

• Taxmann, “Cross-Border Data Transfers under the DPDP Act 2023” (taxmann.com, 4 May 2025). 
• Lexology / De Penning & De Penning, “Navigating India’s Digital Personal Data Protection Act: Insights from the 2025 Draft Rules” (10 December 2025). 
• European Commission, “Principles Relating to Processing of Personal Data” (commission.europa.eu). 
• Lagioia, F. and Sartor, G., “The Right to Explanation in the GDPR” (University of Bologna, Alma AI). 
• Note: A small number of general-reference and law-firm web sources were used only to verify dates, section numbers and the current commencement status of the DPDP Act/Rules, and should be cross-checked by the author against the official Gazette text on the India Code portal (www.indiacode.nic.in) before final submission.