Quick answerIndia has no single AI law. Businesses using or building AI are governed by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, which are coming into force in phases; the Information Technology Act, 2000, including section 79 safe harbour for intermediaries and the IT Rules, 2021; the Copyright Act, 1957 for ownership of content; and ordinary contract, consumer and criminal law for liability. Sound contracts, clear consent notices and documented safeguards are the main tools for managing these risks.
- Data law
- DPDP Act 2023, Rules 2025
- Platform law
- IT Act 2000, IT Rules 2021
- Regulator
- Data Protection Board, MeitY
- Max DPDP penalty
- Up to ₹250 crore per breach
Data protection under the DPDP Act and Rules
The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. The DPDP Rules, 2025, notified in November 2025, bring the Act into force in phases: the Data Protection Board provisions first, with most obligations of businesses following after a transition period. The exact dates for each obligation should be checked when planning compliance.
Once the obligations apply, a business acting as a Data Fiduciary must:
- Process personal data only for a lawful purpose, on consent that is free, specific, informed, unconditional and unambiguous, or for a legitimate use listed in section 7.
- Give a clear notice describing the data and purpose, and make withdrawing consent as easy as giving it.
- Take reasonable security safeguards and report personal data breaches to the Data Protection Board and to affected individuals.
- Obtain verifiable parental consent before processing a child's data, a child being anyone under 18.
- Respect the rights of Data Principals to access, correction, erasure and grievance redress, and erase data once the purpose is served.
- Bind processors, including AI and cloud vendors, by contract.
Entities notified as Significant Data Fiduciaries must also appoint a Data Protection Officer in India, conduct periodic impact assessments and audits. The Schedule to the Act provides penalties of up to ₹250 crore for a failure to take reasonable security safeguards, with other breaches attracting lower maximums. When fully in force, the Act also replaces section 43A of the IT Act and the 2011 rules on sensitive personal data.
Cross-border transfers and consent managers
The DPDP Act allows personal data to be transferred outside India except to countries the Central Government restricts by notification, so most cloud and AI services hosted abroad can be used, subject to any sector-specific localisation rules such as those of the RBI for payment data. The Act also creates registered Consent Managers, platforms through which individuals can give, manage and withdraw consent across businesses. Contracts with foreign AI vendors should still address where data is stored, who can access it and how it is returned or deleted.
Under section 79 of the Information Technology Act, an intermediary such as a marketplace, social platform, hosting provider or an AI service hosting user content is not liable for third-party content if it observes due diligence and acts on lawful takedown requirements. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 set out that due diligence: terms of use and privacy policy, a grievance officer, time-bound action on complaints and on court or government orders, and faster removal of non-consensual intimate content.
Significant social media intermediaries, those above the user threshold notified by the government, carry additional duties such as a resident chief compliance officer and monthly compliance reports. MeitY has also issued advisories and amendments on AI-generated and synthetic content, including labelling and preventing unlawful deepfakes; these are being updated frequently, so any platform deploying generative AI should review its current obligations before launch.
Contracts for building, buying and selling AI
Most AI risk is allocated in contracts. The clauses we focus on are:
| Clause | Question it answers |
|---|
| Input and training data | May the vendor use your data or prompts to train its models? Is it deleted afterwards? |
| Output ownership and licence | Who owns or may use what the system produces, and on what terms? |
| IP indemnity | Who pays if the model or its output infringes a third party's copyright or trademark? |
| Accuracy and human review | What performance is promised, and where must a human check results before use? |
| Data protection | Processor obligations, security, breach notice and cross-border transfer under the DPDP Act |
| Liability cap and exclusions | How much each side can lose, and which losses fall outside the cap |
| Confidentiality and exit | Protection of trade secrets and return of data when the contract ends |
For general commercial drafting, see our contracts practice.
Who owns AI-generated content?
The Copyright Act, 1957 protects original works of human authors. For computer-generated works, section 2(d)(vi) treats the person who causes the work to be created as the author, but whether and how this applies to output produced largely by generative AI is not settled in Indian law. Copyright in the underlying training data is also being tested in pending litigation, including a case against an AI developer before the Delhi High Court.
Until the position is clearer, businesses should ensure meaningful human creative contribution where ownership matters, keep records of how content was produced, take contractual rights from AI vendors, and register what can be registered. Brand names and logos should still go through trademark registration, and original human-authored material can be protected by copyright registration.
Liability when AI goes wrong
If an AI system gives wrong advice, makes a discriminatory decision or causes loss, liability is decided under existing law. A business deploying AI towards customers remains responsible under the Consumer Protection Act, 2019, including its product liability chapter, and under the contract with the customer. Negligence claims may arise where a business relied on AI without reasonable checks. Regulated sectors such as banking, insurance, securities and health have additional expectations from their regulators on model governance and fairness.
Misuse of AI, such as deepfakes used for impersonation, fraud, defamation or intimate images, can attract offences under the IT Act (sections 66C, 66D, 66E and 67) and the Bharatiya Nyaya Sanhita, 2023, including cheating by personation and defamation. Victims should preserve evidence and act quickly through the platform grievance mechanism, the cyber crime portal and, where needed, the courts. Our cyber crime lawyers handle these complaints.
A practical compliance plan
- Map what personal data you collect, why, where it is stored and which vendors and AI tools touch it.
- Rewrite consent notices and privacy policies in plain language, as the DPDP Rules require.
- Put data processing terms into every vendor and AI contract.
- Adopt an internal AI use policy: approved tools, prohibited inputs such as client confidential data, and human review rules.
- Prepare a breach response plan with named responsibilities and notification templates.
- Review user terms, grievance redress and takedown processes if you operate a platform.
Documents you need
Share what describes your product and data flows. Drafts and screenshots are fine.
- Short description of your product or AI use case
- Current privacy policy, terms of use and consent screens
- List of vendors, cloud and AI services used, with their contracts
- Data flow notes: what personal data you collect, where it is stored and who accesses it
- Customer contracts or SaaS templates you use
- Any notice, complaint or takedown request received
- Company incorporation details and authorised signatory
How we handle it for you
Understand the product
We review how your product or business uses data and AI, and which laws apply.
Gap assessment
We compare your documents and practices with the DPDP Act, IT Rules and sector requirements.
Draft the paperwork
Privacy notice, consent flows, vendor and customer contracts and internal AI policy.
Train and implement
We brief your team on consent, breach response and grievance handling.
Respond to issues
We act on regulator notices, takedown demands, breaches and disputes as they arise.
Why clients choose ProudLegal
Advocates who appear in courtYour matter is drafted and argued by enrolled advocates, not call-centre staff.
Company and tax filings in-houseCompany secretaries and tax professionals handle registrations and returns.
Fees agreed in writingYou receive a written fee quote before any work begins.
Updates on WhatsApp and emailEvery hearing date, filing and document is shared as it happens.
Please note: this page explains the law and procedure in general terms as on 30 October 2026. Fees, limits and timelines change, and the facts of each case matter, so take advice on your own papers before acting.
Frequently asked questions
Is there an AI law in India?
Not a single dedicated statute. AI use is regulated through the DPDP Act, the IT Act and IT Rules, the Copyright Act, consumer law and sector regulators' guidelines.
When does the DPDP Act apply to my business?
The DPDP Rules 2025 bring it into force in phases, with most business obligations applying after a transition period. Preparation should start now, because consents and contracts take time to change.
What is the penalty under the DPDP Act?
The Data Protection Board can impose penalties up to the limits in the Schedule, the highest being ₹250 crore for failing to take reasonable security safeguards.
Who owns content created with ChatGPT or other AI tools?
It is not settled in Indian law. The tool's terms, the degree of human contribution and section 2(d)(vi) of the Copyright Act all matter, so important content should involve real human authorship.
Can I use customer data to train an AI model?
Only if the processing is covered by valid consent or a legitimate use under the DPDP Act and your contracts allow it. Many existing consents do not cover model training.
What is safe harbour under section 79?
It protects intermediaries from liability for third-party content if they follow due diligence under the IT Rules and act on lawful takedown orders.
What can I do if someone makes a deepfake of me?
Preserve the links and screenshots, report to the platform and the cyber crime portal, and consider a police complaint and court action for removal and damages.
Do startups need a Data Protection Officer?
Only Significant Data Fiduciaries notified by the government must appoint one, but every Data Fiduciary must provide a contact person for grievances.
