India’s AI push gathers pace, data protection test in 2027

Three years after Parliament passed the DPDP Act, the rules that will shape Indian AI are largely in place. Full compliance is due by May 2027

India’s artificial intelligence sector is expanding under a new legal framework built around the Digital Personal Data Protection Act, 2023, amended IT Rules on deepfakes and a national AI mission backed by public money. The full test of this framework will come in May 2027, when every obligation under the data protection law takes effect.

AI in daily life

Artificial intelligence refers to computer systems that learn from large volumes of data to predict outcomes, classify information and generate text, images or speech. In India, the technology already checks UPI payments for fraud, sends crop advisories to farmers, translates government services into regional languages and supports doctors in reading scans. Generative AI tools became widely available after 2022 and have since spread into offices, classrooms and social media feeds.

Every such system depends on data. A model that recommends loans learns from past borrowers. A chatbot learns from text written by millions of people. The laws governing how personal data is collected and used, therefore, decide how far Indian AI can develop and how much protection citizens receive along the way.

IT Act, 2000 remains the base law

The Information Technology Act, 2000, was drafted to give legal recognition to electronic records and digital signatures during the early years of e-commerce. Its privacy provisions were limited to Section 43A and the 2011 rules on sensitive personal data, which asked companies to follow reasonable security practices without spelling out consent or individual rights. Section 79 protects online platforms from liability for user content if they follow prescribed due diligence.

The Act did not anticipate machine learning, voice cloning or deepfakes. The government has used rules framed under it to address AI risks. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, were notified by MeitY on February 10, 2026 and came into force on February 20, 2026. The amendment brings synthetically generated information, including deepfakes and AI-altered audio and video, within the due diligence duties of platforms.

Such content must now carry a prominent label and permanent provenance metadata that users cannot remove. Takedown windows have been cut to as little as three hours after a valid notice. A proposal in the October 2025 draft for a watermark covering 10 per cent of the surface area of synthetic content was dropped in favour of a qualitative standard.

Digital rights groups have raised concerns. They warn that short timelines and mandatory labelling, particularly where automated detection tools are used, may chill lawful speech and lead platforms to remove more content than the law requires.

DPDP Act rolls out in phases

The Supreme Court declared privacy a fundamental right in the Puttaswamy judgment of 2017. A dedicated data protection law followed after several drafts. The DPDP Act received Presidential assent on August 11, 2023. MeitY notified the Digital Personal Data Protection Rules in November 2025, with an eighteen-month period for phased compliance.

Implementation is being carried out in three stages. The Data Protection Board of India was constituted in November 2025 with four members. The consent manager framework begins in November 2026. All remaining obligations, including consent systems, privacy notices, rights of individuals and breach protocols, apply from May 2027.

Penalties can reach `250 crore per violation. The Rules require verifiable parental consent before the data of any user under 18 is processed. A personal data breach must be reported to the Board within 72 hours, and affected users must be informed.

For AI developers, the law carries both obligations and openings. Personal data must be processed with consent, for a specified purpose, and deleted once that purpose is served. Legal experts note this creates difficulty for companies training large models, since removing one person’s data from a trained system is technically hard. At the same time, the Act does not apply to personal data that individuals have themselves made publicly available, and it provides exemptions for research, archiving and statistical purposes.

Industry bodies have welcomed this flexibility as practical. Privacy advocates say the public data exemption is broad and may allow large-scale scraping of social media profiles for model training without the knowledge of users.

National AI policy

India’s first formal AI policy was the National Strategy for Artificial Intelligence, released by NITI Aayog in 2018 under the title #AIforAll. It named health, agriculture, education, smart cities and mobility as priority areas. The strategy set a direction but carried no dedicated budget.

Funding arrived in March 2024, when the Union Cabinet approved the IndiaAI Mission with an outlay of `10,372 crore. The Mission has onboarded more than 38,000 GPUs through a subsidised national compute facility, with access offered to startups and researchers at around one dollar per GPU-hour. It also funds the development of indigenous foundation models trained on Indian languages and data.

Skilling forms a second track. Under IndiaAI and FutureSkills programmes, 500 PhD scholars, 5,000 postgraduates and 8,000 undergraduates are receiving support. Some 570 AI Data Labs and 27 IndiaAI labs are operating across states, many of them in smaller cities.

On regulation, MeitY released the India AI Governance Guidelines on November 5, 2025. The guidelines rest on seven principles described as sutras. They propose an inter-ministerial AI Governance Group, a Technology and Policy Expert Committee and an IndiaAI Safety Institute to test systems and advise policymakers. The guidelines state that India will examine gaps in existing laws and amend them where needed, and will not immediately draft a standalone AI Act on the European model.

In January 2026, the Office of the Principal Scientific Adviser released a white paper on a techno-legal approach, which calls for safeguards such as watermarking and bias detection to be built into the design of AI systems. India hosted the India AI Impact Summit in New Delhi on February 19 and 20, 2026.

Progress and gaps

Policy analysts describe India’s approach as infrastructure-first. The European Union began with risk regulation under its AI Act, while India began with compute, capital and skills and has kept regulation light and sector-driven.

Several gaps remain. The four-member Data Protection Board must oversee a country of 1.4 billion people and millions of businesses that handle personal data. The proposed Digital India Act, intended to replace the IT Act, has not yet been introduced in Parliament. Liability for harm caused by AI decisions in lending, recruitment, policing and healthcare is not addressed in any single law. Sectoral regulators, including the Reserve Bank of India and SEBI, are issuing separate AI guidance, which experts warn could produce uneven standards.

Compute capacity has grown fast by Indian standards, though it remains small beside the clusters operated by American and Chinese technology firms. Researchers also point to a shortage of high-quality datasets in Indian languages, which limits the accuracy of local models.

Compliance experts expect the Data Protection Board to begin active enforcement once the May 2027 deadline passes. Companies developing AI products in India have eight months to revise consent systems, privacy notices and data handling practices. How the Board treats its first cases involving AI training data is likely to shape investment decisions in the sector for years.

Compliance experts expect the Data Protection Board to begin active enforcement once the May 2027 deadline passes. Companies developing AI products in India have eight months to revise consent systems, privacy notices and data handling practices. How the Board treats its first cases involving AI training data is likely to shape investment decisions in the sector for years

The writer is a former Vice Chancellor of Jamia Hamdard, New Delhi; Views presented are personal.