Statutory Mandate Matrix: In Force · Enacted Pending · Voluntary
A three-tier comparative mapping separating what Indian law punishes for non-compliance today (CPA 2019, IT Rules 2026, CERT-In, RBI) from provisions that are enacted but not yet commenced (DPDPA 2023 substantive provisions, commencing May 2027) and what the Government of India advises as national voluntary benchmarks (MeitY's 7 Sutras).
In Force — Enforceable Today
Mandatory under Indian parliamentary enactments & gazetted rules. These provisions are in force right now — non-compliance leads to statutory prosecution, civil compensation, or penalties.
Prohibition of Unfair Trade Practices and deficiency of service. Misleading claims about AI capability or deceptive automated scoring are directly actionable.
Mandatory appointment of a resident Grievance Officer, acknowledgment of consumer complaint within 48 hours, and resolution within one month.
Mandatory digital watermarking, tamper-evident metadata, and prominent disclosure for all synthetically generated or modified audio/visual media.
Regulated financial entities cannot outsource core underwriting to black-box models; mandatory board-approved AI governance and human review on credit denial.
Mandatory reporting of cybersecurity incidents within 6 hours of noticing, maintaining system logs for 180 days within Indian jurisdiction.
Enacted — Not Yet In Force
These DPDPA provisions have been enacted by Parliament (Act No. 22 of 2023) and rules notified, but their substantive obligations have not yet commenced. Stage 3 commencement is scheduled for May 13, 2027. Penalty exposure begins on that date — prepare now.
Mandatory clear notice and unconditional, itemized consent before processing personal data for AI training or inference.
Data Fiduciary obligations: Ensure accuracy of personal data used in decisions, implement technical security, and erase data on consent withdrawal.
Strict prohibition on processing child data without verifiable parental consent; absolute ban on tracking, behavioral monitoring, or targeted advertising directed at children.
Significant Data Fiduciaries (SDFs) must appoint an India-based DPO, conduct periodic Data Protection Impact Assessments (DPIA), and undergo independent audits.
Right to Grievance Redressal: Every entity must provide an easily accessible mechanism for data principals to resolve complaints before escalating to the Board.
MeitY 7 National Sutras
Published in November 2025 by the Ministry of Electronics and IT. Carry no statutory fines in isolation, but serve as procurement requirements and GCC audit baselines.
AI systems must inspire verifiable public confidence through deterministic data provenance, uncompromised integrity, and zero deceptive practices.
AI must augment Indian citizens and workers rather than disenfranchise or replace them without safety nets. Dignity and human rights supersede automated efficiency.
India rejects heavy ex-ante statutory bans (unlike EU AI Act tiering) to ensure homegrown startups, researchers, and GCCs can experiment safely without preemptive red tape.
Elimination of algorithmic bias across India’s unique social fabric: caste, religion, gender, geographical disparities, and linguistic diversity (22 scheduled languages).
Clear allocation of responsibility across the AI lifecycle (developer vs deployer vs integrator). An algorithm can never be held liable; a designated legal entity always is.
Right to explanation. Black-box outputs without human-interpretable reasoning violate fundamental transparency, especially when denying benefits or rights.
AI systems must withstand adversarial manipulation (prompt injection, jailbreaking, data poisoning), fail safely without cascading damage, and minimize carbon footprints.