DPDPA 2023 § 6Data Protection Board of India / MeitY
Digital Personal Data Protection Act, 2023
Mandatory clear notice and unconditional, itemized consent before processing personal data for AI training or inference.
Gazetted Statutory Text:
"Every request for consent shall be preceded or accompanied by a notice... informing the Data Principal about the personal data to be collected and the specific purpose for which it will be processed, manner of exercising rights and making complaints."
Penalty:Up to ₹50 Crore under Schedule for non-compliance with data fiduciary duties.
AI Implementation Rule: AI models scraping, ingesting, or running inferences on personal data of Indian citizens without prior purpose-specific consent violate Section 6.
DPDPA 2023 § 8Data Protection Board of India
Digital Personal Data Protection Act, 2023
Data Fiduciary obligations: Ensure accuracy of personal data used in decisions, implement technical security, and erase data on consent withdrawal.
Gazetted Statutory Text:
"A Data Fiduciary shall... ensure that personal data processed by or on behalf of the Data Fiduciary is complete, accurate and consistent, if such personal data is likely to be used to make a decision that affects the Data Principal."
Penalty:Up to ₹250 Crore under Schedule for failure to take reasonable security safeguards to prevent personal data breaches.
AI Implementation Rule: Directly mandates that AI systems making decisions affecting individuals (scoring, hiring, credit) must not rely on stale or inaccurate personal data.
DPDPA 2023 § 9Data Protection Board of India
Digital Personal Data Protection Act, 2023
Strict prohibition on processing child data without verifiable parental consent; absolute ban on tracking, behavioral monitoring, or targeted advertising directed at children.
Gazetted Statutory Text:
"A Data Fiduciary shall, before processing any personal data of a child... obtain verifiable consent of the parent... A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children."
Penalty:Up to ₹200 Crore under Schedule for breach in observance of duties regarding child data.
AI Implementation Rule: Massive trap for Ed-Tech AI! Adaptive learning algorithms that track micro-behaviors, clicks, response latency, or gaze of students (<18) without verifiable parental consent are strictly prohibited.
DPDPA 2023 § 10Data Protection Board of India
Digital Personal Data Protection Act, 2023
Significant Data Fiduciaries (SDFs) must appoint an India-based DPO, conduct periodic Data Protection Impact Assessments (DPIA), and undergo independent audits.
Gazetted Statutory Text:
"The Significant Data Fiduciary shall appoint a Data Protection Officer based in India... appoint an independent data auditor to carry out data audit... and undertake periodic Data Protection Impact Assessment."
Penalty:Up to ₹150 Crore for failure to fulfill additional obligations of Significant Data Fiduciary.
AI Implementation Rule: High-scale foundation model providers and large platform AI aggregators classified as SDFs must conduct auditable algorithmic impact assessments.
DPDPA 2023 § 13Data Protection Board of India
Digital Personal Data Protection Act, 2023
Right to Grievance Redressal: Every entity must provide an easily accessible mechanism for data principals to resolve complaints before escalating to the Board.
Gazetted Statutory Text:
"A Data Principal shall have the right of grievance redressal provided by a Data Fiduciary or Consent Manager... The Data Fiduciary shall respond to grievances within the prescribed period."
Penalty:Failure to provide grievance mechanism triggers direct inquiry by Data Protection Board.
AI Implementation Rule: Companies deploying AI systems that process Indian personal data must publish a dedicated complaint channel where users can challenge automated outcomes.
CPA 2019 § 2(47)Central Consumer Protection Authority (CCPA)
Consumer Protection Act, 2019
Prohibition of Unfair Trade Practices and deficiency of service. Misleading claims about AI capability or deceptive automated scoring are directly actionable.
Gazetted Statutory Text:
"Unfair trade practice means a trade practice which, for the purpose of promoting the sale, use or supply of any goods or for the provision of any service, adopts any unfair method or unfair or deceptive practice..."
Penalty:CCPA powers under Sec 20-21: Directions for recall, refund, penalties up to ₹10 Lakh (₹50 Lakh for subsequent violations), and criminal liability under Sec 89.
AI Implementation Rule: Selling an AI tool with exaggerated claims (e.g. "100% accurate cheating detector" or "bias-free grading") that harms consumers triggers CCPA penalties.
CPA E-Commerce Rules, Rule 5(4)Ministry of Consumer Affairs / CCPA
Consumer Protection (E-Commerce) Rules, 2020
Mandatory appointment of a resident Grievance Officer, acknowledgment of consumer complaint within 48 hours, and resolution within one month.
Gazetted Statutory Text:
"Every e-commerce entity shall establish an adequate grievance redressal mechanism... appoint a grievance officer for consumer grievance redressal and display prominently the name, designation and contact details of such officer on its platform."
Penalty:Deemed violation of Consumer Protection Act 2019 with immediate enforcement notice by CCPA.
AI Implementation Rule: CRITICAL: Any commercial digital platform using AI to price, rank, admit, or evaluate consumers MUST offer this grievance pathway. Automated rejection without human recourse is a deficiency in service.
IT Amendment Rules 2026 (Synthetic Media)Ministry of Electronics & Information Technology (MeitY)
Information Technology (Intermediary Guidelines) Amendment Rules, 2026
Mandatory digital watermarking, tamper-evident metadata, and prominent disclosure for all synthetically generated or modified audio/visual media.
Gazetted Statutory Text:
"Intermediaries and deployers generating or facilitating synthetic media shall embed permanent, machine-readable provenance indicators and provide clear, conspicuous labels to users indicating the content was generated using artificial intelligence."
Penalty:Loss of safe-harbor protection under Section 79 of IT Act 2000; criminal prosecution under Sections 66D, 67, 67A.
AI Implementation Rule: The ONLY binding AI-specific labeling mandate in India today. Generative AI tools creating images, voice, video, or deepfakes must watermark and disclose.
RBI FREE-AI & Lending GuidelinesReserve Bank of India (RBI)
RBI Master Directions on Digital Lending & FREE-AI Framework
Regulated financial entities cannot outsource core underwriting to black-box models; mandatory board-approved AI governance and human review on credit denial.
Gazetted Statutory Text:
"Any algorithmic credit assessment must have documented explainability, auditable data trails, and provide the borrower a transparent pathway to contest adverse algorithmic decisions with human review."
Penalty:RBI regulatory penalties, supervisory suspension of digital lending operations, and monetary fines under Banking Regulation Act.
AI Implementation Rule: Fintechs deploying loan underwriting or credit risk scoring AI cannot treat models as black boxes; customer appeal with human override is legally mandatory.
CERT-In 6-Hour Incident ReportingIndian Computer Emergency Response Team (CERT-In)
CERT-In Cyber Security Directions under IT Act § 70B
Mandatory reporting of cybersecurity incidents within 6 hours of noticing, maintaining system logs for 180 days within Indian jurisdiction.
Gazetted Statutory Text:
"Any service provider, intermediary, data centre, body corporate and government organisation shall mandatorily report cybersecurity incidents to CERT-In within 6 hours of noticing such incidents."
Penalty:Imprisonment up to one year or fine up to ₹1 Lakh or both under Section 70B(7) of IT Act.
AI Implementation Rule: Applies to adversarial attacks on AI systems (model inversion, prompt injection breaches, data exfiltration from vector stores) impacting corporate infrastructure.