Context

• While AI offers opportunities to improve productivity and innovation, its dependence on personal data raises serious concerns about privacy and individual autonomy.
• In 2017, the Supreme Court recognised the right to privacy as a fundamental right under Article 21 in the Justice K. S. Puttaswamy v. Union of India judgment.
• However, India's existing legal framework faces challenges in addressing emerging AI-related risks.
• The Digital Personal Data Protection (DPDP) Act, 2023, requires further strengthening to balance technological progress with constitutional rights.

Privacy Coverage

• Evolution of India's Data Protection Framework
  • Before the DPDP Act, the primary framework governing personal information was the Information Technology Act, 2000, along with its 2011 Rules.
  • These provisions regulated sensitive personal data, including financial information, medical records, sexual orientation and biometric details.
  • Unauthorised disclosure attracted a maximum punishment of three years' imprisonment or a ₹5 lakh fine.
  • However, several categories, including caste, religion, political affiliations, browsing history and social media activities, lacked adequate protection.
  • Publicly available information and data scraped from social media were also largely outside its coverage.
• Limitations of the DPDP Act
  • The DPDP Act, 2023, and Rules notified in November 2025, establish a broader data protection framework.
  • However, the Act does not distinguish adequately between sensitive and non-sensitive personal data.
  • Passwords, biometric information and health records receive the same broad classification as names, marital status and shopping preferences.
  • Another major concern is the exclusion of certain publicly available information.
  • Technology companies such as Meta, Google and Amazon collect extensive user data, which can be utilised to train AI models.
  • Although publicly accessible, such information can become highly sensitive when aggregated and analysed.
  • Therefore, public accessibility should not imply unrestricted permission for commercial exploitation.
  • The framework must recognise that combining seemingly harmless information can expose individuals to significant privacy risks.

Training AI on Personal Data

• Risks of Data Memorisation and Extraction
  • AI models can sometimes memorise and reproduce information contained in their training datasets.
  • Research has demonstrated that carefully designed queries can extract personal information from supposedly anonymised datasets and help identify individuals.
  • AI can also infer sensitive attributes, including emotional conditions, behavioural patterns, mobility and personal relationships, from publicly available information.
  • Consequently, anonymisation alone cannot guarantee privacy because AI can establish connections between seemingly unrelated datasets.
  • This creates new challenges for conventional data protection
• Absence of Effective Consent Mechanisms
  • The DPDP Act does not comprehensively address the use of personal information for AI model training.
  • Its phased implementation delays several substantive provisions until May 2027, leaving individuals with limited protection during the transition.
  • Even after implementation, individuals may have no effective right to object to AI training using certain publicly available personal data.
  • In contrast, Meta provides users in the European Union with an opt-out mechanism for certain uses of their information in AI training.
• Right to be Forgotten and Research Exemption
  • The DPDP Act recognises the right to erasure, but its application to information generated through AI-based inference remains unclear.
  • The Act also exempts certain processing activities undertaken for research, archival and statistical purposes.
  • Since companies may describe AI training as research to improve their services, uncertainty surrounding these exemptions could create opportunities to avoid data protection obligations.

The Way Forward

• Strengthening the DPDP Framework
  • India can address these shortcomings through targeted amendments, appropriate rules and judicial interpretation. Important measures include:
    • Extend DPDP protections to personal data used for AI training.
    • Introduce a meaningful right to object to the use of personal information in AI development.
    • Regulate publicly scraped data and protect information generated through AI-based inference.
    • Establish a separate sensitive personal data category with stricter processing requirements.
    • Strengthen the right to erasure by requiring organisations to disclose other entities holding individuals' data.
    • Clarify whether AI training qualifies for the research exemption and establish safeguards against misuse.
• Balancing Innovation and Constitutional Rights
  • Excessive regulation could discourage investment and restrict research, while inadequate safeguards could facilitate the exploitation of personal information.
  • India's large and diverse population offers considerable opportunities for AI development across businesses, Micro, Small and Medium Enterprises (MSMEs) and non-profit organisations.
  • Banning personal data usage or its international transfer could also weaken
  • AI systems' ability to represent India's linguistic and demographic diversity, potentially increasing algorithmic bias and discrimination.
  • The objective should therefore be proportionate regulation that promotes innovation while ensuring transparency, accountability and individual control over personal information.

Conclusion

• Although the DPDP Act, 2023, establishes an important foundation, gaps concerning sensitive information, publicly available data, AI training and inferred personal attributes require urgent attention.
• India must develop a rights-based and innovation-friendly AI governance framework that protects individuals without unnecessarily restricting technological advancement.
• Ultimately, technological progress must not undermine constitutional freedoms.
• Delaying privacy safeguards could weaken individual autonomy and public trust in an increasingly data-driven society.