DPDP Compliance Checklist: Using AI Tools With Customer Data
A plain DPDP checklist for businesses using AI tools with customer data: who is responsible, consent notices, vendor contracts, breach steps and penalties.
If your staff paste customer names, phone numbers or order details into an AI tool, India’s Digital Personal Data Protection (DPDP) law applies to that use. Your business is the “Data Fiduciary” and stays responsible for the data, and the AI tool provider usually acts as a “Data Processor” that may only process it under a valid contract. The DPDP Rules were notified on 14 November 2025 with an 18-month phased rollout, so now is the time to set simple rules: which tools are approved, what data may go into them, how consent is collected on your forms, and what you do if data leaks.
This checklist is written for small and mid-sized businesses. It is general information, not legal advice, and a lawyer should review your final policies.
Last reviewed: 7 November 2026. Based on the DPDP Act, 2023, the government’s explainer on the DPDP Rules, 2025, and CERT-In’s directions; links at the end.
What does the DPDP law require, in short?
Parliament enacted the Digital Personal Data Protection Act on 11 August 2023. The government notified the DPDP Rules, 2025 on 14 November 2025, and its explainer says the Rules give the Act full effect, with an eighteen-month period for phased compliance. By our count, that runs to around May 2027, so check the official notifications for the date each obligation applies to you.
The government’s explainer lists seven principles behind the law: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. Most of the checklist below is these principles turned into daily habits.
| Requirement | What it means for a business |
|---|---|
| Consent notice | A separate, clear notice explaining the specific purpose for which personal data is collected and used |
| Contact point | Clear contact details for questions about personal data, such as a designated officer |
| People’s rights | Respond within ninety days to requests to access, correct, update or erase data |
| Children | Verifiable consent from a parent or guardian, except for some essential services such as healthcare, education or real-time safety |
| Security | Reasonable security safeguards to prevent a personal data breach, including for processing done by your vendors |
| Breaches | Inform the Data Protection Board and each affected person; tell individuals without delay, in plain language, what happened, the likely impact and the steps taken |
| Erasure | Erase data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it, and make your processors erase it too |
Where do AI tools fit in?
The Act does not mention AI by name, and it does not need to. When an employee pastes personal data into a chat assistant, a transcription service or an AI feature inside your CRM, that tool is processing personal data on your behalf.
Section 8 of the Act is the part that matters most for AI use:
- Section 8(1): the Data Fiduciary is responsible for complying with the Act for any processing it does “or on its behalf by a Data Processor”, whatever any agreement says.
- Section 8(2): a Data Fiduciary may use a Data Processor only under a valid contract.
- Section 8(5): the Data Fiduciary must protect personal data with reasonable security safeguards, including data handled by its processor.
- Section 8(7): when data must be erased, the Data Fiduciary must also make its processor erase it.
So “the AI company handles it” is not a defence under the Act. If a staff member pastes a customer list into a free consumer tool whose terms you have never read, your business is still the one responsible.
The checklist
Work through these in order. The first four cost almost nothing.
1. List where personal data lives
Website forms, WhatsApp, email, your CRM, spreadsheets, call recordings, and any AI tools staff already use. You cannot protect what you have not listed.
2. Approve a short list of AI tools
For each tool, check the terms: is there a business agreement, are your inputs used to train the provider’s models, can that be switched off, and how is data deleted? Approve the tools that pass and say so in writing.
3. Write a one-page AI use rule for staff
Say what may and may not go into AI tools. A workable starting point: no customer phone numbers, addresses, ID numbers, health or financial details in any tool that is not on the approved list. Remove names where the task does not need them.
4. Fix the consent notice on your forms
Each form that collects personal data should say, clearly and separately, what the data is for. If you plan to use AI tools on that data, for example to summarise enquiries, say so in plain words.
5. Name a contact for data questions
Publish an email address and a named role. Make sure requests to that address are answered within ninety days.
6. Set retention and deletion
Decide how long you keep enquiries, orders and recordings, then delete on schedule, including copies held in AI tools and other vendors’ systems.
7. Prepare for a breach before one happens
Write down who decides, who informs customers and the Data Protection Board, and which template message you will use. Separately, CERT-In’s 2022 directions require service providers, intermediaries, data centres, companies and government bodies to report specified cyber incidents to CERT-In within 6 hours of noticing them, and to keep logs of their systems for a rolling 180 days within India. Check with your lawyer which of these apply to you.
8. Check how you handle children’s data
If your customers include children, for example in education or gaming, plan for verifiable parental consent.
9. Review vendor contracts
For every processor, including AI tools, hosting and CRM providers, confirm there is a valid contract that covers security, breach notice and deletion.
10. Train once, remind often
A ten-minute walkthrough of the AI rule at a team meeting does more than a long policy nobody reads. Repeat it when you approve a new tool.
A one-page AI use rule you can adapt
Many small businesses never write this down, so staff guess. Here is sample wording to adapt for your team. Replace the bracketed parts, and have your lawyer check the final version.
- Approved AI tools: [list the tools and accounts, for example the business plan of a named assistant and the AI features in our CRM]. Use only these for work, and only through company accounts.
- Never put into any AI tool: customer or employee phone numbers, addresses, ID numbers such as Aadhaar or PAN, bank or card details, health information, passwords or login details.
- Before pasting customer messages or records, remove names and contact details unless the task cannot be done without them.
- Do not upload full customer lists or database exports to any AI tool without written approval from [role].
- Check AI output before it reaches a customer. You are responsible for what is sent.
- If you think personal data went somewhere it should not have, tell [role] the same day.
Keep it to one page and pin it where people work. Review it whenever you add a new tool, and walk new joiners through it in their first week.
What are the penalties?
According to the government’s explainer, the highest penalty, up to ₹250 crore, applies to failing to maintain reasonable security safeguards. Failing to notify the Board or affected individuals of a breach, and breaking obligations relating to children, can each attract penalties of up to ₹200 crore. Other violations by a Data Fiduciary may attract up to ₹50 crore.
These are maximums set by the Act’s schedule. For a small business, the useful takeaway is that the steps that avoid the largest penalty, security safeguards, are also the ones that protect your customers.
Common mistakes with AI and customer data
- Pasting a whole customer export into an AI tool to “find trends”, when an anonymised summary would do.
- Using personal accounts on free AI tools for work, so the business has no contract and no control.
- Recording calls and sending them to a transcription service without telling customers.
- Keeping every enquiry forever “in case it is useful”, which breaks storage limitation.
- Building a website form that collects more fields than the purpose needs.
Several of these overlap with security basics. If your app or site was built quickly with AI coding tools, our guide on vibe coding security risks covers access rules and secret keys. AI that runs on the phone itself can also reduce how much data you send out, as we explained in on-device AI in mobile apps. For AI-made images and video, the separate rules are in our guide to the IT Rules 2026 on AI content labelling, and for AI agents that act on customer data, see what AI agents can really do.
Getting your systems ready
Most of the checklist is policy and habit. The parts that need technical work are usually consent wording and storage on forms, deletion on schedule, and keeping customer data in one controlled place instead of scattered spreadsheets. Our CRM development and custom web development pages explain how that work is usually scoped. You can see how we describe our own handling of data in our privacy policy.
Frequently asked questions
Does the DPDP Act apply to AI tools?
Yes, when they process personal data for your business. The Act does not name AI, but section 8 makes the Data Fiduciary responsible for processing done on its behalf by a Data Processor, which includes an AI tool provider handling your customers’ data.
When do the DPDP Rules come into force?
The Rules were notified on 14 November 2025, and the government’s explainer describes an eighteen-month period for phased compliance. Check the official notifications for when each obligation applies to your business.
Can employees use free AI tools with customer data?
It is risky. Without a business agreement, you may not know how the data is stored, used for training or deleted, and your business remains responsible under the DPDP Act. Approve specific tools and keep personal data out of the rest.
What is the penalty for a data breach under the DPDP Act?
Failing to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore, and failing to notify the Board or affected people of a breach up to ₹200 crore, according to the government’s explainer. These are maximum amounts.
How fast must a business respond to a data request?
Within ninety days, according to the government’s explainer on the DPDP Rules. People can ask to access, correct, update or erase their personal data, and can nominate someone to act on their behalf.
