{"id":5117,"date":"2026-11-14T10:00:00","date_gmt":"2026-11-14T04:30:00","guid":{"rendered":"https:\/\/www.ogeninfo.com\/blog\/?p=5117"},"modified":"2026-11-10T13:48:46","modified_gmt":"2026-11-10T08:18:46","slug":"dpdp-compliance-checklist-ai-tools","status":"publish","type":"post","link":"https:\/\/www.ogeninfo.com\/blog\/dpdp-compliance-checklist-ai-tools\/","title":{"rendered":"DPDP Compliance Checklist: Using AI Tools With Customer Data"},"content":{"rendered":"
If your staff paste customer names, phone numbers or order details into an AI tool, India’s Digital Personal Data Protection (DPDP) law applies to that use. Your business is the “Data Fiduciary” and stays responsible for the data, and the AI tool provider usually acts as a “Data Processor” that may only process it under a valid contract. The DPDP Rules were notified on 14 November 2025 with an 18-month phased rollout, so now is the time to set simple rules: which tools are approved, what data may go into them, how consent is collected on your forms, and what you do if data leaks.<\/p>\n
This checklist is written for small and mid-sized businesses. It is general information, not legal advice, and a lawyer should review your final policies.<\/p>\n
Last reviewed: 7 November 2026. Based on the DPDP Act, 2023, the government’s explainer on the DPDP Rules, 2025, and CERT-In’s directions; links at the end.<\/em><\/p>\n
What does the DPDP law require, in short?<\/h2>\n
Parliament enacted the Digital Personal Data Protection Act on 11 August 2023. The government notified the DPDP Rules, 2025 on 14 November 2025, and its explainer says the Rules give the Act full effect, with an eighteen-month period for phased compliance. By our count, that runs to around May 2027, so check the official notifications for the date each obligation applies to you.<\/p>\n
The government’s explainer lists seven principles behind the law: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. Most of the checklist below is these principles turned into daily habits.<\/p>\n
\n\n
\n
Requirement<\/th>\n
What it means for a business<\/th>\n<\/tr>\n<\/thead>\n
\n
\n
Consent notice<\/td>\n
A separate, clear notice explaining the specific purpose for which personal data is collected and used<\/td>\n<\/tr>\n
\n
Contact point<\/td>\n
Clear contact details for questions about personal data, such as a designated officer<\/td>\n<\/tr>\n
\n
People’s rights<\/td>\n
Respond within ninety days to requests to access, correct, update or erase data<\/td>\n<\/tr>\n
\n
Children<\/td>\n
Verifiable consent from a parent or guardian, except for some essential services such as healthcare, education or real-time safety<\/td>\n<\/tr>\n
\n
Security<\/td>\n
Reasonable security safeguards to prevent a personal data breach, including for processing done by your vendors<\/td>\n<\/tr>\n
\n
Breaches<\/td>\n
Inform the Data Protection Board and each affected person; tell individuals without delay, in plain language, what happened, the likely impact and the steps taken<\/td>\n<\/tr>\n
\n
Erasure<\/td>\n
Erase data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it, and make your processors erase it too<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Where do AI tools fit in?<\/h2>\n
The Act does not mention AI by name, and it does not need to. When an employee pastes personal data into a chat assistant, a transcription service or an AI feature inside your CRM, that tool is processing personal data on your behalf.<\/p>\nWho is responsible when personal data goes into an AI tool. Based on section 8 of the DPDP Act.<\/figcaption><\/figure>\n
Section 8 of the Act is the part that matters most for AI use:<\/p>\n
\n
Section 8(1): the Data Fiduciary is responsible for complying with the Act for any processing it does “or on its behalf by a Data Processor”, whatever any agreement says.<\/li>\n
Section 8(2): a Data Fiduciary may use a Data Processor only under a valid contract.<\/li>\n
Section 8(5): the Data Fiduciary must protect personal data with reasonable security safeguards, including data handled by its processor.<\/li>\n
Section 8(7): when data must be erased, the Data Fiduciary must also make its processor erase it.<\/li>\n<\/ul>\n
So “the AI company handles it” is not a defence under the Act. If a staff member pastes a customer list into a free consumer tool whose terms you have never read, your business is still the one responsible.<\/p>\n
The checklist<\/h2>\n
Work through these in order. The first four cost almost nothing.<\/p>\n
1. List where personal data lives<\/h3>\n
Website forms, WhatsApp, email, your CRM, spreadsheets, call recordings, and any AI tools staff already use. You cannot protect what you have not listed.<\/p>\n
2. Approve a short list of AI tools<\/h3>\n
For each tool, check the terms: is there a business agreement, are your inputs used to train the provider’s models, can that be switched off, and how is data deleted? Approve the tools that pass and say so in writing.<\/p>\n
3. Write a one-page AI use rule for staff<\/h3>\n
Say what may and may not go into AI tools. A workable starting point: no customer phone numbers, addresses, ID numbers, health or financial details in any tool that is not on the approved list. Remove names where the task does not need them.<\/p>\n
4. Fix the consent notice on your forms<\/h3>\n
Each form that collects personal data should say, clearly and separately, what the data is for. If you plan to use AI tools on that data, for example to summarise enquiries, say so in plain words.<\/p>\n
5. Name a contact for data questions<\/h3>\n
Publish an email address and a named role. Make sure requests to that address are answered within ninety days.<\/p>\n
6. Set retention and deletion<\/h3>\n
Decide how long you keep enquiries, orders and recordings, then delete on schedule, including copies held in AI tools and other vendors’ systems.<\/p>\n
7. Prepare for a breach before one happens<\/h3>\n
Write down who decides, who informs customers and the Data Protection Board, and which template message you will use. Separately, CERT-In’s 2022 directions require service providers, intermediaries, data centres, companies and government bodies to report specified cyber incidents to CERT-In within 6 hours of noticing them, and to keep logs of their systems for a rolling 180 days within India. Check with your lawyer which of these apply to you.<\/p>\n
8. Check how you handle children’s data<\/h3>\n
If your customers include children, for example in education or gaming, plan for verifiable parental consent.<\/p>\n
9. Review vendor contracts<\/h3>\n
For every processor, including AI tools, hosting and CRM providers, confirm there is a valid contract that covers security, breach notice and deletion.<\/p>\n
10. Train once, remind often<\/h3>\n
A ten-minute walkthrough of the AI rule at a team meeting does more than a long policy nobody reads. Repeat it when you approve a new tool.<\/p>\nThe ten steps at a glance. The first four cost almost nothing.<\/figcaption><\/figure>\n
A one-page AI use rule you can adapt<\/h2>\n
Many small businesses never write this down, so staff guess. Here is sample wording to adapt for your team. Replace the bracketed parts, and have your lawyer check the final version.<\/p>\n
\n
Approved AI tools: [list the tools and accounts, for example the business plan of a named assistant and the AI features in our CRM]. Use only these for work, and only through company accounts.<\/li>\n
Never put into any AI tool: customer or employee phone numbers, addresses, ID numbers such as Aadhaar or PAN, bank or card details, health information, passwords or login details.<\/li>\n
Before pasting customer messages or records, remove names and contact details unless the task cannot be done without them.<\/li>\n
Do not upload full customer lists or database exports to any AI tool without written approval from [role].<\/li>\n
Check AI output before it reaches a customer. You are responsible for what is sent.<\/li>\n
If you think personal data went somewhere it should not have, tell [role] the same day.<\/li>\n<\/ol>\n
Keep it to one page and pin it where people work. Review it whenever you add a new tool, and walk new joiners through it in their first week.<\/p>\n
What are the penalties?<\/h2>\n
According to the government’s explainer, the highest penalty, up to \u20b9250 crore, applies to failing to maintain reasonable security safeguards. Failing to notify the Board or affected individuals of a breach, and breaking obligations relating to children, can each attract penalties of up to \u20b9200 crore. Other violations by a Data Fiduciary may attract up to \u20b950 crore.<\/p>\n
These are maximums set by the Act’s schedule. For a small business, the useful takeaway is that the steps that avoid the largest penalty, security safeguards, are also the ones that protect your customers.<\/p>\n
Common mistakes with AI and customer data<\/h2>\n
\n
Pasting a whole customer export into an AI tool to “find trends”, when an anonymised summary would do.<\/li>\n
Using personal accounts on free AI tools for work, so the business has no contract and no control.<\/li>\n
Recording calls and sending them to a transcription service without telling customers.<\/li>\n
Keeping every enquiry forever “in case it is useful”, which breaks storage limitation.<\/li>\n
Building a website form that collects more fields than the purpose needs.<\/li>\n<\/ul>\n
![\"Data](\"https:\/\/www.ogeninfo.com\/blog\/wp-content\/uploads\/2026\/11\/dpdp-ai-data-flow.webp\")
![\"Ten-step](\"https:\/\/www.ogeninfo.com\/blog\/wp-content\/uploads\/2026\/11\/dpdp-ai-checklist-10-steps.webp\")