Your pilot will be in production when the core obligations bite in May 2027. The decisions you make this quarter are the ones that will be examined.
In the late 1990s, when we took our executive education programme onto client company LANs, I learned something that has stayed with me. The technology was never the first hurdle. Every rollout began in the corner office, explaining to top management how the system worked and why it was safe to let it inside the organisation.
AI pilots today face the same conversation, but in reverse. The question is no longer what comes in. It is what goes out: the customer transcripts, the HR files, the loan notes and the CRM exports that a team uploads to a model hosted somewhere else.
India now has a law with a clear view on that question. And the calendar is moving faster than most pilot plans.
Where the DPDP clock stands today.
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, putting the 2023 Act on a phased track. The institutional framework for the Data Protection Board came into force immediately.
The next milestone is nine days away. On 13 November 2026, Rule 4 on consent managers commences.
The big one follows on 13 May 2027, when the substantive obligations take effect: notices, security safeguards, breach reporting, erasure and the cross-border transfer framework.
Two other recent developments are worth a note. In October, MeitY issued a Removal of Difficulties Order clarifying consent and audit provisions. And on 31 October, it released a draft handbook on using its DEPA framework for AI training, built on the idea of taking the model to the data rather than the other way round.
Separately, a reported proposal to shorten the 18-month runway has not been notified, so May 2027 remains the legal deadline.
Here is why this matters for your pilot. A proof of concept you start this month will, if it works, be running in production by next summer. “Pilot” is not a legal category. The shortcuts you take now become the practices you must defend later.
So before any personal data leaves your building, I suggest putting five questions to your team.
Question 1: What exactly is leaving, and is it personal data?
This sounds obvious. In my experience, it rarely is. Ask a project team what data the pilot uses, and you will hear “customer queries” or “sales notes”.
Look closer, and you find names, mobile numbers, account details and free-text comments that describe individuals in detail.
Under the Act, personal data is any data about an individual who can be identified by or from it. Replacing names with codes does not take you outside the law if someone in your organisation holds the key.
What to do: ask for a one-page data inventory for each pilot. Which fields, from which systems, how many records, and how sensitive. Then test a masked version. You will often find the model performs almost as well without the personal details, and the compliance question shrinks considerably.
Question 2: Were people told this would happen?
The DPDP framework is built on purpose. Consent must be for a specified purpose, and notices must tell people what their data will be used for. Data collected to service a loan or deliver an order does not automatically become available to train a churn model or test a chatbot.
The Act does allow certain “legitimate uses” without consent, including some employment-related purposes. But these are specific, not a general licence. Treat them as narrow doors, not open gates.
What to do: pull out the privacy notice that applied when the data was collected and read it against the pilot’s purpose. If it does not cover the new use, you have three honest options: anonymise properly, use synthetic data, or seek fresh consent.
Question 3: What does the vendor contract actually say?
This is where I see the most risk, because it is where good intentions meet click-through terms. Many pilots begin on a free trial or a standard online agreement accepted by an enthusiastic team member. Nobody reads the data clauses.
The Act makes clear that responsibility remains with you, the data fiduciary, even when a vendor handles the processing, and that processors should be engaged under a valid contract.
The penalty schedule underlines the point: up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for failing to notify a breach, and up to ₹50 crore for most other lapses.
What to do: before a single record is uploaded, get clear written answers to five things:
Does the vendor use your inputs to train its models? How long does it retain prompts and outputs? Which sub-processors are involved? Where are the logs stored? And how is data deleted when the pilot ends?
Question 4: Where does it go, and who can reach it?
India has taken a relatively permissive line on cross-border transfers. Section 16 lets personal data go to any country except those the government restricts. Note, though, that this provision has not yet commenced and is expected to take effect with the main obligations in May 2027.
The bigger point is that the DPDP Act is not the only rule in play. Sector regulators have their own requirements, and they already apply. The RBI’s payment data storage directive is the best-known example.
If you are in banking, insurance, healthcare or telecom, your sector rules may be stricter than the DPDP Act.
And location is only half the question. Lawyers advising on this now stress who can access the data, not just where the server sits.
What to do: ask whether an India-region or private deployment option is available, and what it costs. For sensitive datasets, the “bring the model to the data” approach that MeitY’s DEPA handbook describes is worth understanding, even at pilot stage.
Question 5: If something goes wrong, can you respond in 72 hours, and delete on request?
Rule 7 requires you to inform the Data Protection Board and affected individuals of a personal data breach without delay, with a detailed report to the Board within 72 hours. There is no materiality threshold. Remember too that CERT-In’s six-hour cyber incident reporting rule already applies today.
AI adds a twist. When a customer exercises their right to erasure, can you actually remove their data? It may now sit in prompt logs, a vector database or, worst of all, a fine-tuned model.
What to do: design for deletion from day one. Prefer architectures where your data stays in a store you control and is retrieved when needed, rather than baked into model weights. And make sure the vendor will tell you about an incident quickly enough for you to meet your own clock.
The one-page passport.
None of this is a reason to slow down. It is a reason to do the slow thinking early, when it is cheap.
Practical suggestion: give every AI pilot a one-page “data passport” with the answers to these five questions. Have it signed by the business owner and whoever looks after legal and IT. It takes an afternoon. Unwinding a production system in April 2027 will take much longer.
The organisations I saw succeed with new technology in the 1990s were not the boldest. They were the ones whose leadership understood what they were letting in. This time, the leadership task is understanding what you are letting out.
Which of these five questions would your current AI pilot struggle to answer? I would value hearing from you in the comments.
This article is for general guidance only and is not legal advice. Please consult qualified counsel on your specific situation.
Sources consulted:
- AZB & Partners: phased rollout and compliance milestones (notification date, 18-month timeline)
- Taxmann: DPDP Act and Rules 2025 timeline (provisions in force immediately; May 2027 deadline)
- King Stubb & Kasiva via Mondaq: 2026 compliance milestones (Rule 4 from 13 November 2026)
- King Stubb & Kasiva: cross-border transfers under the DPDP Act (Section 16 not yet commenced; access, not just location)
- SCC Online: DPDP Removal of Difficulties Order, 2026
- ConsentPlix: MeitY rules and amendments tracker (reported shortening proposal not notified)
- Elets CIO: MeitY DEPA for AI Training handbook
- Konfirmity: DPDP penalty bands (₹250 / ₹200 / ₹50 crore)
- IAPP: operational impacts of the DPDPA, breach notification (72-hour report; CERT-In six-hour rule)
