DPDP Act compliance checklist for teams using AI agents

1. Confirm scope and map every AI agent

The Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India (s. 3). It does not apply to data processed for purely personal or domestic purposes, or to data made publicly available by the person or under a legal obligation.

• RequirementConfirm whether you are a Data Fiduciary (you decide the purpose and means of processing) for each workflow an AI agent touches, and whether the agent vendor acts as your Data Processor.Act s. 2 (definitions), s. 3 (application) · [1]
• Good practiceKeep an inventory of every AI agent in use (including in-house and "shadow" agents): which systems and datasets it can read or write, what personal data it sees, and which business purpose it serves.Practical step; supports Act s. 8(4) "appropriate technical and organisational measures" · [1]
• RequirementRecord a lawful basis for each purpose: consent (s. 6) or one of the listed "certain legitimate uses" (s. 7). An agent should not be given personal data for a purpose that has no basis.Act s. 4, s. 6, s. 7 · [1]

2. Notice and consent

• RequirementGive a standalone notice, understandable on its own, in clear and plain language, with at minimum an itemised description of the personal data and the specified purpose(s), including the goods, services or uses enabled.Rules r. 3(a)–(b); Act s. 5 · [2]
• RequirementInclude the link and means to withdraw consent (as easy as giving it), exercise rights under the Act, and complain to the Data Protection Board.Rules r. 3(c); Act s. 6(4) · [2]
• RequirementMake sure consent is free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and limited to the personal data necessary for the purpose. If an AI agent adds a new purpose (for example, model training or profiling), check whether existing consent covers it.Act s. 6(1) · [1]
• RequirementWhen consent is withdrawn, stop processing (and cause processors, including agent vendors, to stop) within a reasonable time.Act s. 6(6) · [1]
• Good practiceIf you plan to accept consent via a registered Consent Manager, track the Board's register: Consent Manager rules apply from 13 Nov 2026 and Consent Managers must be Indian companies.Rules r. 4 and First Schedule; PIB release · [3]

3. Contracts with AI agent vendors (Data Processors)

• RequirementYou remain responsible for processing done on your behalf by a Data Processor, whatever the contract says. Engage processors only under a valid contract.Act s. 8(1)–(2) · [1]
• RequirementPut reasonable security safeguards into the contract with each agent vendor.Rules r. 6(1)(f) · [2]
• RequirementRequire the vendor to erase personal data you made available when the purpose ends or consent is withdrawn, subject to legal retention.Act s. 8(7)(b) · [1]
• RequirementRequire the vendor to retain personal data, associated traffic data and processing logs for at least one year from processing for the purposes in the Seventh Schedule, then erase unless another law requires longer (the Rules' own illustration covers a cloud provider acting as processor).Rules r. 8(3) · [2]
• Good practiceAsk each vendor where agent prompts, outputs and logs are stored, which sub-processors and model providers see them, and whether your data is used to train models.Practical due-diligence step

4. Reasonable security safeguards for agents

Rule 6 sets the minimum. Failure to take reasonable security safeguards carries the highest penalty in the Act (up to ₹250 crore).

• RequirementProtect personal data with appropriate measures such as encryption, obfuscation, masking or virtual tokens, including data that agents read or pass to model APIs.Rules r. 6(1)(a) · [2]
• RequirementControl access to computer resources. For agents this means scoped service identities, least privilege and no shared human credentials.Rules r. 6(1)(b); least privilege for in-house AI agents is also advised in CERT-In CIAD-2026-0049 · [2]
• RequirementKeep visibility on who and what accessed personal data (logs, monitoring and review) so unauthorised access can be detected, investigated and remediated. Agent actions should be attributable in those logs.Rules r. 6(1)(c) · [2]
• RequirementHave measures for continued processing if data is compromised or lost, such as backups.Rules r. 6(1)(d) · [2]
• RequirementRetain those logs and personal data for one year for detection, investigation and remediation, unless another law requires otherwise.Rules r. 6(1)(e) · [2]
• Good practiceAct on CERT-In CIAD-2026-0049: audit code, commit history and configs for exposed credentials, rotate keys, retire dormant APIs, require MFA, take admin interfaces off the internet and keep logs for at least 180 days.CERT-In CIAD-2026-0049 (15 Oct 2026) · [6]

5. Accuracy when agents make or inform decisions

• RequirementWhere personal data is likely to be used to make a decision that affects the person, or disclosed to another Data Fiduciary, ensure its completeness, accuracy and consistency. Agent summaries or extracted fields fed into decisions should be checked against source records.Act s. 8(3) · [1]
• Good practiceKeep a human approval step before an agent takes an action with legal or significant effect on an individual, and log who approved it.Practical control

6. Personal data breach response

• RequirementNotify each affected Data Principal without delay, through their account or registered contact: what happened (nature, extent, timing), likely consequences, mitigation, steps they can take, and a contact person.Act s. 8(6); Rules r. 7(1) · [2]
• RequirementNotify the Data Protection Board without delay, then within 72 hours (or a longer period the Board allows in writing) send detailed information: facts and reasons, mitigation, findings about who caused it, remedial steps, and a report on the notices given to individuals.Rules r. 7(2) · [2]
• RequirementSeparately, if you are covered by CERT-In Directions, report listed cyber security incidents to CERT-In within 6 hours of noticing them, and keep ICT system logs for 180 days within India. The DPDP and CERT-In timelines run in parallel.CERT-In Directions, 28 Apr 2022 · [5]
• Good practiceInclude "AI agent exceeded its authorisation" and "agent credentials leaked" as scenarios in your incident playbook and tabletop exercises.Practical step informed by CIAD-2026-0049 · [6]

7. Retention and erasure

• RequirementErase personal data when consent is withdrawn or when it is reasonable to assume the purpose is no longer served, whichever is earlier, unless law requires retention. Include agent memory, vector stores, caches and conversation histories.Act s. 8(7)(a) · [1]
• RequirementIf you are an e-commerce entity or social media intermediary with at least 2 crore registered users in India, or an online gaming intermediary with at least 50 lakh, erase data three years after the user last engaged (per the Third Schedule), and warn the user at least 48 hours before erasure.Rules r. 8(1)–(2), Third Schedule · [2]
• RequirementKeep a minimum one-year retention of personal data, traffic data and processing logs for Seventh Schedule purposes, then erase.Rules r. 8(3) · [2]

8. Rights, grievances and contact details

• RequirementSupport the rights to access information, correction, completion, updating and erasure, grievance redressal and nomination, including for data held or produced by agents.Act ss. 11–14 · [1]
• RequirementPublish on your website or app how people can make rights requests and what identifier they need to give.Rules r. 14(1) · [2]
• RequirementPublish and meet a grievance response period of no more than 90 days.Rules r. 14(3) · [2]
• RequirementPublish the business contact information of your Data Protection Officer (if applicable) or a person who can answer questions about processing, and include it in every response to a rights request.Act s. 8(9); Rules r. 9 · [2]

9. Children and persons with disability

• RequirementObtain verifiable consent of a parent (or lawful guardian) before processing a child's personal data, with due diligence that the parent is an identifiable adult.Act s. 9(1); Rules rr. 10–11; clarified by the 2026 Removal of Difficulties Order · [2]
• RequirementDo not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. Check personalisation and recommendation agents for this.Act s. 9(3) (exemptions in Fourth Schedule via r. 12) · [1]

10. If you are a Significant Data Fiduciary

• RequirementAppoint a Data Protection Officer based in India and an independent data auditor.Act s. 10(2) · [1]
• RequirementCarry out a Data Protection Impact Assessment and an audit every 12 months, and have the assessor report significant observations to the Board.Rules r. 13(1)–(2) · [2]
• RequirementDo due diligence that technical measures, including algorithmic software, used to handle personal data are not likely to pose a risk to Data Principals' rights. This directly covers AI agents and models.Rules r. 13(3) · [2]
• RequirementKeep any personal data that the Government specifies (on a committee's recommendation), and the related traffic data, inside India.Rules r. 13(4) · [2]

11. Cross-border transfers

• RequirementPersonal data may be transferred outside India, subject to any restrictions the Central Government notifies (s. 16) and any requirements it sets by order for making data available to a foreign State or entities it controls (r. 15). Track where your agent vendors and model providers process data.Act s. 16; Rules r. 15 · [2]