DPDP Act and AI inference

Why does inference need a data review?

An AI request can contain personal data even when the application looks like a simple chat interface. A user may paste a record, upload an image or ask a question that causes the application to retrieve information about someone. The request needs a data-handling review based on its contents and purpose, rather than on the fact that a language model processes it.

India's Digital Personal Data Protection Act, 2023 provides a framework for digital personal data. The Act addresses matters including notice, consent, responsibilities for handling data and individual rights. Assessing a particular application requires attention to the applicable provisions and their commencement, as well as the way the system is operated. A hosting badge cannot settle those questions.

Map the application before choosing controls

Begin with an engineering inventory. Identify the fields your application accepts, the documents it retrieves and the information added by tools. Track where a request travels and where copies can appear. Include operational logs and support workflows, since those systems can receive information beyond the immediate model interaction.

Separate required inputs from convenient extras. A summarisation task may not need a person's name or contact details. A tool might be able to retrieve only the specific fields needed for an answer. Reducing unnecessary content makes the data flow easier to explain and reduces the number of places that need protection.

Access controls also need a practical design. Decide which team members can view request records, how credentials are stored and how access is removed. Document the decisions in language that product owners, engineers and reviewers can all follow.

What does DPDP-ready describe?

DPDP-ready describes controls that can support a team's data-protection work. It does not establish that an application has met all its obligations. Review the complete service arrangement and the customer's own workflow before making a legal claim about the deployment.

IndicStack provides India-hosted inference, request metadata logs and a no-training commitment for prompts and completions on India-hosted models. Sub-processor information, a data-flow overview and security questionnaire answers are available on request. Use these documents as evidence for your review alongside the architecture of your own application, rather than treating any individual control as a complete assessment.

Related terms