DPDP Act

The DPDP Act establishes consent, purpose limitation, data-principal rights and breach notification for personal data processed in India.

For AI systems it reaches further than teams expect: training data, prompts and stored outputs can all contain personal data, and prompt logs are frequently the forgotten repository.

Consent is the part that most often needs rework. Purposes stated broadly at collection time do not automatically cover later AI processing, so organisations frequently find their existing consent language does not support what they now want to build. Reviewing that early is far cheaper than after the system is live.

Retention deserves specific attention. Prompt and output logs are genuinely useful for debugging and evaluation, and they are also personal-data repositories that accumulate indefinitely unless someone sets a policy. Deciding the retention period before the system goes live is far easier than justifying an unbounded archive afterwards.

Practical first step: decide where prompts and outputs are stored, for how long, and who can read them. That single question tends to surface most of the exposure, because logs accumulate quietly and rarely appear on anyone's data map.