The Digital Personal Data Protection Act, 2023 is India's main law on personal data, with its rules being brought into force in phases. If your chatbots, CRMs and automations handle names, phone numbers, addresses or other customer details, the Act is relevant to you. This article is a practical overview, not legal advice — consult a lawyer for your specific situation.
Core ideas in simple terms
- Consent and purpose: collect personal data for a clear, lawful purpose, and tell people what you are collecting and why.
- Data minimisation: collect only what you need for that purpose.
- Security safeguards: protect data with reasonable security measures.
- Rights of individuals: people can ask to access, correct or erase their data and to withdraw consent.
- Breach handling: have a process to respond to and report data breaches as required.
What this means for automation
- Forms and chatbots: add a short notice explaining how data will be used, and record consent where needed.
- Tool choice: prefer business plans of AI services that do not use your data for model training, and understand where data is stored.
- Access control: give staff and automations only the access they need.
- Logging: keep records of what automations do with personal data.
- Retention: delete data you no longer need.
Sensitive documents
KYC documents, health records and financial details deserve extra care. Mask identifiers where possible, avoid copying documents into multiple tools, and keep a clear record of who can see them.
Vendors and processors
If an agency or software provider processes data on your behalf, put a written agreement in place that covers security, confidentiality and deletion.
FAQs
Does the DPDP Act stop us from using AI tools?
No. It requires responsible handling of personal data, which well-designed AI systems can support.
Do we need a privacy policy?
Yes, a clear privacy notice is essential for any business collecting personal data.
Should we store data in India?
Many businesses prefer Indian cloud regions for performance and peace of mind. Check any sector-specific rules that apply to you.
