AI agents are covered by India’s DPDP Act the moment they touch personal data, even though the law never uses the word “agent”. The company that decides the purpose and means of the processing is the data fiduciary and carries the compliance burden, so the practical task is to design agent access, memory and logging around the Act’s rules before the main obligations begin in mid-May 2027.
This guide explains how the DPDP Act and Rules map onto agentic AI: roles, consent, purpose limits, security, retention and the dates that matter. It is general information, not legal advice.
What is an AI agent, and why does DPDP care?
A chatbot answers questions. An agent acts: it reads email or documents, calls tools and APIs, writes to databases and keeps memory between tasks. Every one of those steps can involve personal data of customers, employees or third parties. The DPDP Act regulates processing of digital personal data, so the agent’s behaviour, not its label, decides whether the law applies.
Commentators note that neither the Act nor the MeitY AI Governance Guidelines (November 2025) mention agentic AI specifically. The guidelines are non-binding and suggest existing laws, including data protection law, can cover AI for now. That means you apply existing duties to new behaviour.
Who is the data fiduciary when an agent processes data?
The Act defines three roles. The data principal is the individual. The data fiduciary decides the purpose and means of processing. The data processor processes on the fiduciary’s behalf.
- Your business is usually the fiduciary when it deploys an agent for its own workflows.
- A model or tool vendor is often a processor, but the contract and the vendor’s own use of data (for example, training on prompts) can change that picture.
- A very large agent provider could be designated a Significant Data Fiduciary under Section 10, which brings a Data Protection Officer in India, independent audits and impact assessments.
Hosted models and cross-border questions
Using a hosted LLM does not automatically create a prohibited transfer. Section 16 governs cross-border transfers, so check where data is processed, whether prompts are retained or used for training, and what the provider promises on security and incident notice.
Consent and purpose limitation for AI agents
Consent under Section 6 must be free, specific, informed and tied to a stated purpose, and the notice should be in plain language. A blanket permission such as “allow access to everything” fits poorly with that standard. Two practical consequences follow:
- Scope each workflow. Define which data a task needs and give the agent only that.
- Remember third parties. A user’s consent does not cover the people whose messages or details sit in the user’s files. Where an agent handles a child’s data, the verifiable parental consent rules also apply; see our guide to DPDP parental consent and children’s data.
A prompt that says “only access relevant information” is not a control. Enforce limits in permissions at the API, application or data layer.
Security safeguards: what Rule 6 expects from agent deployments
Section 8(5) requires reasonable security safeguards, and Rule 6 lists minimum measures. Failing to maintain safeguards can attract penalties of up to ₹250 crore under the Act’s schedule. Translated to agents:
| Rule 6 measure | What it means for an agent |
|---|---|
| Encryption, masking or tokenisation | Mask identifiers before they reach prompts, logs and vector stores where possible. |
| Access control | Give each agent its own identity and least-privilege permissions instead of a shared service account. |
| Logs and monitoring | Record which agent acted, who started it, what it accessed and what it did. |
| Backups and continuity | Keep processing recoverable if agent data is lost or corrupted. |
| One-year retention of logs and data | Plan log retention deliberately, unless another law requires a different period. |
| Processor contracts | Put security obligations into contracts with model and tool providers. |
Prompt injection is a breach pathway
Excessive permissions, prompt injection, insecure integrations and unintended external transfers can expose data. Unauthorised processing that compromises confidentiality, integrity or availability can be a personal data breach, which triggers intimation duties. Read our explainer on DPDP breach notification and the 72-hour clock and rehearse the response before an agent goes live.
Retention and erasure: where agent data hides
Personal data can persist well beyond the source record. Check prompt logs, conversation history, caches, vector databases and embeddings, monitoring traces and external providers’ systems. Deleting a customer record while its embedding survives in a vector store leaves a copy behind. Map the data flow once, then test that erasure actually propagates.
Key dates for AI teams
The DPDP Rules were notified in November 2025 with an 18-month phased rollout. Sources report the dates with a one-day variation, so confirm against the official notification.
- November 2025: initial provisions, mainly the Data Protection Board framework, took effect.
- Mid-November 2026: Rule 4 on consent managers.
- Mid-May 2027: the remaining substantive rules, including security safeguards and breach intimation. This is the milestone for most agent deployments.
For a broader starting point, see a beginner’s guide to implementing DPDP strategies.
A practical checklist before you ship an agent
- Name the purpose of each workflow and the minimum data it needs.
- Give every agent a distinct identity with an owner and a revocation process.
- Enforce least privilege outside the prompt.
- Classify personal data before granting access.
- Keep audit logs without creating unnecessary extra copies of personal data.
- Test prompt injection and unintended disclosure.
- Document and test deletion across logs, caches and embeddings.
- Review vendor terms on training use, retention and incident notice.
Frequently asked questions
Does the DPDP Act apply to AI agents?
Yes, in practice. The Act does not mention AI agents by name, but it applies to digital personal data processing, and an agent that reads, stores or sends personal data is processing it. The organisation that decides why and how the agent is used is typically the data fiduciary.
Who is responsible when an AI agent mishandles personal data?
Generally the data fiduciary that deployed it, including for data handled by its processors. Contracts with the model or tool provider matter, but they do not move the fiduciary’s accountability away.
When do the main DPDP obligations start for AI deployments?
Most substantive obligations, including security safeguards and breach intimation, start in mid-May 2027 under the phased schedule. Consent manager rules start about a year after notification, in mid-November 2026. Sources differ by a day on the exact dates, so check the official notification.
Is a prompt like ‘only use relevant data’ enough to limit an agent?
No. Instructions in a prompt are not an access control. Limits should be enforced through permissions at the API, application or data layer.
Can I use a hosted LLM API with personal data?
It can be possible, but you need to assess the provider’s role, processing location, retention, training use, security terms and incident notification terms, and check the cross-border rules in Section 16.
Conclusion
AI agents do not sit outside the DPDP Act. Treat each one like a new member of staff with access to personal data: give it a defined job, the narrowest permissions, a traceable record and a clear exit path for the data it touched. Teams that build these controls now will be ready when the main obligations start in 2027.
Disclaimer: this article is general information, not legal advice. Consult a qualified lawyer for your specific situation.