Why AI Chatbots Must Meet India's DPDP Rules Before May 2027

Under India's Digital Personal Data Protection Act, 2023, a chatbot that exposes one user's data to another is likely a personal data breach, triggering duties to inform the affected customer without delay and report to the Data Protection Board within 72 hours. Obligations take effect on 13 May 2027, with penalties of up to ₹250 crore for weak safeguards and up to ₹200 crore for missed notifications. Any company whose chatbot processes personal data from users in India is treated as a Data Fiduciary and remains accountable for data handled by its LLM and vendor providers. Chatbots face particular risk because personal data flows in through user messages, retrieval pipelines, and logs, and the article highlights prompt injection and unmasked data sent to LLM providers as the most serious gaps. The piece sets out seven questions for companies to review, each tied to the relevant provision and the evidence needed to show compliance.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.


Discussion (0)
Log in to join the discussion and vote.
Log in