With AI ambitions in focus, India must now clarify how its data protection framework governs the personal data that trains and improves AI systems.
Setting the Stage: AI Summit 2026
The Indian AI Impact Summit 2026 opens today at Bharat Mandapam with an ambitious agenda: Three Sutras: People, Planet and Progress and Seven Chakras covering Human Capital, Safe and Trusted AI, Inclusion, Science, Resilience, Democratizing AI Resources, and Economic Growth. The focus is clear: build computing capacity, strengthen data infrastructure, and position India as a central player in the global AI ecosystem.
A Vision for Human-Centric AI
IT Secretary S. Krishnan has described India's AI vision as "human-centric and inclusive", emphasising "democratic access to AI resources". Prime Minister Narendra Modi is expected to meet global AI leaders, including Sam Altman, Sundar Pichai, Dario Amodei, and Demis Hassabis. India signals that it aims not merely to adopt AI but to shape its trajectory globally.
Yet, alongside infrastructure, a quieter but crucial question remains: how is the personal data used to train AI systems governed?
The Legal Framework: DPDP Act 2023
India's Digital Personal Data Protection Act, 2023 provides a comprehensive framework: Section 6 mandates consent for processing, Section 16 regulates cross-border transfers, and Section 33 prescribes penalties for non-compliance. "Processing" is defined broadly, covering automated operations on personal data, which would appear to include AI training where identifiable data is involved.
The Missing Guidance for AI Training Data
However, neither the statute nor the draft DPDP Rules 2025 offer guidance on how consent, purpose limitation, and transparency principles apply when personal data contributes to model training and refinement. The law is technologically neutral, but neutrality is not clarity.
India's Strategic Opportunity and Global Attention
This matters strategically as India's digital ecosystem is large, diverse, and highly engaged with AI. Global firms see this environment as invaluable for testing, localisation, and iterative improvement. Offering AI tools at low or no cost immediately benefits users while creating rich feedback loops that refine models. In effect, access and data contribution are intertwined, a nuance policymakers cannot afford to overlook.
Learning from Europe: GDPR as a Benchmark
Europe's GDPR guidance provides a useful benchmark. Supervisory authorities there have clarified how consent, purpose limitation, and automated decision-making apply to AI, creating an interpretive structure even without AI-specific statutes. India faces a similar inflexion point: infrastructure and investment alone will not establish leadership. Governance clarity must follow.
Guidance for AI Training and Data Use
Rather than suggesting entirely new rules, India could clarify how existing principles apply in AI training contexts, including:
- Consent in AI training scenarios: guidance on whether interactions with AI require explicit consent for use in model training.
- Purpose limitation for AI reuse: clarity on how secondary uses, like training, align with consented purposes.
- Transparency norms for training datasets: recommendations on what disclosures companies should provide about Indian data used to improve AI systems.
- Regulatory guidance on data provenance and model accountability: defining what documentation or reporting fiduciaries should maintain for AI training and validation datasets.
- Operationalising human-centric, ethical AI: concrete guidance on implementing principles of safety, inclusion, and trust in AI model development.
These are not new mandates but practical clarifications to make India's AI framework actionable, strategic, and globally credible.
Beyond Infrastructure: Completing the AI Architecture
As the AI Summit deliberates on "Safe and Trusted AI", the conversation must extend beyond data centres and investment. Democratisation is not just about access to tools; it is about clarity on how the data powering these systems are used.
India has laid the foundations of data protection. Its AI ambition now calls for completing that architecture.
(The author is an independent AI strategist and policy lawyer specialising in technology and data governance)
Disclaimer: These are the personal opinions of the author
