India's DPDP Act: what it means for agents that act

What it is

The Digital Personal Data Protection Act, 2023  (opens indiacode.nic.in, external site) (Act 22 of 2023) received assent on 11 August 2023. It applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. The Digital Personal Data Protection Rules, 2025  (opens meity.gov.in, external site) were notified on 13 November 2025 and bring the Act into force in phases.

Key dates

• 13 November 2025: the Rules are notified, and provisions establishing the Data Protection Board of India take effect.
• 13 November 2026: provisions on registered consent managers take effect, one year after notification.
• 13 May 2027: the core duties of data fiduciaries take effect, 18 months after notification, including notice, consent, security safeguards, breach intimation and the rights of data principals.

The duties that matter for agents

The Act does not mention AI agents. It does not need to. An agent that reads a customer file, drafts a message to a patient or updates an employee record is processing personal data on behalf of the data fiduciary, which is the business that decides why and how the data is used.

• Notice and consent (sections 5 and 6): processing needs a lawful basis, usually consent that is free, specific, informed, unconditional and unambiguous, for a stated purpose. An agent must not use data for a purpose the notice did not cover.
• Accuracy for decisions (section 8(3)): where personal data is used to make a decision that affects the person, the fiduciary must ensure it is complete, accurate and consistent.
• Security safeguards (section 8(5) and Rule 6): reasonable safeguards, including access control, masking or encryption where appropriate, and logs that allow unauthorised access to be detected. The Rules ask for those logs to be kept for at least one year.
• Breach intimation (section 8(6) and Rule 7): affected people must be told without delay, and the Board must be informed, with a detailed report within 72 hours of becoming aware.
• Erasure (section 8(7)): data must be erased when the purpose is served or consent is withdrawn, unless the law requires it to be kept.
• Rights of data principals (sections 11 to 14): access to a summary of processing, correction and erasure, grievance redress and nomination.

Significant data fiduciaries

The government can notify some fiduciaries as significant, based on the volume and sensitivity of data and the risk to people. They must appoint a data protection officer based in India, appoint an independent data auditor and carry out periodic data protection impact assessments. Under Rule 13 they must also take due care that the algorithmic software they use is not likely to pose a risk to the rights of data principals. For a bank, insurer or hospital group, that is a direct line to every AI model and agent in use.

Penalties

The Schedule to the Act sets penalties per instance of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for failing to notify a breach or to meet the additional duties towards children. The Data Protection Board decides penalties after an inquiry.

How elan1 maps to it (draft)

• Purpose limits as rules: elan1 Govern can refuse an agent action that uses data outside the purpose your notice states.
• Masking before models read: Aadhaar, PAN and account numbers can be masked before any model sees them, as in the banking configuration.
• Access logs: every agent action, allowed, approved or refused, is recorded with the agent's identity, and the record can be kept for as long as your policy requires.
• Residency: India data residency is available in AWS Mumbai, and elan1 Run is designed to run on infrastructure you name.
• Recommend-only decisions: where a decision about a person matters most, elan1 Decide recommends and a person decides.