India’s DPDP rollout still leaves AI training and bias in a legal gray zone as 2025 ends

As India steps up efforts to position itself as a global hub for artificial intelligence, the rollout of the Digital Personal Data Protection Act is triggering growing unease over whether the country’s privacy framework can realistically align with how modern AI systems are built and deployed.

Although the DPDP Act was passed by Parliament in 2023, its implementation remained in limbo until November 2025, when the government finally notified the Digital Personal Data Protection Rules and activated key provisions of the law. While the move brought long-awaited procedural clarity, it has also intensified concerns around consent, data access and compliance at scale.

At the centre of the debate is Section 3 of the Act, which allows the use of publicly available personal data only when it can be established that the information was made public voluntarily by the individual concerned or in accordance with law. Policy experts argue that this requirement is extremely difficult to apply in real-world AI development, where training systems depend on massive, mixed datasets scraped from the public web.

Experts also question the broader assumption that consent-based privacy models offer the strongest form of protection. In practice, they say, such frameworks have struggled to prevent breaches or deliver meaningful privacy outcomes in large digital ecosystems, even in more mature regulatory regimes. There is growing concern that the DPDP framework could evolve into a compliance-heavy structure that consumes resources without proportionate gains in privacy, slowing innovation in the process.

The notification of the DPDP Rules, 2025 has offered some operational guidance to companies, but it has not resolved these underlying tensions. Policy specialists point out that many everyday digital services already operate in grey areas, from platforms that allow users to share third-party information to collaborative tools that process data beyond the original user. Similar issues are deeply embedded in how AI models are trained and deployed.

Under the current framework, experts warn, there is a widening gap between legal expectations and how data actually flows across the internet. Much of the information used for AI development is made public by third parties rather than directly by the individuals to whom the data relates, creating structural challenges for compliance.

There is also concern about the impact of over-regulation in an economy driven by scale and experimentation. For startups and small and medium enterprises in particular, policy analysts caution that rigid compliance burdens could make new services commercially unviable and discourage risk-taking at a critical stage of India’s AI growth.