ComplyDP4 min read
DPDP Compliance and Shadow AI: Securing Generative AI Tools in the Enterprise
ET Online reports on the privacy risks of sharing customer data with third-party AI platforms. Learn how enterprise IT governance teams can prevent AI data leaks and maintain DPDP Act 2023 compliance without outright banning ChatGPT.
Last updated:
What Happened
ET Online recently published a video examining the compliance risks of sharing customer data with third-party AI platforms. The report outlines practical ways for enterprises to safely use tools like ChatGPT while maintaining compliance with India's Digital Personal Data Protection Act, 2023. Employees are increasingly feeding digital personal data into AI tools to execute workflows. This workplace integration introduces severe privacy and security risks. The coverage specifically addresses shadow AI compliance, secure enterprise deployment, and employee usage policies.
Does The DPDP Act Apply Here
The DPDP Act, 2023 applies to digital personal data processed within India or outside India if connected to offering goods or services to Data Principals in India, per Section 3. When an employee pastes a customer name, purchase history, or contact detail into a public AI prompt, they are processing personal data. Corporate IP and fully anonymised data fall outside the Act. D2C and e-commerce companies frequently handle large volumes of identifiable customer data. Feeding this data into an external AI model without an established lawful purpose triggers the Act.
Legal Implications Under DPDP
Consent is the primary basis for processing, except where Section 7 legitimate uses apply. Under Section 4 of the Act, a person may process personal data only for a lawful purpose. If an enterprise uses an AI tool to process personal data, the itemised notice required by the Rules, 2025 must reflect this processing purpose. If the AI provider processes data outside India, the transfer is permitted unless the Central Government restricts transfers to that specific country under Section 16.
Using public AI tools without governance also risks violating the duty to implement reasonable security safeguards against personal data breaches. If an AI platform leaks inputted customer data, the Data Fiduciary must submit a detailed report to the Data Protection Board of India within 72 hours, per the Rules, 2025.
Could This Happen To You
Shadow AI use is rampant in large e-commerce enterprises. Marketing teams frequently dump customer email lists into AI tools to generate segmented campaigns. Customer support agents feed chat transcripts into public language models to draft quick replies. If this happened to your company and resulted in a data leak, the DPBI would demand evidence of your technical controls and consent records.
You would need to produce an audit trail showing the data was processed within the scope of the original consent artefact. A failure here exposes the enterprise to penalties of up to 250 crore rupees for breaching security safeguard duties. The Head of Compliance must answer to the board for these unmonitored data flows. Relying on a heavy banking GRC tool often leaves gaps in mapping these rapid marketing data movements.
What Companies Should Do In The Next 30 Days
1. The IT Governance lead must conduct an audit of current AI tool usage across marketing and support teams to produce a shadow IT inventory.
2. The Head of Compliance needs to draft an employee AI usage policy that forbids pasting digital personal data into consumer-grade AI tools.
3. The Data Protection Officer must review all existing consent artefacts to ensure AI processing aligns with the original purpose stated to the Data Principal.
4. Procurement teams must implement a vendor risk assessment for enterprise AI platforms to verify that agreements prevent the AI provider from using customer data to train their base models.
What To Watch
Enforcement procedures will solidify as the DPBI becomes fully operational. 188 days remain until the DPDP hard compliance deadline of 13 May 2027. Regulators will likely scrutinize third-party data sharing arrangements and shadow IT practices early on. E-commerce enterprises must ensure their data mapping and vendor oversight processes are regulator-ready before the window closes. Companies can evaluate their own readiness and potential AI data risks by running a free compliance scan at https://www.complydp.com/audit-preview today.
Sources
Frequently asked questions
Does the DPDP Act allow employees to use ChatGPT for work?
The Act allows AI usage if the Data Fiduciary establishes a lawful purpose. Consent is the primary basis for processing, except where Section 7 legitimate uses apply. Companies must ensure digital personal data is not fed into AI tools without proper notice and consent.
What happens if an AI tool leaks our customer data?
The Data Fiduciary remains responsible for the breach. You must intimate affected Data Principals without delay and submit a detailed report to the DPBI within 72 hours under the Rules, 2025. Penalties for failing to implement reasonable security safeguards can reach up to 250 crore rupees.
Are cross-border data transfers to foreign AI servers permitted?
Yes, cross-border transfers are generally permitted under Section 16 of the Act. The Central Government may restrict transfers to a negative list of notified countries. You must still maintain valid consent and purpose limitation for the transfer.
How should e-commerce marketing teams handle AI data processing?
Marketing teams must stop pasting unverified customer lists into public AI models. The Head of Compliance should implement an enterprise AI policy and unbundle consent for specific processing activities. An audit trail proving data was processed according to the original consent artefact is required.
What is the deadline for DPDP Act compliance?
188 days remain until the DPDP hard compliance deadline of 13 May 2027. Enterprises must update their itemised notices, secure their vendor agreements, and prepare breach reporting workflows before this date.