ComplyDP4 min read
Innoviti Asserts DPDP Compliance for AI Payment Analytics via Localized Infrastructure
Innoviti displayed its Sanketdigital.ai platform at the RAI Summit to analyze 50 million purchase points for retail insights. The company cites localized infrastructure as its compliance basis. This claim prompts fintech General Counsels to review consent, purpose limitation, and AI data ingestion rules under the DPDP Act.
Last updated:
What happened
Innoviti displayed its AI platforms at the RAI Summit according to Passionate in Marketing. The company presented Sanketdigital.ai. This system tracks consumer purchasing behavior to drive the RAI-Innoviti SANKET index. It reads over 50 million purchase points across 2,800 towns and 10,000 pin codes. Innoviti feeds this data into a 27-billion-parameter Qwen model running on a sovereign, in-house NVIDIA H100 cluster. The company stated the platform is DPDPA-compliant because it hosts data locally. It keeps the data in India.
Does the DPDP Act apply here?
The DPDP Act covers digital personal data processed within India. Payment streams typically contain identifiable customer data, including account details and location markers. If Innoviti or its retail partners ingest raw payment records into the AI model, the Act governs that action. The law does not apply to irreversibly anonymized data. General Counsels face a high re-identification risk when feeding 50 million discrete purchase points into a 27-billion-parameter model. If the system can output data that identifies an individual, the entity remains a Data Fiduciary. It must obey the statute.
Legal implications under DPDP
Under Section 4 of the DPDP Act, a person may process personal data only for a lawful purpose. Consent acts as the main basis except where Section 7 legitimate uses apply. Using consumer payment histories to generate retail growth analytics requires an explicit, itemised notice under the DPDP Rules, 2025. This notice tells the user that their transaction data trains AI models. Innoviti claims compliance because its data stays in India. The DPDP Act does not mandate data localization for all processing. The central government manages cross-border transfers through a negative list of restricted countries. Running a localized, sovereign cluster supports the Section 8 duty to set up reasonable security safeguards, while meeting overlapping RBI data localization rules.
Could this happen to you
Fintech product teams frequently ship AI features that ingest existing payment streams. General Counsels face immediate liability when product leads bypass legal review to launch analytics tools. If your fintech processes 50 million purchase points for predictive analytics, the Data Protection Board of India will demand evidence of compliance. An auditor will ask you to produce the exact consent records and the itemised notice shown to those users. Failure to apply reasonable security safeguards or get valid consent carries penalty ceilings up to Rs 250 crore. When negotiating enterprise deals with retail partners, your legal team must provide defensible indemnities on how this data was sourced. A missing consent log derails these contracts. It shifts liability entirely onto your organization.
What companies should do in the next 30 days
1. Map AI data pipelines. Identify which fintech product teams feed production payment data into internal or third-party AI models. The product lead has to deliver a data flow diagram to the legal team.
2. Draft itemised notices. Update customer onboarding flows to state explicitly that the company processes transaction data for AI analytics. The legal head approves the updated notice copy.
3. Audit vendor processing clauses. Review contracts with infrastructure providers to check for defined liability limits. The text should specify that they process data only on your instructions. The General Counsel signs addendums for non-compliant agreements.
4. Test re-identification limits. Verify that data science teams apply technical safeguards before data reaches the model. The engineering head logs the anonymization techniques used.
What to watch
The rollout of the DPDP Rules, 2025 will set the specific technical standards for itemised notices and verifiable consent mechanisms. Legal teams should monitor how the Data Protection Board of India treats localized infrastructure as a defense against security breach penalties. Exactly 205 days remain until the DPDP hard compliance deadline of 13 May 2027. Fintechs must adapt immediately. Product cycles need to align with these regulatory rules before the window closes. General Counsels evaluating their exposure to these AI data requirements can test their posture at https://www.complydp.com/audit-preview.
Sources
Frequently asked questions
Does the DPDP Act restrict fintechs from using payment data for AI models?
The Act does not ban AI analytics. Processing identifiable payment data requires an itemised notice under the DPDP Rules, 2025 and verifiable consent from the Data Principal.
Does hosting data locally in India guarantee DPDP compliance?
No. A localized infrastructure helps meet the reasonable security safeguards required by the Act. However, companies still need to obey rules for consent, purpose limitation, and data principal rights.
What penalties apply if a fintech uses transaction data without valid consent?
Processing personal data without valid consent or a legitimate use exposes a Data Fiduciary to financial penalties. The Data Protection Board can impose fines up to Rs 250 crore for severe compliance failures.
How does the DPDP Act treat anonymized transaction records?
The DPDP Act applies only to digital personal data. If payment streams are completely and irreversibly anonymized before being fed into AI models, that processing falls outside the scope of the Act.
Can we rely on RBI localization rules to satisfy the DPDP Act?
RBI guidelines and the DPDP Act impose separate obligations. Localizing data meets RBI mandates. The DPDP Act generally allows cross-border transfers unless the destination is on a government negative list.