Responsible AI and India's DPDP Act
Responsible AI Principles
- Fairness: test outputs across languages, regions and genders (for example loan or job screening bots).
- Transparency: tell users they are talking to AI; show sources.
- Accountability: a named owner, logs, and a way to reach a human.
- Privacy and security: collect the minimum data, protect it, delete it on time.
- Safety: block harmful content; extra care for health, finance and children.
Responsible AI is the practice of building AI systems that are fair, transparent, accountable, private and safe, and checking that they stay that way. These are not abstract ideals: each one maps to a concrete engineering task. Fairness means running your evals per language and region, because a bot that works well in English and poorly in Tamil treats some customers worse. Transparency means a visible "AI assistant" label and citations. Accountability means a named owner and logs good enough to explain a decision after a complaint.
DPDP Act 2023 Basics
India's Digital Personal Data Protection Act, 2023 governs digital personal data. Its Rules were notified in November 2025 and apply in phases. Key ideas for GenAI apps:
| Term / rule | Meaning for a GenAI app |
|---|---|
| Data Principal | the person the data is about (your customer) |
| Data Fiduciary | you, the company deciding why and how data is processed |
| Data Processor | vendors processing data for you (cloud, LLM API providers) |
| Notice and consent | tell users clearly what data you collect and why; get consent for that purpose |
| Purpose and storage limits | use chat data only for the stated purpose; delete it when no longer needed |
| Rights | users can access, correct and erase their data and raise grievances |
| Security and breaches | reasonable safeguards; report breaches to the Data Protection Board and affected users |
| Penalties | up to ₹250 crore per breach of certain duties |
Note: This is a summary for developers, not legal advice. Check the current Act, Rules and your company's legal team before launching.
What It Means in Code
- Mask PII before sending to the LLM API and before logging.
- Set a retention period for chat logs and delete them automatically.
- Do not put customer chats in fine-tuning or eval datasets without consent and anonymisation.
- Know where your LLM provider processes and stores data, and sign a data processing agreement.
The thinking behind the law is consent for a purpose. A customer who shares a phone number to get delivery updates has agreed to that purpose, not to having their chats used to train a model or sent to marketing. When you design a GenAI feature, write down for each piece of personal data: why you collect it, who processes it (including the LLM provider as a processor), how long you keep it, and how a user can see or erase it. If you cannot answer, the feature is not ready.
Summary
- Responsible AI = fairness, transparency, accountability, privacy, safety, turned into concrete checks.
- Under the DPDP Act you are the Data Fiduciary; your LLM provider is a Data Processor.
- Use data only for the consented purpose, keep it only as long as needed, and honour user rights.
- Mask, minimise and set retention in code; confirm details with legal.