Can You Train AI on Indian Customer Data? What the DPDP Act Says About AI Training Data
India’s DPDP Act has no research exemption for commercial AI, no legitimate-interests basis, and no concept of anonymised-enough. If you are fine-tuning a model on customer support transcripts or building a RAG index over user records, here is what the law actually requires.
Unlike the EU GDPR, which includes a balancing test for "legitimate interests" under Article 6(1)(f), India’s DPDPA 2023 requires specific, informed, unconditional consent for every distinct purpose not covered by the narrow list of Section 7 legitimate uses.
Consent obtained for "providing customer support" does NOT authorise using those support transcripts to train or fine-tune a commercial LLM unless either (a) a separate, unbundled consent purpose for AI model training was explicitly accepted by the Data Principal, or (b) the dataset is irreversibly anonymised so that no individual can be re-identified.
Need help implementing this under the DPDP Act 2023?
Talk to our legal advisors at Manoj Bhagat & Associates or estimate your annual compliance cost in 30 seconds.