DPDP Compliance for AI Chatbots and LLM Apps Built in India
Your chatbot is a data collection surface with a text box. Users paste Aadhaar numbers, medical histories, and card details into it, your prompts go to a model provider abroad, and every conversation is logged. Here is what the DPDP Act requires of an LLM application built in India — and the architecture that satisfies it.
Unstructured chat interfaces present a unique challenge under India’s Digital Personal Data Protection Act (DPDPA) 2023. Unlike traditional web forms with fixed fields, an AI assistant invites Data Principals to type free-form text that frequently includes financial identifiers, health conditions, and personal contact details.
Under Section 5 and Section 6 of the DPDPA, Data Fiduciaries must provide an itemised notice of the personal data collected and the specific purpose of processing before or at the time of collection. For LLM applications, this means presenting a clear pre-chat consent notice that discloses whether conversation logs are retained, whether third-party model APIs process prompts outside India, and whether inputs are used for model fine-tuning.
Architecture Checklist for Compliant AI Apps: (1) Embed a granular DPDPA Consent Notice before the first prompt is submitted; (2) Implement automated PII scrubbing (regex + NER redaction for Aadhaar, PAN, phone, and email) before forwarding prompts to external LLM APIs; (3) Wire your chat history database to your Request Centre so Data Principals can exercise their Right to Erasure across conversation logs and vector embeddings.
Need help implementing this under the DPDP Act 2023?
Talk to our legal advisors at Manoj Bhagat & Associates or estimate your annual compliance cost in 30 seconds.