Artificial Intelligence and Data Privacy Laws in India

Published Paper PDF: Download PDF

Confirmation Letter: View

Dr. Anand Kumar Dwivedi

Assistant Professor, Department of Law

VSSD College, Kanpur

ORCID id – https://orcid.org/0009-0009-8256-1074

Abstract— The rapid adoption of artificial intelligence (AI) across India’s public and private sectors has intensified debate over how the country’s data privacy framework should respond to algorithmic decision-making, automated profiling, and large-scale personal data processing. This paper examines the evolving relationship between AI governance and data privacy law in India, tracing the legal foundations from the Supreme Court’s recognition of privacy as a fundamental right in Justice K.S. Puttaswamy v. Union of India through the Srikrishna Committee’s 2018 report, the enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act), and the more recent Digital Personal Data Protection Rules, 2025. Drawing on statutory texts, government policy documents from NITI Aayog and the Ministry of Electronics and Information Technology (MeitY), and peer-reviewed and law-journal literature, the paper reviews India’s regulatory approach to both data protection and artificial intelligence, and examines the points at which the two increasingly overlap, particularly through obligations placed on “Significant Data Fiduciaries” to assess algorithmic risk. The findings indicate that India has deliberately chosen not to enact a standalone AI law, instead relying on a lighter, voluntary governance framework layered onto its general data protection statute, with the result that data protection law is emerging as the country’s de facto instrument for algorithmic accountability. The paper concludes that while this approach offers regulatory flexibility, it leaves significant gaps around explainability, automated decision-making, and algorithmic bias that will need to be addressed as AI adoption deepens across Indian institutions.

Keywords: artificial intelligence; data privacy; Digital Personal Data Protection Act; algorithmic accountability; India; right to privacy

References

Committee of Experts under the Chairmanship of Justice B.N. Srikrishna. (2018). A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians. Ministry of Electronics and Information Technology, Government of India.
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). Ministry of Electronics and Information Technology, Government of India. https://www.meity.gov.in
Digital Personal Data Protection Rules, 2025. Ministry of Electronics and Information Technology, Government of India (notified 13 November 2025).
Indian Journal of Law and Legal Research. (2026). Algorithmic accountability by the back door: The Significant Data Fiduciary due diligence mandate as India’s de facto AI governance instrument. Indian Journal of Law and Legal Research. https://www.ijllr.com/post/algorithmic-accountability-by-the-back-door-the-significant-data-fiduciary-due-diligence-mandate-as
Justice K.S. Puttaswamy (Retd.) and Anr. v. Union of India and Ors., (2017) 10 SCC 1; AIR 2017 SC 4161 (Supreme Court of India).
Ministry of Electronics and Information Technology. (2025). India AI Governance Guidelines. Government of India.
NITI Aayog. (2018). National Strategy for Artificial Intelligence #AIforAll. Government of India. https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf
NITI Aayog. (2021). Responsible AI for All: Approach Document for India, Part 1 – Principles for Responsible AI. Government of India. https://www.niti.gov.in/sites/default/files/2021-02/Responsible-AI-22022021.pdf
NITI Aayog. (2022). Responsible AI for All: Adopting the Framework – A Use Case Approach on Facial Recognition Technology. Government of India.
PRS Legislative Research. (2018). Report summary: A Free and Fair Digital Economy. https://prsindia.org/policy/report-summaries/free-and-fair-digital-economy
Why We Need Data Protection Laws for AI in India. (2025). De Facto Law Journal. https://defactolawjournal.org/papers/why-we-need-data-protection-laws-for-ai-in-india/