DPDP Act and AI Tools: A Plain Guide for Small Businesses

General information, not legal advice. This article explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for small business owners who use AI tools. It is not legal advice. Laws and notifications change; for decisions about your business, consult a qualified professional such as a lawyer or company secretary.

More small businesses are putting customer data into AI tools: pasting a customer list into a chatbot, letting a WhatsApp assistant collect enquiries, or running scanned KYC documents through an extraction tool. At the same time, awareness of the new data protection law is very low. An India SME Forum survey of 7,835 MSMEs^[src] (December 2025) found that only 1.4%^[src] confirmed they were aware of the DPDP guidelines.

This guide covers what the law says, when it applies, where AI tools create risk, and a practical checklist you can start on this month.

The DPDP Act in one minute

The Act governs digital personal data: any data about an identifiable person, including paper records once they are scanned or typed in. It uses three roles you should know.

Data Fiduciary: your business, when it decides why and how personal data is used.
Data Principal: the person the data is about, such as a customer, patient, student, employee or lead.
Data Processor: a vendor that handles data on your behalf. Your CRM, WhatsApp API provider, OCR service, cloud storage and AI assistant are all processors.

Three points matter most for small businesses:

Size does not exempt you. A two-person CA practice, a single-doctor clinic and a coaching centre are all covered. Extra duties apply only to notified Significant Data Fiduciaries, which are typically large platforms.
You stay responsible for your vendors. If an AI tool leaks or misuses data you gave it, your business is still accountable. The Rules expect you to engage processors under a valid contract.
Publicly available data is narrower than it sounds. The Act excludes data a person made public themselves, but India Briefing notes that the test turns on how the data became public, and scraping or buying lists raises other legal questions.

Timeline: when does this apply?

August 2023: The Act was passed by Parliament.
November 2025: The DPDP Rules, 2025 were notified. Provisions setting up the Data Protection Board took effect immediately.
13 November 2026: Provisions on Consent Managers take effect.
13 May 2027: The main obligations start: notice, consent, security safeguards, breach intimation, children’s data, data-principal rights and penalties.

In early 2026, MeitY sought views on shortening the compliance window for some obligations. As of 30 September 2026, no notification making that change had been published. For most small businesses, treat May 2027 as the working date, and keep an eye out for amendments.

Do not read this as “nothing to do until 2027”. Your larger B2B customers and your own vendors are already preparing, and fixing data habits takes months, not days.

Where AI tools touch personal data

Most AI risk in a small business comes from a handful of everyday situations.

Pasting data into a chatbot. A salesperson pastes 200 customer names and numbers into a free assistant to “write personalised follow-ups”.
WhatsApp AI assistants and chatbots. Meta Business Agent or an API chatbot collects names, requirements, addresses and sometimes health or financial details.
Call recording and voice AI. Calls are recorded, transcribed and summarised, sometimes by a third-party voice agent.
Document extraction. Invoices, bank statements, Aadhaar and PAN copies, lab reports or salary slips go through OCR or extraction tools.
Marketing and lead scoring. AI decides whom to target and what to send, often using data collected for a different purpose.
Hiring. CVs are screened or ranked by AI.

In each case, ask three questions: What personal data goes in? Where does it go and how long is it kept? Who can see it?

Core duties in plain language

These apply fully from May 2027, but they are also simply good practice.

Notice. When you collect personal data, give a clear, standalone notice: what you collect, why, and how the person can withdraw consent or complain. The Rules require plain language and availability in English or any of the 22 languages^[src] in the Eighth Schedule to the Constitution.
Consent. Where consent is the basis, it must be free, specific, informed and given by a clear action. Pre-ticked boxes do not count, and withdrawing must be as easy as giving it. Some “legitimate uses” need no separate consent, such as using details a customer voluntarily gave you for the purpose they gave them.
Purpose limitation. Data collected for billing should not quietly become marketing data.
Security safeguards. Use reasonable measures such as encryption or masking, access control, monitoring and backups, and keep logs for at least one year^[src].
Retention. Delete personal data once its purpose is served or consent is withdrawn, unless another law requires you to keep it, as tax and accounting laws often do.
Breach intimation. Inform affected people without delay, and send the Data Protection Board a detailed report within 72 hours^[src] of becoming aware of a breach.
Rights. People can ask to access, correct or erase their data and nominate someone to act for them. Publish a contact for data questions and respond within the time the Rules set.
Children. For anyone under 18 you need verifiable consent from a parent or guardian, and tracking, behavioural monitoring and targeted advertising aimed at children are prohibited. This matters most for coaching institutes, schools and paediatric clinics.

Penalties are steep: up to ₹250 crore^[src] for failing to take reasonable security safeguards, and up to ₹200 crore^[src] for violations involving children’s data.

Do’s for using AI tools

Prefer business plans with clear data terms. For example, Claude’s Team plan states that content is not used for model training by default, and ChatGPT Business makes a similar commitment. Claude Team: ₹1,632–₹2,400/user/month (free tier available) USD at ₹96/USD, excl. tax: Pro $17/mo billed yearly or $20 monthly; Team standard seat $20 yearly or $25 monthly per user (2-150 users). Max from $100/mo.; indicative, checked Sept 2026 ChatGPT Business: ₹1,800–₹2,250/user/month Standard seat ₹1,800/user/mo billed annually or ₹2,250 billed monthly, excl. 18% GST; min 2 users. Premium seat (5x usage) costs more. UPI not offered for Business.; indicative, checked Sept 2026
Keep a simple data register. One sheet listing each tool, what personal data it holds, who has access and how long data is kept.
Mask before you paste. Replace names, phone numbers, PAN, Aadhaar and health details with placeholders before using a general-purpose assistant. Test new tools with sample data first.
Show a notice before bots collect details. A two-line message at the start of a WhatsApp chat or IVR is enough to begin with. Tell callers when a call is recorded or handled by AI.
Keep a human reviewer for AI outputs that affect people: credit or hiring decisions, medical notes, tax filings and replies to notices.
Set retention in each tool. Delete old chat logs, recordings and uploads you no longer need.
Write a one-page breach plan. Who decides, who tells customers, and who informs the Board and, for certain cyber incidents, CERT-In.

Don’ts

Don’t paste client databases, patient records or student lists into free consumer chatbots.
Don’t buy or scrape contact lists for AI-driven outreach. Consent must come from the person, and telemarketing rules apply separately.
Don’t reuse data across purposes without fresh consent, such as sending marketing to numbers collected for delivery updates.
Don’t let freelancers or agencies keep customer data after the work ends. Put deletion in the contract.
Don’t assume a popular tool is automatically compliant. Popularity is not a data processing agreement.

Questions to ask every AI vendor

Before you put customer data into any AI tool, get written answers to these:

Is our data used to train your models? Can we switch that off?
Where is the data stored and processed?
How long do you keep chats, files and recordings, and can we set that period?
Will you delete our data when we stop using the service?
Which other companies (sub-processors) handle our data?
How and how quickly will you tell us about a breach?

If a vendor cannot answer clearly, use it only with masked or non-personal data.

A 30-day starter plan

Week 1: List every tool that holds customer or employee data, including WhatsApp, Google Drive, your billing software and any AI assistant.
Week 2: Check each tool’s data terms, switch off training on your data where possible, and remove access for ex-staff.
Week 3: Draft a short privacy notice for your website and WhatsApp greeting, and a one-page breach plan.
Week 4: Set retention periods, delete old exports and chat backups you no longer need, and brief staff on masking before pasting.

If you are also deciding which AI tools to adopt, AI Marga generates a software-made AI roadmap for ₹1,999. Whatever you choose, run each tool through the vendor questions above before customer data goes in.

Frequently asked questions

Does the DPDP Act apply to my small business?

Almost certainly, if you keep customer, employee, patient or student details in digital form. The Act has no general turnover threshold. The government can exempt some classes of businesses, such as startups, from certain duties, but do not assume you are exempt unless a notification clearly covers you.

From when do I have to comply?

The Rules were notified in November 2025. Most duties, including notice, consent, security, breach reporting and data-principal rights, apply from 13 May 2027. MeitY has floated shortening this window, but no change had been notified as of 30 September 2026. Treat May 2027 as the working date and watch for updates.

Can I paste customer data into ChatGPT or Gemini?

Avoid it on free consumer plans. Mask names, phone numbers, PAN, Aadhaar and health details, or use a business plan whose terms say your content is not used for model training by default. Your business remains responsible for what the AI vendor does with the data you share.

Do I need consent before a WhatsApp AI assistant collects customer details?

When a customer messages you with an enquiry, using their details to answer that enquiry is generally a legitimate use. Using the same details later for marketing is a different purpose and needs clear opt-in. Show a short notice explaining what you collect and why, and honour opt-outs quickly.

Is this article legal advice?

No. It is general information to help small business owners understand the DPDP Act in plain language. It is not legal advice. For decisions about your business, speak to a lawyer or company secretary who can look at your specific facts and the latest notifications.

Sources

dlapiperdataprotection.com: https://www.dlapiperdataprotection.com/index.html?t=law&c=IN
prsindia.org: https://prsindia.org/billtrack/digital-personal-data-protection-bill-2023
india-briefing.com: https://www.india-briefing.com/news/india-dpdp-act-publicly-available-personal-data-46899.html
indiasmeforum.org: https://indiasmeforum.org/digishaastra/assets/docs/Final-META-Report-Card-2025.pdf
claude.com: https://claude.com/pricing

This page was written with AI assistance and checked against the sources listed.