Laws and data licensing
India: privacy laws and AI data licensing
Short answer
If your records include people in India, the main rules are: Digital Personal Data Protection Act.
In short
- Country
- India
- Main privacy laws
- Digital Personal Data Protection Act.
- Note
- Consent-centered; rules are being phased in.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
Consent-centered; rules are being phased in.
For suppliers#
- SourceX works with businesses based in India when at least 90% of their records are in English
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
What is the status of the DPDP Act and the DPDP Rules 2025?#
The Digital Personal Data Protection Act, 2023 is being brought into force in phases: the government notified the DPDP Rules, 2025 in November 2025, with an 18-month phased compliance timeline for organisations. The Data Protection Board of India, set up under section 18 of the Act, can inquire into personal data breaches and non-compliance and impose monetary penalties.
The Act covers digital personal data processed in India and also processing outside India when it is connected with offering goods or services to people in India. It does not apply to personal data that the person made publicly available, or that someone was legally required to publish. Penalties are set in the Schedule: up to 250 crore rupees for failing to take reasonable security safeguards against a breach, and up to 150 crore rupees for breaching the additional duties of a Significant Data Fiduciary.
When does consent cover reusing records under the DPDP Act?#
Only when the person agreed to that specific purpose, or another ground in the Act applies. Section 4 allows processing for a lawful purpose either with consent or for certain legitimate uses, and section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to the data needed for the stated purpose.
A notice must accompany or precede each consent request, and under the Rules it must be a standalone notice that explains the specific purpose. People can withdraw consent, including through a registered Consent Manager, which the Rules require to be an Indian company. The legitimate use in section 7(a) covers only the specified purpose for which a person voluntarily gave their data, so it does not stretch to a new use the person was never told about.
Section 17(2)(b) exempts processing for research, archiving or statistical purposes, but only where the data is not used to take a decision specific to a person and the processing follows prescribed standards. In practice, licensing identifiable records to an AI developer is a new purpose that ordinary service consent rarely covers, which is why records are usually reviewed so they no longer identify anyone before any release. Counsel confirms which ground, if any, fits the specific records.
Can personal data be transferred outside India under section 16?#
Yes, by default. Section 16(1) works as a restricted list: the Central Government may, by notification, restrict transfers by a Data Fiduciary to countries or territories it names, and transfers to other destinations are not barred by the Act itself. Section 16(2) keeps in force any other Indian law that gives a higher degree of protection or a stricter restriction on transfers, so sector rules still apply on top of the Act.
Two further limits matter. A Significant Data Fiduciary must follow government-specified restrictions on certain categories of data, including local storage where required. And the transfer question sits alongside the consent question: moving records abroad does not by itself create a right to reuse them for a new purpose. Check current notifications on the official gazette before any transfer, since the restricted list can change.
Which DPDP checkpoints apply before records leave the business?#
The order below follows the questions a reviewer usually works through for records that include people in India. Records that no longer identify anyone fall outside most of these checkpoints; the rest apply to records that still do.
SourceX can consider companies in India when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.
| Checkpoint | Provision | Question to answer | Typical evidence |
|---|---|---|---|
| Scope | Section 3 | Is the data digital personal data, processed in India or tied to offering goods or services to people in India? | Data map showing where records came from and who they describe |
| Lawful ground | Sections 4, 6 and 7 | Did people consent to this specific purpose, or does a legitimate use cover it? | Consent records and the notice text shown at collection |
| Notice | Section 5 and the Rules | Was a standalone notice given that explained the specific purpose? | Archived notice versions with dates |
| Research exemption | Section 17(2)(b) | Is the use research, archiving or statistics, with no decisions about specific people? | Written purpose statement and the standards followed |
| Cross-border transfer | Section 16 | Is the destination on a restricted list, or does a stricter sector law apply? | Gazette check on the transfer date; sector rule review |
| Significant Data Fiduciary | Section 10 | Has the business been notified as one, triggering an India-based DPO, an independent data auditor and impact assessments? | Notification status; latest impact assessment and audit |
| Security safeguards | Section 8 and the Schedule | Are reasonable safeguards in place for the copy that will move? | Access controls, encryption and breach procedures |
Sources for this section
- The DPDP Act, 2023 sets its scope (section 3), consent and legitimate-use grounds (sections 4, 6 and 7), Significant Data Fiduciary duties (section 10), cross-border transfer powers (section 16), the research, archiving and statistical exemption (section 17(2)(b)) and the penalty Schedule. Source
- The official Gazette text of the Act sets maximum penalties of 250 crore rupees for failing to take reasonable security safeguards and 150 crore rupees for breaching Significant Data Fiduciary duties. Source
- The government notified the DPDP Rules, 2025 in November 2025 with an 18-month phased compliance timeline, standalone consent notices and Consent Managers that must be Indian companies. Source
- The government's backgrounder on the Rules describes the phased compliance period, Significant Data Fiduciary audits and impact assessments, and government-directed restrictions on certain data categories, including local storage where needed. Source
Frequently asked questions
Which privacy laws apply to records about people in India?
Digital Personal Data Protection Act. Consent-centered; rules are being phased in.
Can a company based in India license its data through SourceX?
Yes, when at least 90% of the company's records are in English. U.S. companies are SourceX's priority, records are reviewed against the rules that apply, and personal details are removed before anything is shared.
Can a U.S. business license records that include customers in India?
Records tied to India are reviewed against its rules or excluded from the license, and personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.