Regulation map
DPDP Act, clause by clause.
India's Digital Personal Data Protection Act, 2023, mapped section by section to elan1 controls. Core duties apply from 13 May 2027. Free to read, no form.
- Last reviewed
- Access
- Read free · no form
In short
The short answer.
What does the DPDP Act mean for AI agents?
The Digital Personal Data Protection Act, 2023 sets India's first comprehensive rules for personal data, and its core duties apply from 13 May 2027. An AI agent that reads or changes personal data is processing it, and the business that deploys the agent answers for that.
- Applies to
- Digital personal data processed in India, and processing outside India connected with offering goods or services to people in India. The Rules were notified on 13 November 2025 and bring the Act into force in phases.
- Key dates
- 11 Aug 2023The Act receives assent (Act 22 of 2023).
- 13 Nov 2025The DPDP Rules are notified; provisions establishing the Data Protection Board of India take effect.
- 13 Nov 2026Provisions on registered consent managers take effect.
- 13 May 2027Core duties of data fiduciaries take effect: notice, consent, security safeguards, breach intimation and the rights of data principals.
Clause by clause
Each duty, and the control that answers it.
| Clause, and what it asks | elan1 control | Mapped to | Claim IDs |
|---|---|---|---|
| Sections 5 and 6: notice and consentProcessing needs a lawful basis, usually consent, for a stated purpose. An agent must not use data for a purpose the notice did not cover. | Purpose limits as rules: elan1 Govern can refuse an agent action that uses data outside the purpose your notice states. |
| |
| Section 8(3): accuracy for decisionsWhere personal data is used to make a decision that affects the person, the fiduciary must ensure it is complete, accurate and consistent. | Recommend-only decisions: where a decision about a person matters most, elan1 Decide recommends and a person decides. |
| |
| Section 8(5) and Rule 6: security safeguardsReasonable safeguards, including access control, masking or encryption where appropriate, and logs that allow unauthorised access to be detected, kept for at least one year. | Aadhaar, PAN and account numbers can be masked before any model sees them. Every agent action, allowed, approved or refused, is recorded with the agent's identity, and the record can be kept for as long as your policy requires. |
| |
| Where the data is processedThe Act covers processing in India, and processing outside India connected with offering goods or services to people in India. | India data residency is available in AWS Mumbai, and elan1 Run runs on infrastructure you name: the cloud, your data centre or an appliance. |
|
Mappings are drafts for your counsel and auditors. They are not certification, legal advice or regulator approval.
By industry
Where this rule shows up.
Retail, Consumer and Commerce
DPDP Act 2023 (marketing consent)
- elan1 Propel
- elan1 Govern
Banking, Financial Services and Insurance
DPDP Act 2023
Run, Govern purpose rules.
- elan1 Run
- elan1 Govern
Healthcare, Wellness and Lifestyle
DPDP Act 2023 (main duties from 13 May 2027)
Govern purpose rules, Run.
- elan1 Govern
- elan1 Run
Manufacturing and Distribution
DPDP Act 2023
- elan1 Govern
Professional Services and GCCs
DPDP Act 2023
- elan1 Govern
Public Sector
DPDP Act 2023
Run, Govern purpose rules.
- elan1 Run
- elan1 Govern
Read more
The explainer, and the official text.
Regulation watch
India's DPDP Act: what it means for agents that act
Core duties apply from 13 May 2027. Agents that read personal data inherit every one.
4 min read
Perspectives
Sovereign AI is a procurement question, not a GPU question
Where the hardware sits matters less than whether you can name, swap and audit every part.
3 min read
Questions
DPDP Act, plainly.
The Digital Personal Data Protection Act, 2023 received assent on 11 August 2023. Its Rules were notified on 13 November 2025, when provisions establishing the Data Protection Board took effect. Consent manager provisions apply from 13 November 2026, and the core duties of data fiduciaries apply from 13 May 2027.
No, and it does not need to. An agent that reads a customer file, drafts a message to a patient or updates an employee record is processing personal data on behalf of the data fiduciary, the business that decides why and how the data is used. Under Rule 13, significant data fiduciaries must also take due care that the algorithmic software they use is not likely to pose a risk to the rights of data principals.
The Rules ask for logs that allow unauthorised access to be detected to be kept for at least one year. elan1 Govern records every agent action with the agent's identity, and the record can be kept for as long as your policy requires.
The Schedule to the Act sets penalties per instance of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for failing to notify a breach or to meet the additional duties towards children. The Data Protection Board of India decides penalties after an inquiry.
In India by default: AWS Mumbai, three availability zones, no US region. elan1 Run also runs in your data centre or on an appliance. Personal fields are masked before any model call.
No. Mappings are drafts for your counsel and auditors. They are not certification, legal advice or regulator approval. Each row names the clause or duty, what it asks, the elan1 control that answers it and, where one is assigned, the claim ID behind it, so your counsel and auditors can test each mapping against the receipts.
Other maps
The other rules we map.
- Allowed · Approved by Asha R.
- Held for CFO
- Refused · rule 4.2