DPDP Act 2023 · and your Sovereign Artificial Intelligence (AI)

DPDP Act and AI: what the platform does, and what stays your duty

This page explains how India's Digital Personal Data Protection Act, 2023 bears on AI systems, and what BiltIQ's platform does about it. Owning the platform on your servers, the Agent OS platform gate and approval records reduce what you must account for. Consent, notices, rights requests and breach reporting stay the buyer's duty. It is not legal advice.

Book a paid pilot

This is an explainer, not legal advice. Confirm your obligations with qualified counsel.

Agent OS outbound calls, blocked by default (platform gate): Off
Business OS data-changing tools that wait for a person: 23
Duties the Act sets, each with its section below: 8
Consent, notices, rights requests and breach reporting: Yours

Book a scoping call

30 minutes with an engineer. We map your workload and walk you through the product on sample data. You leave with a written next step.

Full Name *

Work Email *

Phone

Organisation

What are you exploring? *

Industry

How do you want to buy?

Own it (on your servers)Subscribe (BiltIQ's India cluster, 2027 waitlist)Not sure yet

Message

I agree that Aarna Tech Consultants Private Limited (BiltIQ AI) may use these details to respond to my enquiry, as set out in the Privacy Policy. I can withdraw consent, or ask for my data to be corrected or erased, at any time by writing to [email protected]. Send me occasional product updates by email. I can unsubscribe at any time.

We use your details only to reply to you. We never sell them. Privacy Policy.
By submitting, you agree to our Terms and Conditions.

Terms the Act uses

Who is who under the DPDP Act

Data principal

s.2(j)

The person the data is about. For a child, it includes the parent or lawful guardian.

Data fiduciary

s.2(i), s.8(1)

The organisation that decides why and how personal data is processed. It answers for the processing.

Data processor

s.2(k), s.8(2)

An organisation that processes personal data on a data fiduciary's behalf.

Consent manager

s.2(g), s.6(7)–(9); Rules, rule 4

A body registered with the Data Protection Board that lets a person give, manage, review and withdraw consent through one platform.

Significant data fiduciary

s.2(z), s.10

A data fiduciary the central government notifies, looking at factors such as the volume and sensitivity of the data and the risk to people's rights.

Child

s.2(f)

Anyone who has not turned 18.

What the Act asks

What the DPDP Act 2023 asks of organisations using AI

Lawful purpose

ss.4–7

Process personal data only for a lawful purpose: with the person's consent, or for one of the legitimate uses the Act lists. Every request for consent comes with, or after, a notice of what data is used and why.

Rights

s.6(4), ss.11–14

People can get a summary of their data and how it is processed, have it corrected or erased, withdraw consent as easily as they gave it, nominate someone to act for them, and raise grievances.

Safeguards

s.8(5); Rules, rule 6

Take reasonable security safeguards to prevent a personal-data breach, including for processing done by a data processor.

Breach intimation

s.8(6); Rules, rule 7

Tell the Data Protection Board of India and each affected person about a personal-data breach, in the form the DPDP Rules set.

Processors

s.8(1), 8(2), 8(7); s.6(6)

The data fiduciary answers for processing done on its behalf. It may use a data processor only under a valid contract, and must have it erase data when the purpose ends or consent is withdrawn.

Children

s.9; Rules, rules 10 and 12

Get verifiable consent from a parent or lawful guardian before processing a child's data. Do not process it in a way likely to harm the child's well-being, and do not track, behaviourally monitor or target advertising at children. The DPDP Rules list limited exemptions, for example for educational institutions.

Significant Data Fiduciaries

s.10; Rules, rule 13

Organisations the government notifies carry extra duties: a Data Protection Officer based in India, an independent data auditor, and periodic impact assessments and audits.

Timing and penalties

s.1(2), s.33 and Schedule

The duties come into force in phases under the DPDP Rules, and the Act sets penalties for breaches. Check the current timeline in the official DPDP Rules.

Does and does not

What your AI platform does, and what it does not

The platform does

Own it: your AI's models run on your GPU server, so no cloud model provider sits in the model path.
Agent OS platform gate: outbound calls are blocked by default; an unconfigured install blocks all outbound calls. In on-prem-required mode, no outbound host can be allowed at all.
Approvals: irreversible and high-consequence actions your AI proposes in Agent OS pause for human approval; in Business OS, all 23 data-changing copilot tools wait for a person.
Privacy library: our MIT-licensed library detects Indian personal data such as Aadhaar and PAN and pseudonymises it; where it runs is set per deployment.

The platform does not (disclosed)

Business OS files are stored in GCS or S3 cloud storage today; on-prem file storage is a roadmap item. Business OS makes no Claude or OpenAI calls; it has a Kimi cloud-model option that is off by default.
Learning OS cannot be installed on-premises today. LMS course files sit in AWS (India region); LMS quizzes have a cloud fallback (Kimi) that is on by default and can be switched off; the AI Teacher's embeddings, vision and voice default to cloud services unless repointed. For school and college trials, we plan to run AI Teacher's voice and embeddings on local models; we will confirm the setup in writing before a trial starts.
Subscribe tier: inference runs on BiltIQ's GPU cluster in India. It is not yet on sale; its data terms are published at launch.
Managed service: BiltIQ monitors the GPU server and services remotely, with your permission and no access to your documents.

What stays your duty

What stays your duty under the DPDP Act, whichever platform runs your AI

Your AI can keep the record. These decisions stay with you:

Notices and consent, including verifiable consent from a parent or lawful guardian before a child's data is processed.
Honouring consent that a person gives or withdraws through a registered consent manager, where they use one.
Answering requests for a summary of processing, correction, completion, updating and erasure, and nominations, and handling grievances.
Deciding retention, and erasing data when its purpose ends unless a law requires you to keep it. The DPDP Rules also set a minimum period for keeping processing logs.

Reasonable security safeguards, and telling the Board and affected people about a breach.
If you are notified as a Significant Data Fiduciary: the Data Protection Officer, the independent data auditor, impact assessments and audits.
Contracts with every processor you use, including BiltIQ wherever it processes personal data for you. You answer for what your processors do on your behalf.

Where BiltIQ processes personal data for you, for example in a pilot on our servers or when we run Learning OS for a school, we act as your data processor: we process it on your instructions and under the contract, which sets the safeguards and when we erase the data. You remain the data fiduciary.

A correction worth knowing

Does the DPDP Act require data to stay in India?

No, not in general. The Act lets the government restrict transfers of personal data to countries it notifies; it does not ban every transfer. The DPDP Rules let the government require Significant Data Fiduciaries to keep certain personal data in India, and set conditions on making personal data available to a foreign state. Sector rules can be stricter, so check your regulator's rules as well. On an Own-it Agent OS install, the files your AI reads stay on your own servers, whatever the rule.

FAQ

Frequently asked questions

Does on-premise AI make us DPDP compliant?

No. Owning your AI on your own servers reduces what you must account for, because no cloud model provider sits in the model path. In BiltIQ Agent OS, the platform gate blocks outbound calls by default and high-consequence actions wait for approval. Consent, notices, rights requests, retention and breach reporting stay your duty under the DPDP Act, whichever vendor runs your AI.

When do the DPDP Act's main duties apply?

The DPDP Act's duties come into force in phases under the DPDP Rules, and the Act sets penalties for organisations that breach them. Check the current timeline in the official DPDP Rules, or with qualified counsel. Organisations choosing a platform for their AI now are choosing the architecture they will have to account for.

Does BiltIQ's AI platform send personal data to cloud services?

It depends on the product. An Own-it Agent OS install blocks outbound calls by default. Business OS stores files in GCS or S3 and makes no Claude or OpenAI calls; its Kimi option is off by default. Learning OS keeps LMS files in AWS (India region), its Kimi quiz fallback is on by default and can be switched off, and AI Teacher embeddings, vision and voice default to cloud.

What does the DPDP Act require for children's data in an AI tutor?

Before processing a child's data, the data fiduciary must obtain verifiable consent from a parent or lawful guardian, and must not track, behaviourally monitor or target advertising at children, subject to limited exemptions in the DPDP Rules. For BiltIQ's AI Tutor, the school or college is the data fiduciary; BiltIQ processes data for it. AI Teacher voice and embeddings default to cloud services today. This is not legal advice.

Business OS controls Learning OS: what runs where on-premise AI pricing What your DPO will ask about your AI vendor The compensating-control trap Shadow AI: staff pasting company data AI transformation in regulated sectors

Map your AI workload against the DPDP Act

Bring one workload. We'll show you on a 30-minute call where your data would sit in each product, and what would stay your duty.

Book a scoping call Book a paid pilot

We'll walk you through it on sample data.