{"id":232,"date":"2026-10-21T18:30:00","date_gmt":"2026-10-21T13:00:00","guid":{"rendered":"https:\/\/www.graveiensai.com\/blog\/?p=232"},"modified":"2026-10-21T18:30:00","modified_gmt":"2026-10-21T13:00:00","slug":"dpdp-act-ai-training-data","status":"publish","type":"post","link":"https:\/\/www.graveiensai.com\/blog\/dpdp-act-ai-training-data\/","title":{"rendered":"DPDP Act and AI Training Data: What Data Buyers and Vendors Must Do in 2026\u201327"},"content":{"rendered":"\n<p class=\"last-updated wp-block-paragraph\"><em>Last updat\u00aded: Octo\u00adber 2026<\/em><\/p>\n\n\n\n<div class=\"wp-block-group key-takeaways\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Key take\u00adaways<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The DPDP Act applies to AI train\u00ading data when\u00adev\u00ader a dataset holds dig\u00adi\u00adtal per\u00adson\u00adal data about an iden\u00adti\u00adfi\u00adable per\u00adson. That includes voic\u00ades, faces, names in free text and speak\u00ader meta\u00adda\u00adta.<\/li>\n\n\n\n<li>The DPDP Rules, 2025 start in three phas\u00ades. Board rules applied on noti\u00adfi\u00adca\u00adtion. Con\u00adsent man\u00adag\u00ader reg\u00adis\u00adtra\u00adtion fol\u00adlows after 12 months (around 13 Novem\u00adber 2026). Most duties fol\u00adlow after 18 months (around 13 May 2027).<\/li>\n\n\n\n<li>Con\u00adsent must be free, spe\u00adcif\u00adic, informed, uncon\u00addi\u00adtion\u00adal and unam\u00adbigu\u00adous. AI train\u00ading should appear as its own named pur\u00adpose in an item\u00adized, plain-lan\u00adguage notice.<\/li>\n\n\n\n<li>The buy\u00ader is usu\u00adal\u00adly the Data Fidu\u00adcia\u00adry and stays legal\u00adly respon\u00adsi\u00adble. The col\u00adlec\u00adtion or anno\u00adta\u00adtion ven\u00addor acts as a Data Proces\u00adsor under a valid con\u00adtract and must sup\u00adport secu\u00adri\u00adty, breach report\u00ading and era\u00adsure.<\/li>\n\n\n\n<li>Penal\u00adties reach up to \u20b9250 crore for secu\u00adri\u00adty fail\u00adures. Check con\u00adsent evi\u00addence before any file enters a train\u00ading pipeline, not after.<\/li>\n<\/ul>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The DPDP Act AI train\u00ading data ques\u00adtion has moved from legal the\u00ado\u00adry to pro\u00adcure\u00adment check\u00adlists. Indi\u00ada\u2019s Dig\u00adi\u00adtal Per\u00adson\u00adal Data Pro\u00adtec\u00adtion Act, 2023 and the DPDP Rules, 2025 now gov\u00adern how teams col\u00adlect, label, store and delete per\u00adson\u00adal data for mod\u00adel train\u00ading. Most core duties start in May 2027, and datasets bought this quar\u00adter will still be in use then.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide is for AI teams that buy speech, video or text data, and for the ven\u00addors that col\u00adlect and anno\u00adtate it. It cov\u00aders scope, the ver\u00adi\u00adfied rules time\u00adline, con\u00adsent and proces\u00adsor duties. It ends with an 8\u2011point buy\u00ader check\u00adlist for your next ven\u00addor review. If you track India data pro\u00adtec\u00adtion and AI pol\u00adi\u00adcy, the time\u00adline sec\u00adtion is the one to book\u00admark.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>This arti\u00adcle is gen\u00ader\u00adal infor\u00adma\u00adtion, not legal advice. Check the Act, the Rules and your own coun\u00adsel before you act on it.<\/em><\/p>\n\n\n\n<p class=\"cta-inline wp-block-paragraph\"><strong>Sourc\u00ading Indi\u00adan data for a 2027 mod\u00adel?<\/strong> <a href=\"https:\/\/www.graveiensai.com\/contact-us\">Ask us for our con\u00adsent &amp; data-han\u00addling pack<\/a> before you sign a ven\u00addor.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What does the DPDP Act cover for AI training data?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The DPDP Act cov\u00aders the pro\u00adcess\u00ading of dig\u00adi\u00adtal per\u00adson\u00adal data in India. Per\u00adson\u00adal data means any data about an indi\u00advid\u00adual who is iden\u00adti\u00adfi\u00adable by or in rela\u00adtion to that data. Pro\u00adcess\u00ading includes col\u00adlec\u00adtion, record\u00ading, struc\u00adtur\u00ading, stor\u00adage, use, shar\u00ading and era\u00adsure. That maps direct\u00adly onto col\u00adlec\u00adtion, anno\u00adta\u00adtion and mod\u00adel train\u00ading. In short: if a per\u00adson can be iden\u00adti\u00adfied, the Act applies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sec\u00adtion 3 of the Act applies to per\u00adson\u00adal data col\u00adlect\u00aded in dig\u00adi\u00adtal form in India, or col\u00adlect\u00aded on paper and dig\u00adi\u00adtized lat\u00ader. It also reach\u00ades pro\u00adcess\u00ading out\u00adside India when that pro\u00adcess\u00ading is con\u00adnect\u00aded with offer\u00ading goods or ser\u00advices to peo\u00adple in India [1].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two exclu\u00adsions mat\u00adter for AI teams. The Act does not apply to data processed for pure\u00adly per\u00adson\u00adal or domes\u00adtic pur\u00adpos\u00ades. It also does not apply to per\u00adson\u00adal data made pub\u00adlic by the per\u00adson it relates to, or by some\u00adone legal\u00adly required to pub\u00adlish it. We cov\u00ader that sec\u00adond exclu\u00adsion below, because it is often mis\u00adread as a scrap\u00ading license.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Four roles to map before any data moves<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Every oblig\u00ada\u00adtion in the Act attach\u00ades to a role. Map these on day one of a project, in writ\u00ading.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Role<\/th><th>Mean\u00ading in the Act<\/th><th>Typ\u00adi\u00adcal par\u00adty in an AI data project<\/th><\/tr><\/thead><tbody><tr><td>Data Prin\u00adci\u00adpal<\/td><td>The indi\u00advid\u00adual the data relates to. For a child, it includes the par\u00adent or law\u00adful guardian.<\/td><td>Speak\u00aders, cam\u00adera wear\u00aders, bystanders, anno\u00adta\u00adtors<\/td><\/tr><tr><td>Data Fidu\u00adcia\u00adry<\/td><td>Decides the pur\u00adpose and means of pro\u00adcess\u00ading, alone or with oth\u00aders.<\/td><td>The AI com\u00adpa\u00adny com\u00admis\u00adsion\u00ading or buy\u00ading the dataset<\/td><\/tr><tr><td>Data Proces\u00adsor<\/td><td>Process\u00ades per\u00adson\u00adal data on behalf of a Data Fidu\u00adcia\u00adry.<\/td><td>Col\u00adlec\u00adtion, tran\u00adscrip\u00adtion and anno\u00adta\u00adtion ven\u00addors<\/td><\/tr><tr><td>Con\u00adsent Man\u00adag\u00ader<\/td><td>Reg\u00adis\u00adtered with the Board. Lets a per\u00adson give, man\u00adage, review and with\u00addraw con\u00adsent on one plat\u00adform.<\/td><td>An option\u00adal con\u00adsent plat\u00adform cho\u00adsen by the indi\u00advid\u00adual<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Roles fol\u00adlow deci\u00adsions, not job titles. A ven\u00addor can be your proces\u00adsor for the dataset and also a fidu\u00adcia\u00adry for its own par\u00adtic\u00adi\u00adpant onboard\u00ading and pay\u00adment records. Agree that split before kick\u00adoff.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">When do the DPDP Rules 2025 take effect?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The DPDP Rules, 2025 were pub\u00adlished in the Gazette as G.S.R. 846(E), dat\u00aded 13 Novem\u00adber 2025, and announced by the gov\u00adern\u00adment on 14 Novem\u00adber 2025. They com\u00admence in three phas\u00ades. Board rules applied at once. Con\u00adsent man\u00adag\u00ader reg\u00adis\u00adtra\u00adtion starts one year lat\u00ader. Notice, secu\u00adri\u00adty, breach, chil\u00addren\u2019s data and rights duties start eigh\u00adteen months lat\u00ader, around 13 May 2027.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rule 1 of the Rules sets the phas\u00ades [2]. The gov\u00adern\u00admen\u00adt\u2019s own sum\u00adma\u00adry describes \u201can eigh\u00adteen-month peri\u00adod for phased com\u00adpli\u00adance\u201d [3]. Here is what each phase means for AI data work.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Phase<\/th><th>Rules that com\u00admence<\/th><th>Approx\u00adi\u00admate date<\/th><th>What it means for AI data<\/th><\/tr><\/thead><tbody><tr><td>On noti\u00adfi\u00adca\u00adtion<\/td><td>Rules 1, 2 and 17 to 21: def\u00adi\u00adn\u00adi\u00adtions and the Data Pro\u00adtec\u00adtion Board<\/td><td>13 Novem\u00adber 2025<\/td><td>Board frame\u00adwork exists; oper\u00adat\u00ading duties not yet in force<\/td><\/tr><tr><td>+12 months<\/td><td>Rule 4: reg\u00adis\u00adtra\u00adtion and oblig\u00ada\u00adtions of Con\u00adsent Man\u00adagers<\/td><td>Around 13 Novem\u00adber 2026<\/td><td>Reg\u00adis\u00adtered con\u00adsent plat\u00adforms can begin oper\u00adat\u00ading<\/td><\/tr><tr><td>+18 months<\/td><td>Rules 3, 5 to 16, 22 and 23: notice, secu\u00adri\u00adty, breach, reten\u00adtion, chil\u00addren, Sig\u00adnif\u00adi\u00adcant Data Fidu\u00adcia\u00adries, rights, trans\u00adfers, research stan\u00addards<\/td><td>Around 13 May 2027<\/td><td>Full duties for buy\u00aders and their ven\u00addors<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Some advis\u00aders count each date one day lat\u00ader, from the 14 Novem\u00adber announce\u00adment. Con\u00adfirm exact dates with coun\u00adsel before you plan around them.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"800\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-rules-2025-phases-table.webp\" alt=\"Table of the three DPDP Rules 2025 phases: on notification for Board rules, plus 12 months for consent manager registration, and plus 18 months for notice, security, breach, children and rights duties\" class=\"wp-image-229\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-rules-2025-phases-table.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-rules-2025-phases-table-300x150.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-rules-2025-phases-table-1024x512.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-rules-2025-phases-table-768x384.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-rules-2025-phases-table-1536x768.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">The DPDP Rules, 2025 com\u00admence in three phas\u00ades count\u00aded from noti\u00adfi\u00adca\u00adtion.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Has the 18-month timeline been shortened?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Not as of mid-Octo\u00adber 2026. In Jan\u00adu\u00adary 2026, Busi\u00adness Stan\u00addard report\u00aded a MeitY pro\u00adpos\u00adal to cut the win\u00addow to 12 months for Sig\u00adnif\u00adi\u00adcant Data Fidu\u00adcia\u00adries [4]. Some pro\u00advi\u00adsions would also start soon\u00ader. We found no Gazette noti\u00adfi\u00adca\u00adtion mak\u00ading that change as of this update.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One small change did land. On 5 Octo\u00adber 2026, MeitY issued the DPDP (Removal of Dif\u00adfi\u00adcul\u00adties) Order, 2026, S.O. 5458(E), under Sec\u00adtion 43 of the Act. It adds the word \u201cof\u201d in Sec\u00adtion 9(1) and changes \u201caudit\u201d to \u201cdata audit\u201d in Sec\u00adtion 10(2)\u00a9(ii). Law firm reviews describe both edits as edi\u00adto\u00adr\u00adi\u00adal. The order moves no dead\u00adline.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our advice: plan to May 2027, but build your con\u00adsent and breach process\u00ades as if the date could move ear\u00adli\u00ader.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What counts as personal data in AI training datasets?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Per\u00adson\u00adal data in train\u00ading datasets is any data about an indi\u00advid\u00adual who can be iden\u00adti\u00adfied from it, direct\u00adly or in com\u00adbi\u00adna\u00adtion. In AI work, that includes voice record\u00adings, faces in video, names and phone num\u00adbers in tran\u00adscripts, speak\u00ader meta\u00adda\u00adta such as age band and dis\u00adtrict, and anno\u00adta\u00adtor IDs. Remov\u00ading names alone rarely makes a dataset non-iden\u00adti\u00adfi\u00adable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is where per\u00adson\u00adal data hides, by data type.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Speech.<\/strong> A voice record\u00ading is data about the speak\u00ader. The spo\u00adken con\u00adtent may name oth\u00ader peo\u00adple. Meta\u00adda\u00adta such as gen\u00adder, age band, dis\u00adtrict and dialect nar\u00adrows iden\u00adti\u00adty fur\u00adther. Our guide to <a href=\"https:\/\/www.graveiensai.com\/blog\/indic-speech-data-collection\/\">Indic speech data col\u00adlec\u00adtion<\/a> cov\u00aders how these fields are spec\u00adi\u00adfied.<\/li>\n\n\n\n<li><strong>Ego\u00adcen\u00adtric and oth\u00ader video.<\/strong> Faces, hands with jew\u00adel\u00adry or tat\u00adtoos, num\u00adber plates, screens, doc\u00adu\u00adments, house num\u00adbers and bystanders who nev\u00ader signed any\u00adthing. See what to ask an <a href=\"https:\/\/www.graveiensai.com\/blog\/egocentric-data-collection-vendor\/\">ego\u00adcen\u00adtric data col\u00adlec\u00adtion ven\u00addor<\/a> about bystanders.<\/li>\n\n\n\n<li><strong>Text and chat logs.<\/strong> Names, phone num\u00adbers, address\u00ades and account num\u00adbers inside free text. Code-mixed Indic text is hard\u00ader to redact auto\u00admat\u00adi\u00adcal\u00adly than Eng\u00adlish.<\/li>\n\n\n\n<li><strong>Work\u00adforce data.<\/strong> Anno\u00adta\u00adtor IDs, pro\u00adduc\u00adtiv\u00adi\u00adty logs and pay\u00adment details. Anno\u00adta\u00adtors are Data Prin\u00adci\u00adpals too.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Is publicly available data exempt?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Only in part. Sec\u00adtion 3\u00a9(ii) excludes per\u00adson\u00adal data made pub\u00adlic by the Data Prin\u00adci\u00adpal her\u00adself, or by some\u00adone legal\u00adly required to pub\u00adlish it [1]. The Act\u2019s own exam\u00adple is a per\u00adson who blogs her views on social media.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The exemp\u00adtion turns on who made the data pub\u00adlic. A scraped cor\u00adpus mix\u00ades self-pub\u00adlished posts with reposts, leaks, aggre\u00adga\u00adtor list\u00adings and screen\u00adshots that the per\u00adson nev\u00ader pub\u00adlished. Law firm com\u00admen\u00adtary in 2026 notes that large-scale com\u00admer\u00adcial reuse for AI train\u00ading remains unset\u00adtled. Doc\u00adu\u00adment prove\u00adnance per source, and do not assume a scrape sits out\u00adside the Act.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does the research exemption cover model training?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Rarely for com\u00admer\u00adcial prod\u00aducts. Sec\u00adtion 17(2)(b) says the Act does not apply to pro\u00adcess\u00ading nec\u00ades\u00adsary for research, archiv\u00ading or sta\u00adtis\u00adti\u00adcal pur\u00adpos\u00ades. Two con\u00addi\u00adtions apply. The data must not be used to take any deci\u00adsion spe\u00adcif\u00adic to a Data Prin\u00adci\u00adpal. The pro\u00adcess\u00ading must fol\u00adlow pre\u00adscribed stan\u00addards [1].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rule 16 and the Sec\u00adond Sched\u00adule set those stan\u00addards [2]. Pro\u00adcess\u00ading must be law\u00adful and lim\u00adit\u00aded to nec\u00ades\u00adsary data. It must aim for accu\u00adra\u00adcy, keep data only as long as need\u00aded, apply secu\u00adri\u00adty safe\u00adguards and have clear account\u00adabil\u00adi\u00adty. Rule 16 sits in the 18-month phase. A mod\u00adel that lat\u00ader dri\u00adves deci\u00adsions about indi\u00advid\u00adu\u00adals, such as cred\u00adit scor\u00ading or per\u00adson\u00adal\u00adized offers, is a weak fit. Treat the exemp\u00adtion as nar\u00adrow and take advice before rely\u00ading on it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What about anonymized data?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Act does not define anonymiza\u00adtion. Data that is tru\u00adly not about an iden\u00adti\u00adfi\u00adable per\u00adson falls out\u00adside the def\u00adi\u00adn\u00adi\u00adtion of per\u00adson\u00adal data. In prac\u00adtice, voic\u00ades and faces are hard to make non-iden\u00adti\u00adfi\u00adable, so most raw speech and video datasets stay in scope.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What consent does the DPDP Act require for AI training data?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Con\u00adsent must be free, spe\u00adcif\u00adic, informed, uncon\u00addi\u00adtion\u00adal and unam\u00adbigu\u00adous, giv\u00aden by a clear affir\u00adma\u00adtive action. It cov\u00aders only the data need\u00aded for the spec\u00adi\u00adfied pur\u00adpose. It must fol\u00adlow an item\u00adized, plain-lan\u00adguage notice, offered in Eng\u00adlish or any Eighth Sched\u00adule lan\u00adguage. With\u00addraw\u00adal must be as easy as giv\u00ading con\u00adsent, and the fidu\u00adcia\u00adry must prove it all.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Those words come from Sec\u00adtions 5 and 6 of the Act [1]. The DPDP Rules 2025 con\u00adsent notice stan\u00addard sits in Rule 3 [2]. The notice must stand on its own and item\u00adize the per\u00adson\u00adal data. It must state the spec\u00adi\u00adfied pur\u00adpose and the uses it enables. It must also link to ways to with\u00addraw con\u00adsent, exer\u00adcise rights and com\u00adplain to the Board.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For AI data projects, four con\u00adse\u00adquences fol\u00adlow.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Name AI train\u00ading as its own pur\u00adpose.<\/strong> Con\u00adsent giv\u00aden for a ser\u00advice does not cov\u00ader mod\u00adel train\u00ading. The Act\u2019s telemed\u00adi\u00adcine exam\u00adple shows con\u00adsent shrink\u00ading to what the stat\u00aded pur\u00adpose needs.<\/li>\n\n\n\n<li><strong>Offer the notice in the par\u00adtic\u00adi\u00adpan\u00adt\u2019s lan\u00adguage.<\/strong> Sec\u00adtions 5(3) and 6(3) require the option of Eng\u00adlish or any lan\u00adguage in the Eighth Sched\u00adule to the Con\u00adsti\u00adtu\u00adtion. For Indic speech col\u00adlec\u00adtion, that usu\u00adal\u00adly means the lan\u00adguage being record\u00aded.<\/li>\n\n\n\n<li><strong>Make with\u00addraw\u00adal real.<\/strong> Under Sec\u00adtion 6(6), the fidu\u00adcia\u00adry must stop pro\u00adcess\u00ading with\u00adin a rea\u00adson\u00adable time and make its proces\u00adsors stop too. Decide ear\u00adly which arte\u00adfacts get delet\u00aded: raw files, tran\u00adscripts, labels and derived sub\u00adsets.<\/li>\n\n\n\n<li><strong>Keep proof.<\/strong> Sec\u00adtion 6(10) puts the bur\u00adden on the fidu\u00adcia\u00adry to prove that notice was giv\u00aden and con\u00adsent was obtained.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Con\u00adsent is not the only law\u00adful ground. Sec\u00adtion 7 lists \u201ccer\u00adtain legit\u00adi\u00admate uses\u201d, such as legal oblig\u00ada\u00adtions, med\u00adical emer\u00adgen\u00adcies and employ\u00adment. There is no gen\u00ader\u00adal \u201clegit\u00adi\u00admate inter\u00adests\u201d ground of the GDPR kind. For com\u00admis\u00adsioned data col\u00adlec\u00adtion, con\u00adsent is usu\u00adal\u00adly the prac\u00adti\u00adcal basis. For voice projects, <a href=\"https:\/\/www.graveiensai.com\/contact-us\">ask us for our speak\u00ader con\u00adsent tem\u00adplate<\/a>, which is built around these rules.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Consent manager under the DPDP Act<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A Data Prin\u00adci\u00adpal may give, man\u00adage, review or with\u00addraw con\u00adsent through a Con\u00adsent Man\u00adag\u00ader reg\u00adis\u00adtered with the Board (Sec\u00adtion 6(7) to 6(9)). Rule 4 on reg\u00adis\u00adtra\u00adtion com\u00admences one year after the Rules were pub\u00adlished, around 13 Novem\u00adber 2026 [2].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The First Sched\u00adule sets the bar. A Con\u00adsent Man\u00adag\u00ader must be a com\u00adpa\u00adny incor\u00adpo\u00adrat\u00aded in India with a net worth of at least \u20b92 crore. It must not be able to read the per\u00adson\u00adal data it helps share. It must keep con\u00adsent records for at least sev\u00aden years and avoid con\u00adflicts of inter\u00adest with Data Fidu\u00adcia\u00adries. For buy\u00aders, the prac\u00adti\u00adcal step is sim\u00adple. Make sure your con\u00adsent records can accept and hon\u00ador sig\u00adnals from a reg\u00adis\u00adtered plat\u00adform if a par\u00adtic\u00adi\u00adpant uses one.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Children and guardians<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A child is any\u00adone under 18 (Sec\u00adtion 2(f)). Before pro\u00adcess\u00ading a child\u2019s data, the fidu\u00adcia\u00adry must obtain ver\u00adi\u00adfi\u00adable con\u00adsent from a par\u00adent (Sec\u00adtion 9(1)). Rule 10 requires due dili\u00adgence that the per\u00adson con\u00adsent\u00ading is an iden\u00adti\u00adfi\u00adable adult. The check can use reli\u00adable iden\u00adti\u00adty and age details already held, or details the per\u00adson pro\u00advides [2]. It can also use a vir\u00adtu\u00adal token from an autho\u00adrized enti\u00adty, such as a Dig\u00adiLock\u00ader ser\u00advice.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sec\u00adtion 9 also bars pro\u00adcess\u00ading like\u00adly to harm a child\u2019s well-being, and track\u00ading, behav\u00adioral mon\u00adi\u00adtor\u00ading or tar\u00adget\u00aded adver\u00adtis\u00ading direct\u00aded at chil\u00addren. Per\u00adsons with dis\u00adabil\u00adi\u00adty who have a law\u00adful guardian need the guardian\u2019s ver\u00adi\u00adfi\u00adable con\u00adsent under Rule 11. For speech or house\u00adhold video projects, choose one path per project: exclude minors, blur them, or run a ver\u00adi\u00adfied parental con\u00adsent work\u00adflow.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"600\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-consent-flow-ai-data-collection.webp\" alt=\"Five-step consent flow for AI data collection under the DPDP Act: itemized notice, affirmative consent, capture with consent ID, QA and evidence log, and withdrawal to erasure\" class=\"wp-image-230\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-consent-flow-ai-data-collection.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-consent-flow-ai-data-collection-300x113.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-consent-flow-ai-data-collection-1024x384.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-consent-flow-ai-data-collection-768x288.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-consent-flow-ai-data-collection-1536x576.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">A con\u00adsent flow that keeps evi\u00addence attached to every file, from notice to era\u00adsure.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What must a DPDP compliant data annotation vendor do?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Act places legal duties on the Data Fidu\u00adcia\u00adry, who stays respon\u00adsi\u00adble for every\u00adthing its Data Proces\u00adsor does. A DPDP com\u00adpli\u00adant data anno\u00adta\u00adtion ven\u00addor works only under a valid con\u00adtract and on the buy\u00ader\u2019s instruc\u00adtions. It applies the Rule 6 secu\u00adri\u00adty safe\u00adguards, reports breach\u00ades fast enough for the 72-hour Board report, and stops pro\u00adcess\u00ading and eras\u00ades data when told.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The ven\u00addor duties come most\u00adly through the fidu\u00adcia\u00adry. Here is the chain, clause by clause.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Respon\u00adsi\u00adbil\u00adi\u00adty stays with the buy\u00ader.<\/strong> Sec\u00adtion 8(1) makes the fidu\u00adcia\u00adry respon\u00adsi\u00adble for pro\u00adcess\u00ading done on its behalf, what\u00adev\u00ader the con\u00adtract says.<\/li>\n\n\n\n<li><strong>A valid con\u00adtract is manda\u00adto\u00adry.<\/strong> Sec\u00adtion 8(2) allows a proces\u00adsor to be engaged only under a valid con\u00adtract.<\/li>\n\n\n\n<li><strong>Secu\u00adri\u00adty safe\u00adguards cov\u00ader the ven\u00addor.<\/strong> Rule 6 sets min\u00adi\u00admum mea\u00adsures [2]. They include encryp\u00adtion, mask\u00ading or vir\u00adtu\u00adal tokens, access con\u00adtrol, log\u00adging and mon\u00adi\u00adtor\u00ading, and back\u00adups. Logs and relat\u00aded per\u00adson\u00adal data must be kept for one year to inves\u00adti\u00adgate inci\u00addents, unless anoth\u00ader law says oth\u00ader\u00adwise. The fidu\u00adcia\u00adry-proces\u00adsor con\u00adtract must include secu\u00adri\u00adty terms.<\/li>\n\n\n\n<li><strong>Breach report\u00ading runs on two clocks.<\/strong> Under Rule 7, the fidu\u00adcia\u00adry must tell each affect\u00aded per\u00adson and the Board with\u00adout delay. A detailed Board report is due with\u00adin 72 hours, unless the Board allows longer. Your ven\u00addor\u2019s alert clause has to be much short\u00ader.<\/li>\n\n\n\n<li><strong>With\u00addraw\u00adal and era\u00adsure reach the ven\u00addor.<\/strong> Sec\u00adtions 6(6) and 8(7)(b) require the fidu\u00adcia\u00adry to make its proces\u00adsors stop pro\u00adcess\u00ading and erase data shared with them.<\/li>\n\n\n\n<li><strong>Know your sub-proces\u00adsors.<\/strong> Under Sec\u00adtion 11(1)(b), a per\u00adson can ask the fidu\u00adcia\u00adry to name every fidu\u00adcia\u00adry and proces\u00adsor their data was shared with. Keep a cur\u00adrent list.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">One clause helps Indi\u00adan ven\u00addors with over\u00adseas clients. Sec\u00adtion 17(1)(d) exempts much of the Act for some off\u00adshore work. It applies when an India-based enti\u00adty process\u00ades data of peo\u00adple out\u00adside India under a con\u00adtract with a for\u00adeign par\u00adty. Sec\u00adtion 8(5) secu\u00adri\u00adty safe\u00adguards and Sec\u00adtion 8(1) respon\u00adsi\u00adbil\u00adi\u00adty still apply [1].<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who does what: buyer and vendor<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Oblig\u00ada\u00adtion<\/th><th>Buy\u00ader (Data Fidu\u00adcia\u00adry)<\/th><th>Ven\u00addor (Data Proces\u00adsor)<\/th><\/tr><\/thead><tbody><tr><td>Notice and con\u00adsent<\/td><td>Owns notice word\u00ading and pur\u00adpos\u00ades; must prove con\u00adsent<\/td><td>Runs the notice and cap\u00adture flow as instruct\u00aded; keeps evi\u00addence<\/td><\/tr><tr><td>Secu\u00adri\u00adty safe\u00adguards<\/td><td>Legal\u00adly respon\u00adsi\u00adble, includ\u00ading for ven\u00addor pro\u00adcess\u00ading<\/td><td>Encryp\u00adtion or mask\u00ading, access con\u00adtrol, logs, as con\u00adtract\u00aded<\/td><\/tr><tr><td>Breach<\/td><td>Informs the Board and affect\u00aded peo\u00adple; files the 72-hour report<\/td><td>Alerts the buy\u00ader at once with known facts<\/td><\/tr><tr><td>With\u00addraw\u00adal and era\u00adsure<\/td><td>Stops pro\u00adcess\u00ading; directs era\u00adsure<\/td><td>Stops pro\u00adcess\u00ading; deletes copies; con\u00adfirms in writ\u00ading<\/td><\/tr><tr><td>Rights requests<\/td><td>Answers access, cor\u00adrec\u00adtion and era\u00adsure requests<\/td><td>Finds records by con\u00adsent ID; sup\u00adports the response<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Penalties under the DPDP Act<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Sched\u00adule to the Act sets max\u00adi\u00admum penal\u00adties [1]. A fail\u00adure to take rea\u00adson\u00adable secu\u00adri\u00adty safe\u00adguards can reach \u20b9250 crore. A fail\u00adure to noti\u00adfy a breach can reach \u20b9200 crore, as can a breach of the chil\u00addren\u2019s data duties. Sig\u00adnif\u00adi\u00adcant Data Fidu\u00adcia\u00adry breach\u00ades can reach \u20b9150 crore, and oth\u00ader breach\u00ades \u20b950 crore. The Board weighs grav\u00adi\u00adty, dura\u00adtion, rep\u00ade\u00adti\u00adtion and mit\u00adi\u00adga\u00adtion.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These penal\u00adties fall on the fidu\u00adcia\u00adry. A ven\u00addor\u2019s expo\u00adsure is most\u00adly con\u00adtrac\u00adtu\u00adal, plus direct lia\u00adbil\u00adi\u00adty for any data it han\u00addles as a fidu\u00adcia\u00adry itself.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Significant Data Fiduciaries<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The gov\u00adern\u00adment may noti\u00adfy some Data Fidu\u00adcia\u00adries as Sig\u00adnif\u00adi\u00adcant Data Fidu\u00adcia\u00adries. Fac\u00adtors include data vol\u00adume and sen\u00adsi\u00adtiv\u00adi\u00adty, and risk to peo\u00adple\u2019s rights. They must appoint a Data Pro\u00adtec\u00adtion Offi\u00adcer based in India and an inde\u00adpen\u00addent data audi\u00adtor. Under Rule 13, they must run a Data Pro\u00adtec\u00adtion Impact Assess\u00adment and audit every 12 months and report key find\u00adings to the Board. They must also check that algo\u00adrith\u00admic soft\u00adware they use is not like\u00adly to pose a risk to peo\u00adple\u2019s rights. Spec\u00adi\u00adfied data may face lim\u00adits on trans\u00adfer out\u00adside India.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">DPDP Act AI training data checklist: the 8\u2011point dataset diligence check<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use this check before a dataset enters your train\u00ading pipeline. It works for new col\u00adlec\u00adtions and for datasets you already hold. Each point maps to a clause above, so a \u201cno\u201d tells you exact\u00adly which gap to close.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Roles mapped in writ\u00ading.<\/strong> Name the fidu\u00adcia\u00adry, the proces\u00adsor and every sub-proces\u00adsor for this dataset.<\/li>\n\n\n\n<li><strong>Item\u00adized notice per Rule 3.<\/strong> Lists the data col\u00adlect\u00aded and the AI train\u00ading pur\u00adpose, in the par\u00adtic\u00adi\u00adpan\u00adt\u2019s lan\u00adguage.<\/li>\n\n\n\n<li><strong>AI train\u00ading as a sep\u00ada\u00adrate pur\u00adpose.<\/strong> A dis\u00adtinct opt-in, not a clause buried in ser\u00advice terms.<\/li>\n\n\n\n<li><strong>Con\u00adsent ref\u00ader\u00adence on every file.<\/strong> Each record\u00ading, clip or doc\u00adu\u00adment links to a con\u00adsent record and notice ver\u00adsion.<\/li>\n\n\n\n<li><strong>With\u00addraw\u00adal-to-era\u00adsure path test\u00aded.<\/strong> Run one test dele\u00adtion across your copies and the ven\u00addor\u2019s copies.<\/li>\n\n\n\n<li><strong>Minors and guardians han\u00addled.<\/strong> Exclud\u00aded, blurred, or cov\u00adered by ver\u00adi\u00adfi\u00adable parental or guardian con\u00adsent.<\/li>\n\n\n\n<li><strong>Secu\u00adri\u00adty terms in the con\u00adtract.<\/strong> Encryp\u00adtion or mask\u00ading, access con\u00adtrol, and one-year logs per Rule 6.<\/li>\n\n\n\n<li><strong>Breach clock that fits 72 hours.<\/strong> The ven\u00addor alerts you fast enough for your detailed Board report.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">For scraped or third-par\u00adty data, add two checks: prove\u00adnance per source, and a writ\u00adten basis for any reliance on the pub\u00adlic-data or research exemp\u00adtions.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"818\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-buyer-checklist-ai-datasets.webp\" alt=\"Eight-point DPDP dataset diligence checklist for AI training data buyers, from roles mapped in writing to a breach clock that fits the 72-hour report\" class=\"wp-image-231\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-buyer-checklist-ai-datasets.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-buyer-checklist-ai-datasets-300x153.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-buyer-checklist-ai-datasets-1024x524.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-buyer-checklist-ai-datasets-768x393.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/10\/dpdp-buyer-checklist-ai-datasets-1536x785.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">The 8\u2011point dataset dili\u00adgence check: one line per clause buy\u00aders should ver\u00adi\u00adfy.<\/figcaption><\/figure>\n\n\n\n<p class=\"cta-inline wp-block-paragraph\"><strong>Want to run this check on a live project?<\/strong> <a href=\"https:\/\/www.graveiensai.com\/contact-us\">Ask us for our con\u00adsent &amp; data-han\u00addling pack<\/a> and com\u00adpare it against your cur\u00adrent ven\u00addor terms.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Common mistakes with personal data in training datasets<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most DPDP prob\u00adlems in AI data projects trace back to a few habits. Each one is cheap to fix before col\u00adlec\u00adtion and expen\u00adsive after.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reusing ser\u00advice con\u00adsent for train\u00ading.<\/strong> Con\u00adsent cov\u00aders the spec\u00adi\u00adfied pur\u00adpose only. A new mod\u00adel pur\u00adpose needs its own notice and opt-in.<\/li>\n\n\n\n<li><strong>Treat\u00ading \u201cpub\u00adlic\u201d as \u201cfree to use\u201d.<\/strong> The exemp\u00adtion cov\u00aders data the per\u00adson made pub\u00adlic, not every\u00adthing a crawler can reach.<\/li>\n\n\n\n<li><strong>Call\u00ading com\u00admer\u00adcial train\u00ading \u201cresearch\u201d.<\/strong> The research exemp\u00adtion fails if the data dri\u00adves deci\u00adsions about indi\u00advid\u00adu\u00adals.<\/li>\n\n\n\n<li><strong>Strip\u00adping names and call\u00ading it anonymized.<\/strong> Voic\u00ades, faces and rich meta\u00adda\u00adta can still iden\u00adti\u00adfy peo\u00adple.<\/li>\n\n\n\n<li><strong>For\u00adget\u00adting bystanders and anno\u00adta\u00adtors.<\/strong> Both are Data Prin\u00adci\u00adpals. Plan blur\u00adring or exclu\u00adsion rules, and pro\u00adtect work\u00adforce records.<\/li>\n\n\n\n<li><strong>Los\u00ading track of off\u00adshore access.<\/strong> Sec\u00adtion 16 lets the gov\u00adern\u00adment restrict trans\u00adfers to noti\u00adfied coun\u00adtries. Keep a map of where data and anno\u00adta\u00adtors sit.<\/li>\n\n\n\n<li><strong>No breach clock in the ven\u00addor con\u00adtract.<\/strong> With\u00adout one, the 72-hour Board report is hard to meet.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Teams that already run an AI risk pro\u00adgram can add these items to the data sec\u00adtion of their reg\u00adis\u00adter. A <a href=\"https:\/\/www.graveiensai.com\/data-validation\">data val\u00adi\u00adda\u00adtion pass<\/a> before train\u00ading is a nat\u00adur\u00adal place to catch them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Graveiens AI handles consent<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We run explic\u00adit-con\u00adsent data col\u00adlec\u00adtion on every project. The work\u00adflow has four stages: par\u00adtic\u00adi\u00adpant onboard\u00ading, record\u00ading or cap\u00adture man\u00adage\u00adment, meta\u00adda\u00adta tag\u00adging and QA. Con\u00adsent sits in the first stage, and noth\u00ading moves to cap\u00adture with\u00adout it.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Con\u00adsent first.<\/strong> Our <a href=\"https:\/\/www.graveiensai.com\/data-collection\">con\u00adsent-based data col\u00adlec\u00adtion<\/a> starts with par\u00adtic\u00adi\u00adpant onboard\u00ading, before any record\u00ading begins.<\/li>\n\n\n\n<li><strong>Lan\u00adguage cov\u00ader\u00adage.<\/strong> We work in 25+ lan\u00adguages with deep Indic cov\u00ader\u00adage. That mat\u00adters when notices must be avail\u00adable in the lan\u00adguage a par\u00adtic\u00adi\u00adpant speaks. See our <a href=\"https:\/\/www.graveiensai.com\/voice-speech\">voice and speech data ser\u00advices<\/a>.<\/li>\n\n\n\n<li><strong>Pay for approved deliv\u00ader\u00adables.<\/strong> You review deliv\u00ader\u00adables against agreed accep\u00adtance cri\u00adte\u00adria and pay for what you approve.<\/li>\n\n\n\n<li><strong>Qual\u00adi\u00adty sys\u00adtem.<\/strong> Graveiens AI is ISO 9001 cer\u00adti\u00adfied.<\/li>\n\n\n\n<li><strong>Your terms, scoped togeth\u00ader.<\/strong> Roles, notice word\u00ading, con\u00adsent ref\u00ader\u00adences in meta\u00adda\u00adta, reten\u00adtion and dele\u00adtion are project-spe\u00adcif\u00adic. We scope them with you at kick\u00adoff.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to see the out\u00adput before you com\u00admit, our 30-minute speech sam\u00adple set is free. For DPDP Act AI train\u00ading data projects, we scope the role map and con\u00adsent flow with you first.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1760100000000\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does the DPDP Act apply to AI training data?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes, when\u00adev\u00ader the train\u00ading data con\u00adtains dig\u00adi\u00adtal per\u00adson\u00adal data about an iden\u00adti\u00adfi\u00adable per\u00adson processed in India. That cov\u00aders voice record\u00adings, video with faces, names in text and iden\u00adti\u00adfy\u00ading meta\u00adda\u00adta. The Act\u2019s def\u00adi\u00adn\u00adi\u00adtion of pro\u00adcess\u00ading includes col\u00adlec\u00adtion, struc\u00adtur\u00ading, stor\u00adage, adap\u00adta\u00adtion and use, so col\u00adlec\u00adtion, anno\u00adta\u00adtion and train\u00ading all fall in scope. Ful\u00adly non-iden\u00adti\u00adfi\u00adable data falls out\u00adside it.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1760100000001\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can I train AI on publicly available personal data in India?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Only some of it. Sec\u00adtion 3\u00a9(ii) excludes per\u00adson\u00adal data that the per\u00adson made pub\u00adlic her\u00adself, or that some\u00adone was legal\u00adly required to pub\u00adlish. Reposts, leaks and aggre\u00adga\u00adtor list\u00adings are not cov\u00adered just because they are online. Com\u00admer\u00adcial reuse for AI train\u00ading is still debat\u00aded, so record the source of each item and take legal advice before rely\u00ading on the exemp\u00adtion.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1760100000002\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does the research exemption cover commercial AI model training?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Usu\u00adal\u00adly not on its own. Sec\u00adtion 17(2)(b) exempts research, archiv\u00ading or sta\u00adtis\u00adti\u00adcal pro\u00adcess\u00ading only under two con\u00addi\u00adtions. The data must not dri\u00adve deci\u00adsions about spe\u00adcif\u00adic peo\u00adple, and the Sec\u00adond Sched\u00adule stan\u00addards must be fol\u00adlowed. Mod\u00adels that lat\u00ader dri\u00adve deci\u00adsions about indi\u00advid\u00adu\u00adals, such as cred\u00adit or per\u00adson\u00adal\u00adized offers, are a weak fit. Treat the exemp\u00adtion as nar\u00adrow.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1760100000003\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">When do the DPDP consent rules take effect?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>The notice rule (Rule 3) and the secu\u00adri\u00adty, breach, chil\u00addren\u2019s data and rights rules com\u00admence around 13 May 2027. That is eigh\u00adteen months after the Rules were pub\u00adlished on 13 Novem\u00adber 2025. Con\u00adsent man\u00adag\u00ader reg\u00adis\u00adtra\u00adtion (Rule 4) com\u00admences after twelve months, around 13 Novem\u00adber 2026. As of Octo\u00adber 2026, no Gazette amend\u00adment had short\u00adened these win\u00addows.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1760100000004\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is a data annotation vendor a Data Fiduciary or a Data Processor?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Usu\u00adal\u00adly a Data Proces\u00adsor, because it process\u00ades per\u00adson\u00adal data on the buy\u00ader\u2019s behalf and instruc\u00adtions. The buy\u00ader decides pur\u00adpose and means, so the buy\u00ader is the Data Fidu\u00adcia\u00adry and stays respon\u00adsi\u00adble. A ven\u00addor becomes a fidu\u00adcia\u00adry for data it uses for its own pur\u00adpos\u00ades, such as par\u00adtic\u00adi\u00adpant pay\u00adment records. Write the role split into the con\u00adtract.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1760100000005\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Do I need a consent manager to collect speech data?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. A con\u00adsent man\u00adag\u00ader under the DPDP Act is an option for the Data Prin\u00adci\u00adpal, not a require\u00adment for the buy\u00ader. A per\u00adson may give, man\u00adage, review or with\u00addraw con\u00adsent through a reg\u00adis\u00adtered Con\u00adsent Man\u00adag\u00ader. Con\u00adsent man\u00adag\u00ader DPDP reg\u00adis\u00adtra\u00adtion opens around 13 Novem\u00adber 2026. Your own notice, con\u00adsent cap\u00adture and records must still meet Sec\u00adtions 5 and 6 either way.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1760100000006\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What are the penalties under the DPDP Act?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>The Sched\u00adule sets max\u00adi\u00admums. Fail\u00ading to take rea\u00adson\u00adable secu\u00adri\u00adty safe\u00adguards can cost up to \u20b9250 crore. Fail\u00ading to report a breach, or breach\u00ading the chil\u00addren\u2019s data duties, can each cost up to \u20b9200 crore. Sig\u00adnif\u00adi\u00adcant Data Fidu\u00adcia\u00adry breach\u00ades can reach \u20b9150 crore, and oth\u00ader breach\u00ades up to \u20b950 crore. The Board weighs grav\u00adi\u00adty, dura\u00adtion and mit\u00adi\u00adga\u00adtion.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<div class=\"wp-block-group cta-box\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Ask for our consent &amp; data-handling pack<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Tell us what you are col\u00adlect\u00ading, in which lan\u00adguages and for which mod\u00adel. We will share how we run con\u00adsent, meta\u00adda\u00adta and dele\u00adtion on our projects, so you can check it against the 8\u2011point list above.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.graveiensai.com\/contact-us\">Ask us for our con\u00adsent &amp; data-han\u00addling pack<\/a>. You can also request our free 30-minute speech sam\u00adple set.<\/p>\n<\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Gov\u00adern\u00adment of India, \u201cThe Dig\u00adi\u00adtal Per\u00adson\u00adal Data Pro\u00adtec\u00adtion Act, 2023 (No. 22 of 2023),\u201d Gazette of India, 11 August 2023, via MeitY. <a href=\"https:\/\/www.meity.gov.in\/static\/uploads\/2024\/06\/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf\" rel=\"noopener\" target=\"_blank\">meity.gov.in<\/a><\/li>\n\n\n\n<li>Min\u00adistry of Elec\u00adtron\u00adics and Infor\u00adma\u00adtion Tech\u00adnol\u00ado\u00adgy, \u201cDig\u00adi\u00adtal Per\u00adson\u00adal Data Pro\u00adtec\u00adtion Rules, 2025,\u201d G.S.R. 846(E), 13 Novem\u00adber 2025. <a href=\"https:\/\/www.meity.gov.in\/static\/uploads\/2025\/11\/53450e6e5dc0bfa85ebd78686cadad39.pdf\" rel=\"noopener\" target=\"_blank\">meity.gov.in<\/a><\/li>\n\n\n\n<li>Press Infor\u00adma\u00adtion Bureau, \u201cDPDP Rules, 2025 Noti\u00adfied: A Cit\u00adi\u00adzen-Cen\u00adtric Frame\u00adwork for Pri\u00adva\u00adcy Pro\u00adtec\u00adtion and Respon\u00adsi\u00adble Data Use,\u201d 17 Novem\u00adber 2025. <a href=\"https:\/\/static.pib.gov.in\/WriteReadData\/specificdocs\/documents\/2025\/nov\/doc20251117695301.pdf\" rel=\"noopener\" target=\"_blank\">pib.gov.in<\/a><\/li>\n\n\n\n<li>Aashish Aryan, \u201cMeity may cut com\u00adpli\u00adance time\u00adline for key DPDP rules to 12 months,\u201d Busi\u00adness Stan\u00addard, 22 Jan\u00adu\u00adary 2026. <a href=\"https:\/\/www.business-standard.com\/technology\/tech-news\/meity-may-cut-compliance-timeline-for-key-dpdp-rules-to-12-months-126012201293_1.html\" rel=\"noopener\" target=\"_blank\">business-standard.com<\/a><\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">About the author<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Graveiens AI Edi\u00adto\u00adr\u00adi\u00adal Team.<\/strong> The Graveiens AI edi\u00adto\u00adr\u00adi\u00adal team writes about human data for AI: speech and ego\u00adcen\u00adtric data col\u00adlec\u00adtion, anno\u00adta\u00adtion, val\u00adi\u00adda\u00adtion and eval\u00adu\u00ada\u00adtion. Our guides draw on how we scope, cap\u00adture and review con\u00adsent-based data pro\u00adgrams for AI teams.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DPDP Act AI train\u00ading data guide: ver\u00adi\u00adfied rules time\u00adline, con\u00adsent, ven\u00addor duties and an 8\u2011point buy\u00ader check\u00adlist. Ask for our con\u00adsent &amp; data-han\u00addling pack.<\/p>\n","protected":false},"author":1,"featured_media":228,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[1],"tags":[19,20,9,18,21],"class_list":["post-232","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-ai-training-data","tag-data-annotation-vendors","tag-data-consent","tag-dpdp-act","tag-india-data-protection"],"_links":{"self":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts\/232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/comments?post=232"}],"version-history":[{"count":1,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts\/232\/revisions"}],"predecessor-version":[{"id":239,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts\/232\/revisions\/239"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/media\/228"}],"wp:attachment":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/media?parent=232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/categories?post=232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/tags?post=232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}