Artificial Intelligence and Data Protection in India: A Legal Analysis under the Digital Personal Data Protection Act, 2023

The paper aimed to review the artificial intelligence and data protection in India with a systematic literature review to 20142025 and a doctrinal study focusing on the Digital Personal Data Protection Act, 2023. The review reveals that it is impossible to make sense of the legal role of AI in India outside of the emergence of informational privacy as a constitutional issue, the constraints of the previous SPDI-based regime, and the subsequent establishment of a specific statutory framework of digital personal data. Under that historical and doctrinal meaning, the DPDP Act is a significant legal step. It transforms privacy into a concept that is much more fragmented and sectoral into a more coherent system of rights, obligations, and enforcement within the context of the digital era. Simultaneously, the paper concludes that AI brings about types of risks that can be partially absorbed by the general data protection law. AI systems interfere with the presumptions of meaningful consent, produce inferential harms that is not self-evident data disclosure, complicate transparency, and expose risks of unjust or discriminatory results. The DPDP Act also concerns the legality of digital personal data processing and provides a robust base architecture of accountability, although it is not yet a complete normative framework of algorithmic governance. The legal account of the relationship between AI and data protection can then be regarded as being layered: data protection is not only sufficient, but also necessary, for reliable AI. The most compelling finding that is made in the literature is that India currently has an underlying privacy law that can be used to regulate AI, yet such a pillar must be reinforced by interpretation, institutional reform, and additional governance provisions. The announcement of the DPDP Rules and the establishment of the Data Protection Board by 2025 indicate that implementation has started, yet the effectiveness of the long-term success of the regime will be determined by its ability to react to real-life AI applications. But normatively, the future of AI regulation in India must be pegged on the constitutional values expressed in Puttaswamy: dignity, liberty, autonomy, and safeguarding against capricious violations of personal life. The Digital Personal Data Protection Act, 2023, is a necessary step toward the same direction. But with the increase in the strength and deeper integration of AI systems into the governance and markets, Indian law will have to shift away from a model of minimalist compliance to a more robust model of transparency, contestability, fairness, and human-focused accountability. It is only at that point that data protection can be used as not only a legal protection against abuse, but as a value system of democratic and rights-observant AI governance.

[1].           Committee of Experts under the Chairmanship of Justice B. N. Srikrishna. (2018). A free and fair digital economy: Protecting privacy, empowering Indians. Government of India. [2].           Deshpande, S. (2023). Data privacy in India: Technical and legal perspective. SSRN. https://doi.org/10.2139/ssrn.4420148 [3].           Government of India. (2011). The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. India Code. [4].           Government of India. (2023). The Digital Personal Data Protection Act, 2023 (No. 22 of 2023). Ministry of Electronics and Information Technology. [5].           Government of India. (2025, January 3). Notification under the Digital Personal Data Protection Act, 2023. Ministry of Electronics and Information Technology, Gazette of India. [6].           Government of India. (2025, November 13). Notification establishing the Data Protection Board of India. Ministry of Electronics and Information Technology, Gazette of India. [7].           Government of India. (2025, November 14). Digital Personal Data Protection Rules, 2025. Ministry of Electronics and Information Technology, Gazette of India. [8].           Joshi, D. (2024). AI governance in India: Law, policy and political economy. Policy Design and Practice. [9].           Justice K. S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., Writ Petition (Civil) No. 494 of 2012, Supreme Court of India (2018). [10].             Kanipakam, S. (2019). Law and regulation of artificial intelligence in India. In Legal technology and the new sharing economy (Springer).