Why now
On 13 May 2027, “we are evaluating AI” stops being an answer.
Full enforcement of the Digital Personal Data Protection Act reaches every organisation that holds Indian citizens' data — not just the largest. Here is what it means for a mid-size bank, NBFC, hospital, pharma manufacturer or PSU, and what an AI plan that survives it looks like.
Not just the largest
- Mid-size banks
- NBFCs
- Hospitals
- Pharma manufacturers
- PSUs
The rules were always yours. Now they have teeth.
Who it covers
Any organisation processing personal data of people in India — customers, employees, patients, vendors’ staff. Size is not a threshold.
What it requires
Lawful purpose, consent or a recognised legitimate use, security safeguards, breach notification, and — for larger or sensitive processors designated as Significant Data Fiduciaries — audits, impact assessments and restrictions on where data may be processed.
What it costs to get wrong
Penalties scale by failure type, up to ₹250 crore per instance for failing to take reasonable security safeguards.
Why AI is the sharp edge
Sending documents or records to a public AI service is a transfer of personal data to a third party, often outside India, with no purpose limitation and no audit trail. Most organisations have no contract, no consent and no record of what was sent.
Three questions a regulator — or your board — will ask
Where did the data go?
If the answer is “a server we do not control, in a country we did not choose,” there is no defensible position.
Who decided what was allowed?
If a model’s judgement is the only control, there is no reproducible decision to show an auditor.
Who could see what?
If access was granted to the AI rather than to the person asking, every answer is a potential disclosure.
An AI plan that answers all three is one where the data stays inside your infrastructure, the rules are fixed and enforced before the model runs, and access is decided per person before any answer is produced. That is the shape of the door.
| The choice most organisations face today | What it costs after 13 May 2027 |
|---|---|
| Use public AI on real data | A transfer with no consent, no contract and no record — the clearest breach there is |
| Pay a global SI for a compliant build | Budgets written for the top 150; 9–18 month timelines; the deadline arrives first |
| Wait | “Evaluating” is not a safeguard; the board question becomes a regulator question |
A 90-day path to an AI plan your board can approve
- 1
Days 1–15
Map where personal data lives and which teams are already using public AI on it (most organisations find at least one).
- 2
Days 15–30
Choose one high-value, high-sensitivity use case — contracts, policies, customer records — and write the access and retention rules for it as policy, not as a prompt.
- 3
Days 30–50
Deploy Vectalk on that corpus inside your infrastructure; pilot to production in 3 weeks, maximum.
- 4
Days 50–90
Add the first Neo Agent to the process that depends on that corpus; collect the audit trail as compliance evidence.
Leave with the one-page version of this plan for your organisation.
Frequently asked questions
Yes. It applies by activity — processing personal data of people in India — not by company size.
If personal data is included and it leaves your control without a lawful basis, consent where required, and safeguards, it is very likely to be. Ask your counsel; do not ask the model.
Residency helps with one requirement. It does not answer who decided what was allowed or who could see what.
Yes — IRDAI, RBI and SEBI directions and the health-data guidelines layer on top. The rule-engine approach lets each be written as its own policy.
Tiered by failure, with a ceiling of ₹250 crore per instance for inadequate security safeguards.