If you are deploying AI systems that touch customer data in India, the Act determines several things about how the project should be structured. This is a plain summary, not legal advice — take advice on your specific situation.
The two roles
You are the Data Fiduciary. You decide why customer data is collected and what happens to it, and the responsibility sits with you.
Your vendor is a Data Processor. They act on your instructions, for your stated purpose, and for nothing else. That relationship should be in the contract rather than assumed.
The distinction matters because responsibility does not transfer. If a vendor mishandles data collected by you, it remains your obligation to the customer.
What it means for an AI project
- Purpose has to be specific. Data collected to book an appointment is for booking appointments. Reusing it for marketing is a separate purpose needing its own basis.
- Retention has to end. "Indefinitely" is not a retention period. Call recordings in particular should have a stated window and actual deletion at the end of it.
- Consent has to be informed. Callers should be told they are speaking to an automated system and that the call is recorded.
- Rights have to be serviceable. A customer can ask what you hold and ask for it to be corrected or erased. If your data is scattered across a vendor's systems with no way to retrieve it, that request becomes very difficult.
- Cross-border transfer is permitted but not unconditional. Where a model or platform runs outside India, that should be a decision you made knowingly, not one discovered later.
A note on certification
There is no DPDP certification. Any vendor claiming to be "DPDP certified" is describing something that does not exist. What a vendor can genuinely do is contract to the obligations, name the sub-processors involved, state where data sits, and support you when a customer exercises a right.
Questions
- Can we use AI models hosted outside India?
- Generally yes, subject to the restrictions in force, but it should be a deliberate decision recorded in the proposal. The point is that you know where data goes before it goes there.
- How long can we keep call recordings?
- As long as your stated purpose requires, and no longer. What matters is that a period is decided, written down, disclosed, and actually enforced by deletion rather than left to accumulate.
Wondering whether this applies to your business? That is a thirty-minute call, not a research project.
Book a Consultation Call