Regulating Artificial Intelligence At The Workplace

A Practical Industry Guide to Drafting, Implementing and Enforcing an Artificial Intelligence Acceptable Use Policy with Full Alignment to the Digital Personal Data Protection Act, 2023

and the DPDP Rules, 2025

Created by Shubhank Suman, AI, Privacy, and IP Counsel

Walk into any office in India today and you will find employees using AI tools. Some are using ChatGPT to draft emails. Some are using Gemini to summarize contracts. Most of them are doing this without any guidance from their employer about what is safe and what is not. Most of them do not realize they are creating a legal problem for their organization every time they upload personal data to a tool they found on the internet.

This guide exists because that situation is no longer acceptable. The digital personal data protection act, 2023 is in force. The DPDP rules, 2025 are in force. The data protection board can investigate your organisation, impose penalties, and name individuals.

What Is Covered In The Report

Output	What It Gives You
The Model Policy	A complete, ready-to-adapt AI Acceptable Use Policy with 12 clauses.
Clause Analysis	For every single clause: why the clause exists, a checklist of things to verify before you finalise that clause, a practical real-world illustration, and the specific DPDPA provision it connects to.
Enforcement Guide	For every clause, a specific breakdown of which department owns it, what that department must actually do, and what the consequence is if they do not do it.

Scenario A: The Employee Who Uploads Personal Data To A Public AI Tool

An employee or intern uploads a document containing personal data to a public AI tool like ChatGPT or Gemini to quickly summarize or rewrite it to complete a task quickly.

This is a violation of the Digital Personal Data Protection Act, 2023. It does not matter that the employee did not mean any harm or nothing bad happened. The act of uploading personal data to a public AI tool without a lawful basis, without proper notice to the individuals whose data it is, and without a data processing agreement with the vendor is a breach of Sections 4, 5, 6, and 8 of the DPDPA. Each of those breaches can attract separate penalties.

Scenario B: The Physical Document That Was Scanned And Then Uploaded

The document was originally in physical form. An employee scans a paper record containing personal data into a digital file and uploads the scan to a free, publicly available AI summarization website.

This is where many people make critical mistakes. They assume that because the data originated on paper, it falls outside the scope of the DPDPA. That assumption is incorrect. Section 2(t) of the DPDPA explicitly applies to personal data collected in non‑digital form and subsequently digitized. The moment the document is scanned, digital personal data is created. The moment it is uploaded, that data is processed without a lawful basis, without a data processing agreement, and almost certainly through an unauthorized cross‑border transfer. This constitutes a serious compliance failure.

1.1 What The DPDPA Says And Why AI Makes It Urgent

The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection law. It applies to every organisation that processes the digital personal data of Indian residents, regardless of where the organisation is based. The DPDP Rules, 2025 fill in the operational detail. Together they create a framework that makes most current AI use in Indian workplaces legally non-compliant.

The table below explains the key legal terms in plain English and shows exactly how each one applies to AI use in a workplace:

Legal Term	Plain English Meaning	What It Means for AI Use
Data Fiduciary	Your organization. The entity that decides why and how personal data is processed.	When your employee uploads client data to ChatGPT, your organization is legally responsible. Not the employee. Not OpenAI. You.
Data Principal	The individual whose personal data is being processed.	Your client, your employee, your vendor. Every person whose name or details are in that document your employee just uploaded.
Data Processor	A third party that processes personal data on your instructions under a contract.	An AI vendor you have a signed contract with. A public AI tool is not a Data Processor. It is an unauthorized recipient of personal data.
Personal Data	Any information about an identifiable living individual.	A name alone. A name with an employer. A phone number. A salary figure. A combination of innocuous details that together identify a person.
Processing	Anything done with data: collecting, storing, using, sharing, transmitting, deleting.	Typing personal data into an AI chat is processing. Uploading a document is processing. Scanning paper and uploading the scan is processing.
Lawful Basis	A legal justification for processing personal data. Without one, processing is unlawful.	Uploading client data to ChatGPT without consent or a lawful basis means there is no legal justification for that processing.
Data Processing Agreement	A legally binding contract with a Data Processor specifying how they handle data.	Without this contract, a vendor cannot lawfully receive your personal data. No DPA means no lawful processing.

Part 2 The Model AI Acceptable Use Policy

The following is a complete model AI Acceptable Use Policy suitable for Indian organizations. It is designed to be adapted, not copied wholesale.

AI Acceptable Use Policy

[Organisation Name]

Effective Date: [Date] | Policy Owner: [Designation / Team] | Review Cycle: Annual

C 1 Purpose And Scope

This policy governs how every employee, contractor, intern, and temporary worker at [Organisation Name] may use artificial intelligence tools in the course of their work. It applies to all AI systems used for any work purpose: tools publicly available on the internet, tools embedded within licensed software, and tools built internally by the technology team. It applies regardless of the work location and regardless of whether the device is company-owned or personal.

The purpose is to allow the organisation to benefit from AI technology responsibly, while protecting the personal data of clients, employees and other individuals, protecting confidential business information, and complying with the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025, and all other applicable laws.

C 2 Definitions

The following definitions apply throughout this policy. They are aligned with the definitions in the DPDPA.

Term	Definition
AI Tool or AI System	Any technology that generates, summarizes, classifies, translates, recommends, or transforms content using machine learning or generative models. This includes chatbots, writing assistants, image generators, code assistants, and AI features embedded within other software including but not limited to Chatgpt, Gemini, Claude, Copilot, etc.
Public AI Tool	Any AI tool that is not specifically contracted by the organization, including free or personal accounts on any AI platform.
Approved AI Tool	Any AI tool that has been reviewed, assessed, and formally approved by [IT Security and Legal] and appears on the current Approved AI Tools List.
Personal Data	Any information relating to an identifiable living individual, including names, phone numbers, email addresses, financial details, health information, identification numbers, location data, and any combination of information that can identify a specific person. This includes data that was originally on paper and has been subsequently digitised.
Confidential Business Information	Non-public information belonging to the organisation or its clients: contracts, pricing, business strategy, unreleased products, and internal communications.
High-Risk Use Case	Any AI use involving personal data, confidential information, automated decision-making about individuals, client-facing outputs, or automated business processes.
Data Processing Agreement (DPA)	A legally binding contract with an AI vendor specifying how they may handle personal data shared with them. Mandatory before any vendor can be approved.

C 3 Organisational Risk Stance

[Organisation Name] supports the responsible use of AI. AI tools can help employees work better, faster, and more creatively. AI tools also carry real risks for personal data, confidential information, and the trust of clients and employees. The organisation's position is this: AI use is encouraged where it is responsible and controlled. It is prohibited where it puts personal data, confidential information, or legal obligations at risk.

The practical test for every employee before using AI is this: would you be comfortable if your client or your manager could see exactly what you just typed into that AI system? If the answer is no, do not type it.

C 4 Core Principles

These six principles apply every time any employee uses any AI tool for any work purpose. They are not aspirational. They are mandatory.

Principle 1: Protect Personal And Confidential Data

Never input personal data or confidential business information into a public AI tool or any unapproved AI tool. Before inputting any information, ask yourself: could this information identify a real person, or does it reveal confidential business details? If yes, use only an approved tool, and only if the specific use case has been approved.

Principle 2: You Are Responsible For Every AI Output You Use

AI is an assistant. You are the professional. Every output that an AI tool produces and that you use, share, or act upon is your responsibility. If the AI makes an error and you share it without checking, the error is yours. Always review AI outputs for accuracy, tone, legal correctness, and completeness before using them.

Principle 3: Be Honest About AI Use

If AI helped you produce a deliverable that a client or manager will rely on, disclose it. Do not present AI output as your own original expert work without appropriate disclosure. Follow any specific disclosure requirements set by your department or by client contracts.

Principle 4: Do Not Discriminate Through AI

Do not use AI to make or assist decisions that may discriminate against individuals on the basis of gender, religion, caste, disability, age, or any other protected characteristic. This applies to hiring, performance reviews, and customer decisions.

Principle 5: Follow The Law

AI use must comply with the Digital Personal Data Protection Act 2023, the Information Technology Act 2000, applicable sector regulations, and all client contractual requirements. When in doubt about whether a particular use is legal, ask Legal or Compliance before proceeding, not after.

Principle 6: Verify Everything

AI systems produce errors. They can present incorrect information with complete confidence. They can invent citations, fabricate facts, and produce legally incorrect analysis. Never use an AI output without checking it. For anything consequential, a qualified human must review the output before it is used.

C 5 Approved And Prohibited AI Tools

Employees may use only the tools listed on the Approved AI Tools List for any work involving personal data, confidential information, or client-related tasks. The Approved AI Tools List is maintained by [IT Security Team] and published at [Intranet Link]. It is reviewed quarterly.

Before using any AI tool for work, check the list. If the tool is not on it, either use a tool that is, or submit a request for the new tool to be reviewed and approved before you start using it.

Approved Tool Rules	Prohibited Tool Rules
Use only for the approved purposes listed against each tool.	Do not use public AI tools for any work involving personal data.
Use only on company-approved devices unless specifically authorised otherwise.	Do not use your personal accounts on AI platforms for business work.
Do not connect approved AI tools to company systems without IT approval.	Do not install AI browser extensions or plugins without IT approval.
Report any unexpected behaviour or data concerns to IT immediately.	Do not use any AI tool on personal devices for work involving personal or confidential data.

C 6 What You Can And Cannot Do

Always Allowed: No Prior Approval Needed

You may use approved AI tools freely for the tasks below, provided you use no personal data and no confidential information in doing so.

• Drafting or improving internal emails and documents with no personal or confidential content.
• Brainstorming ideas, names, structures, or approaches.

• Summarising publicly available information.

• Writing or debugging code where the code contains no personal data or proprietary logic.

• Translating non-confidential text.

• Creating completely synthetic example data for testing, using entirely fictitious names and details.

Even for these permitted tasks, review every AI output before using it. Human accountability applies without exception.

Always Prohibited: No Exceptions Under Any Circumstances

These actions are prohibited regardless of which tool is used, regardless of seniority, and regardless of the business justification offered:

• Uploading personal data to any public or unapproved AI tool.

• Uploading confidential business information to any public or unapproved AI tool.
• Scanning a physical document that contains personal data and then uploading the scan to any public or unapproved AI tool.
• Sharing passwords, API keys, system credentials, or architecture details in any AI prompt.
• Using AI to make fully automated decisions about hiring, termination, promotion, or compensation without human review at every step.
• Using AI to create deceptive content, impersonate individuals, or generate false documents.

• Using AI to develop malware, exploit code, or tools designed to cause harm.

• Profiling or scoring individuals using AI without a validated fairness review.

• Publishing AI-generated content externally as verified expert fact without human review and disclosure.

Requires Review Before You Start

Submit a use case review request before beginning any task that involves any of the following:

• Any personal data, even on an approved tool.

• Any confidential client or business information.
• A decision that affects an individual's employment, financial standing, or access to services.

• A client-facing or public-facing deliverable.

• An automated workflow where AI runs without human oversight at each step.

• Building, fine-tuning, or training a model using organisational or client data.
• Any use in a regulated domain such as insurance, healthcare, banking, or legal services.

C 7 How To Handle Data Before Using AI

Before you input any information into an AI tool, even an approved one, apply these three steps every time without exception.

Step 1: Minimise

Use only the information that is strictly necessary for the task. If you are drafting a client letter, you do not need the entire client file. If you are analysing a trend, you do not need individual names. Strip out everything that is not essential before you begin.

Step 2: Anonymise Where Possible

Replace real names, identification numbers, and contact details with fictional placeholders before inputting data. Instead of 'Priya Sharma, Account No. 1234, Balance Rs. 50,000', write 'Client A, Account Ref A1, Balance X'. Reconstruct the real details yourself after the AI has completed its work. Understand that replacing names with codes is pseudonymisation, not anonymisation. Pseudonymised data is still personal data under the DPDPA.

Step 3: Verify That Your Use Case Is Approved

An approved tool does not automatically mean every use of personal data on that tool is approved. Confirm that the specific use case involving this type of data has been reviewed and approved. If you are not sure, submit a review request before you proceed.

C 8 The Use Case Review Process

If your intended AI use falls into the 'Requires Review' category in Clause 6, submit a request through [Intranet Link] before you start. Your request must include: the task and its business purpose, the AI tool you want to use, the type of data you will input including whether it contains personal data, who will see the outputs and how they will be used, and your proposed safeguards such as anonymisation and human review.

The AI Governance Committee, which includes representatives from Legal, IT Security, and the relevant business function, will review the request and respond within five working days. If you do not receive a response within that period, do not proceed. Chase the committee. Starting before approval is a policy violation.

Review Outcome	What It Means
Approved	Proceed as proposed. Record the approval reference in your team log.
Approved with Conditions	Proceed only after implementing the specified conditions. Conditions are not suggestions.
Pilot Approval	A limited, time-bound test is permitted. You must report results before proceeding further.

Not Approved Do not proceed. A written explanation will be provided. You may redesign the use case and resubmit.

C 9 Transparency And Disclosure

If AI was used to produce a deliverable that a client, a regulator, or senior management will rely on, disclose AI involvement. This does not require a lengthy disclaimer on every document. It requires honesty when it matters.

Situation	Required Action
Client deliverable where AI drafted a substantial portion	Add to the document or covering communication: 'AI tools assisted in the preparation of this document. The content has been reviewed and validated by [Name / Role].'
Client personal data was used in an AI process	The client must have been informed through the engagement letter or a specific consent must have been obtained. If not, stop immediately and speak to Legal.
AI assisted in producing public content	Add a clear disclosure that AI assisted in production and that the content was editorially reviewed by a named human.
Internal use only, no personal data, low stakes	No disclosure required, but document the use if your department head requires it.

C 10 Vendor And Third-Party AI Requirements

Any AI vendor whose tool will process personal data on behalf of the organisation must be approved by IT Security and Legal before being added to the Approved AI Tools List. Approval requires the following conditions to be met without exception:

• A signed Data Processing Agreement compliant with the DPDPA must be in place.

• The vendor must commit in writing that it will not use organisational data to train its AI models.
• The vendor must encrypt data in transit and at rest.
• The vendor must notify the organisation within 72 hours of any data breach involving organisational data.

• The vendor must delete all organisational data within 30 days of the contract ending.
• The vendor must assist the organisation in responding to Data Principal rights requests including access, correction, and erasure.

• The vendor must hold and maintain current security certifications such as ISO 27001 or SOC 2 Type 2.
• The vendor must notify the organisation before changing any sub-processor that handles organisational data.

C 11 Monitoring And Enforcement

The organisation may monitor AI tool usage to ensure compliance with this policy. Monitoring will be proportionate and consistent with the Employee Privacy Notice. It may include logging of access to approved AI tools, alerts triggered by unusual data upload volumes to external services, periodic audits of AI use case logs, and annual review of vendor security certifications.

Violations of this policy will be addressed under the organisation's disciplinary framework. Consequences may include a formal warning, revocation of AI tool access, and in cases involving deliberate breach of personal data obligations, termination of employment and referral to the appropriate legal authority.

C 12 Incident Reporting

If you believe personal data may have been uploaded to an unapproved AI tool, or if an AI output has caused or may cause harm to an individual, report it immediately. Do not wait. Do not try to resolve it yourself first. Prompt reporting protects the organisation and it protects you.

Report to: [IT Security Team Email / Hotline] and [Data Protection Officer Email]

Report within: 24 hours of becoming aware of the incident.

Your report must include: the AI tool involved, the data that may have been exposed, how the incident occurred, when you became aware of it, and what steps you have already taken. The organisation will investigate and, where required, notify the Data Protection Board within the timeframe prescribed by the DPDPA Rules.

Employee Acknowledgement

I confirm that I have read and understood the AI Acceptable Use Policy of [Organisation Name]. I agree to comply with all requirements. I understand that violations may result in disciplinary action including termination of employment.

Name: _________________________________ Signature: _________________________________ Date: _____________

Part 3 Clause By Clause Analysis: Why, Checklist, And Enforcement

Every clause in Part 2 was drafted for a specific reason. Every clause carries legal weight. Every clause has practical enforcement requirements that specific departments must carry out.

This part explains all of that for each of the twelve clauses. Read this section before you adapt the model policy. It will help you make better decisions about what to keep, what to adjust, and what additional clauses your specific organisation may need.

C 1 Purpose And Scope: Analysis

Why This Clause Exists

This is the foundation on which everything else stands. A policy with a poorly drafted scope clause is a policy with gaps that employees will walk through. The most common argument employees make when accused of violating an AI policy is: 'I did not know this applied to me in this situation.' If your scope clause only says 'all employees using company systems', an intern working from home on her personal laptop has a credible argument. If a contractor working on your client's data says he was not an employee, he has a credible argument. If someone says the AI tool they used was not for work, they may have a credible argument.

The Reasoning That Must Drive Scope Drafting

Personal data does not stop being personal data because the person handling it is a contractor rather than an employee, or because they are at home rather than in the office, or because they used a personal device rather than a company laptop. The DPDPA obligation follows the data, not the employment contract or the device. Your scope clause must follow the same logic.

Checklist Before You Finalise This Clause

☐ Have you listed every category of worker: employees, contractors, interns, gig workers, temporary staff?

☐ Does the clause explicitly cover remote work and work from personal devices?

☐ Have you included AI features embedded in software already in use, such as AI summarisers in video conferencing tools?

☐ Is the effective date confirmed and the review cycle set?

Practical Illustration

A mid-size accounting firm issues an AI policy that applies to 'all employees using company systems.' A junior accountant working from home uploads a client balance sheet to the free version of ChatGPT on her personal laptop. The firm attempts disciplinary action. The accountant argues the policy said 'company systems' and she used her personal laptop. The firm has no answer because its scope clause was not wide enough. A properly drafted clause covering personal devices and home working would have resolved this immediately.

Departmental Enforcement: Who Does What

Department	Specific Action Required	Frequency	What Happens If They Do Not Do It
Legal and Compliance	Draft scope to cover every worker category and working arrangement. Update whenever the workforce model changes.	At policy issue and on change	The policy has gaps. Employees escape accountability through definitional loopholes.
HR	Maintain an accurate register of all worker categories including contractors and interns. Share this with Legal when the policy is reviewed.	Quarterly update	Scope clause is drafted without knowing who actually works for the organisation.
IT Security	Map all devices and locations from which company data is accessed. Confirm the scope covers all of them.	Annual review	The policy does not cover the environments where breaches actually happen.
Department Heads	Ensure every person in the team, including all contractors and interns, has received and acknowledged the policy.	At onboarding and each renewal	Non-employee workers operate entirely outside the AI governance framework.

C 2 Definitions: Analysis

Why This Clause Exists

Policy words mean exactly what you define them to mean. No more and no less. If you do not define 'personal data', employees will use their own understanding of what it means, and that understanding is almost always narrower than the legal definition. Most employees think personal data means a national ID number or a medical record. They do not think it covers a client's name combined with their account balance, or a list of employees with their leave records, or a spreadsheet of customer names and purchase histories.

THE REASONING BEHIND PRECISE DEFINITIONS

The DPDPA defines personal data very broadly: any data about an individual who is identifiable by or in relation to such data. This is deliberately wide. A name alone can be personal data. A phone number alone can be personal data. Two pieces of information that are harmless individually can become personal data when combined. Your definition must reflect this breadth, not the narrow intuitive version employees carry in their heads.

Checklist Before You Finalise This Clause

☐ Is your definition of 'personal data' consistent with Section 2(t) of the DPDPA?

☐ Is 'public AI tool' defined broadly enough to cover future platforms, not just the ones that exist today?

☐ Is 'approved AI tool' defined to make clear that approval is a formal process, not an informal email?

☐ Is 'high-risk use case' defined in language a non-lawyer line manager can apply?

☐ Is 'Data Processing Agreement' defined and its absence stated as disqualifying for any vendor?

Practical Illustration

A bank's AI policy defines 'high risk data' as data classified as Restricted under the internal data classification policy, which was written ten years ago and predates AI entirely. An operations manager uses an AI tool to analyse a spreadsheet of customer names and account balances. He does not consider it Restricted because the old classification system never contemplated AI scenarios. The data goes to a public tool. When discovered, the manager argues the policy definition did not cover this. A definition aligned with the DPDPA's own language would have covered it without any ambiguity.

Departmental Enforcement: Who Does What

Department	Specific Action Required	Frequency	What Happens If They Do Not Do It
Legal and Compliance	Draft definitions aligned with DPDPA Section 2. Cross-reference with the existing data classification policy.	At policy drafting and each annual review	Policy definitions diverge from law. Compliance gaps appear immediately.
HR	Include the definitions in AI training with practical examples. Test employees to confirm they can correctly identify personal data.	Each training cycle	Employees know the definitions exist on paper but cannot recognize personal data in real files.
All Department Heads	When definitions are updated, brief the team on what changed using examples from their own work.	Each policy update	Definition updates do not reach the people who handle the actual data.

C 4 Core Principles: Analysis

Why This Clause Exists

No policy can anticipate every situation an employee will encounter. AI technology is changing so rapidly that specific rules written today will be incomplete within a year. Principles fill the gaps. When an employee faces a situation the specific rules do not cover, the principles tell them what the right response is. An employee who has genuinely internalised the six principles will almost always make the right call even in a situation the policy never explicitly addressed.

Each principle maps directly to a legal obligation under the DPDPA:

Principle	DPDPA Provision It Reflects
Protect Personal and Confidential Data	Section 4 (lawful processing), Section 6 (consent), Section 8(5) (security safeguards)
You Are Responsible for Every AI Output	Section 8(1): the Data Fiduciary is accountable for all processing, including that done by processors on its behalf
Be Honest About AI Use	Section 5 (notice obligation), Section 11 (right of access for Data Principals)
Follow the Law	Every provision of the DPDPA and the IT Act 2000
Verify Everything	Section 8(3): obligation to ensure accuracy and completeness of personal data processed

The Reasoning Behind Principle 2: Human Accountability

This is the principle that most organisations underestimate. When an AI tool makes an error that causes harm, the question the law asks is not what did the AI do but what did the Data Fiduciary do. The Data Fiduciary is your organisation. The employee acting on behalf of the organisation carries that accountability forward. An AI output that was used without being checked, that caused harm to an individual, is a failure of the Data Fiduciary's obligation to ensure accurate and responsible processing. The AI company will not share that liability. You will carry it entirely.

Checklist Before You Finalise This Clause

☐ Are all six principles in the training materials with specific examples drawn from your industry?

☐ Is Principle 2 supported by a process for employees to flag AI outputs they believe are wrong?

☐ Is Principle 3 supported by template disclosure language employees can actually use?

☐ Is Principle 4 backed by a process for fairness review of AI use cases that affect individuals?

☐ Is Principle 6 supported by verification checklists for the most common AI use cases in your organisation?

Practical Illustration

A financial services company uses AI to draft investment proposals for clients. An AI output contains an incorrect tax rate for a specific instrument. The employee sends it to the client without checking. The client makes an investment decision based on incorrect information. The company argues the AI made the error. The regulator points out that the employee signed the proposal and the company's own policy stated that employees are responsible for AI outputs. The accountability principle means the Data Fiduciary and the employee acting on its behalf are responsible for the accuracy of all processing, including AI-generated processing. Principle 2 would have required verification before sending.

C 5 Approved And Prohibited Tools: Analysis

Why This Clause Exists

This is the most operationally critical clause in the entire policy. Every AI vendor that processes your personal data is a Data Processor under the DPDPA. Section 8(2) requires that you only engage Data Processors under a valid contract that includes specific data protection obligations. A public AI tool, such as the free version of ChatGPT, has no such contract with your organisation. When your employee uploads personal data to that tool, you are in breach of Section 8(2) before anything else has even gone wrong.

The Reasoning Behind The Approved List Requirement

Approval is not a bureaucratic checkbox. It is the mechanism through which the organisation satisfies its legal obligation to ensure that every Data Processor it engages provides sufficient guarantees of security and compliance. The organisation cannot fulfil this obligation with an unapproved tool. There is no contract. There is no security assessment. There is no deletion guarantee. There is nothing. An approved tool is one where the organisation has done the work to confirm the legal and technical basis for processing personal data on that platform.

The Vendor Approval Process: What It Must Actually Look Like

Many organisations assume that because their IT team uses a tool, it is approved. That is not sufficient. Approval for the purposes of this policy requires the following steps:

1. IT Security assesses the vendor's security posture: encryption standards, data residency, access controls, and certifications such as ISO 27001 or SOC 2.

2. Legal Reviews The Vendor's Terms Of Service And Privacy Policy To Identify Data Protection Gaps.

3. Legal negotiates a Data Processing Agreement that meets DPDPA requirements: the no-training clause, breach notification timelines, deletion obligations, and audit rights.

4. The approved tool is added to the Approved AI Tools List specifying the purposes for which it is approved and the data types it may handle.

5. The Approval Is Reviewed Annually And Immediately When The Vendor Changes Its Terms Or Its Technology.

Checklist Before You Finalise This Clause

☐ Is the Approved AI Tools List a live, maintained document with a clear owner?

☐ Does every tool on the list have a signed Data Processing Agreement addressing AI-specific risks?

☐ Does the list specify, for each tool, which data types it may be used with?

☐ Is there a formal request process for employees to nominate new tools?

☐ Does the clause address embedded AI features in software already licensed, such as Copilot in

Microsoft 365?

☐ Does the clause address personal accounts on otherwise approved platforms?

☐ Is there a process for what happens when an approved vendor changes its terms of service?

Practical Illustration: The Embedded AI Problem

A large law firm approves Microsoft 365 Copilot after thorough review, because the Microsoft enterprise agreement included Copilot-specific data protection terms. Six months later, employees start using a third-party AI summarisation plugin in their browsers. The plugin integrates with Outlook and can read emails. No one checked the approved list. The plugin's terms allow it to use email content to improve its AI model. Client emails are being processed by an unapproved Data Processor with no DPA in place. The Approved AI Tools List must explicitly address plugins and browser extensions. IT must have technical controls to prevent unapproved extensions from accessing company data.

Departmental Enforcement: Who Does What

Department	Specific Action Required	Frequency	What Happens If They Do Not Do It
IT Security	Maintain the Approved AI Tools List. Assess every vendor technically before approval. Deploy DLP tools to detect and block unapproved AI usage. Monitor for shadow AI on company networks.	List reviewed quarterly; controls maintained continuously	Employees use unapproved tools because there is no technical barrier to doing so.
Legal and Compliance	Review and negotiate the DPA for every approved tool. Maintain a contract register with renewal and certification expiry dates. Monitor vendor communications for changes to terms.	Annual contract review; immediate review on vendor notice	Approved tools operate without legally compliant data protection terms.
Finance and Procurement	Refuse to process any payment for an AI tool not on the approved list. Require Legal sign-off on all AI software contracts before execution.	Every procurement decision	Employees purchase AI tools on company accounts without going through any approval process.
HR	Include the approved tool list and the new tool request process in all AI training. Ensure employees know using an unapproved tool is a disciplinary matter.	At onboarding and each training cycle	Employees do not know the list exists or how to check it.

C 6 What You Can And Cannot Do: Analysis

Why This Clause Exists

Principles and definitions tell employees what they should value. The acceptable and prohibited uses clause tells them specifically what to do and not do. These two levels of the policy work together. Without specific examples, employees will self-classify uncertain situations as permitted and proceed without oversight. The three-tier structure of always allowed, always prohibited, and requires review is deliberate. Most employees classify situations as either fine or not fine. The middle tier captures the significant portion of cases that are not obviously one or the other.

The Reasoning Behind Making The Physical Document Prohibition Explicit

The prohibition on scanning physical documents and uploading the scans to public AI tools must be stated explicitly in this clause because most employees do not understand that scanning digitises data and triggers the DPDPA immediately. It must not be left to inference from the general prohibition on uploading personal data. The specific scenario must be named. If you do not name it, employees who are caught will argue that they did not realise a scan was the same as a digital file. You cannot afford to have that argument after the event.

Checklist Before You Finalise This Clause

☐ Have you tested the always-allowed list against your organisation's actual common AI tasks?

☐ Is the always-prohibited list written in absolute terms with no exceptions in the language?

☐ Is the 'requires review' category described specifically enough that employees can self-identify when they fall into it?

☐ Are the examples from your industry, not generic examples?

☐ Is the review submission process simple and fast enough that employees will actually use it?

☐ Is the physical document scanning scenario explicitly named in the always-prohibited section?

Practical Illustration: The Scanned Document In Full Detail

An HR manager at a manufacturing company needs to summarise three months of attendance records for a Board presentation. The records are in a physical register. She scans all 90 pages into a PDF and uploads it to a free AI summarisation website. The PDF contains the names, dates, arrival times, departure times, and leave details of 340 employees.

What has just happened, in legal terms: the DPDPA applied from the moment of scanning, because the physical records were digitised. At the point of upload, the manager has processed personal data of 340 individuals without a lawful basis under Section 4, shared it with an unapproved Data Processor without a contract under Section 8(2), and in all probability made a cross-border transfer to a foreign server under Section 16. There are three separate compliance failures in one upload. One clear sentence in the always-prohibited list would have told her exactly why she could not do this.

Departmental Enforcement: Who Does What

Department	Specific Action Required	Frequency	What Happens If They Do Not Do It
Legal and Compliance	Review the always-prohibited list against each new DPDPA Rule or regulatory guidance and update as new categories of risk emerge.	Annual review and on regulatory change	The prohibited list becomes outdated as AI capabilities and risks evolve.
IT Security	Configure DLP tools to detect patterns consistent with personal data being uploaded to unknown external URLs. Create alerts for mass uploads to external services.	Continuous monitoring	Prohibited behaviour goes undetected until a complaint is made.
HR	Include concrete examples of each tier in training, using scenarios from the organisation's own work. Run an annual refresher focused on new scenarios that emerged since the last training.	At onboarding and annually	Employees cannot connect abstract rules to their daily tasks.

Line Managers

When a team member is unsure which tier a use falls into, provide clear guidance or escalate to Legal. Do not tell employees to 'use common sense' on matters with legal consequences.

As situations arise

Employees receive incorrect guidance from managers who are also guessing.

C 7 How To Handle Data Before Using AI: Analysis

Why This Clause Exists

Even when an employee has an approved tool and an approved use case, how they handle the data before inputting it into the AI matters enormously. The DPDPA's data minimisation obligation, which runs through Section 8(3) and the overall accountability framework, requires that only as much personal data as is necessary for the purpose is processed. Many AI-related data breaches happen not because the tool was wrong or the use case was unapproved, but because the employee uploaded far more data than was needed for the task.

The Reasoning Behind Making Minimisation A Mandatory Pre-Input Step

Data minimisation is not a soft preference under the DPDPA. It is part of the overarching obligation of the Data Fiduciary to process personal data responsibly. An organisation that regularly feeds entire client files into AI tools when only two fields from each file were actually needed is not meeting this obligation, even if the tool is approved and the use case is reviewed. The habit of minimisation must be built into the workflow, not left to individual discretion.

The Difference Between Anonymisation And Pseudonymisation

Most employees call pseudonymisation anonymisation. The difference matters under the DPDPA. True anonymisation means the individual cannot be re-identified even with additional information available. This is very hard to achieve because AI tools are specifically designed to extract patterns and connections from data. What most employees actually do is replace names with codes while keeping all other details intact. This is pseudonymisation. Pseudonymised data is still personal data under the DPDPA and must be protected accordingly. The safest approach for AI testing is synthetic data: entirely made-up data that mirrors the statistical patterns of real data but contains no actual personal information.

Checklist Before You Finalise This Clause

☐ Is the minimisation step a decision rule, not just an aspiration: ask whether each field is necessary, not just useful?

☐ Does the anonymisation guidance acknowledge that pseudonymisation is not the same as anonymisation?

☐ Is there guidance on how to generate or source synthetic data for testing?

☐ Is the step-3 verification step connected to a specific person or team the employee can contact?

☐ Is there a one-page reference card based on this clause that employees can keep at hand?

Practical Illustration

An insurance company analyses claims trends using an approved AI analytics tool under an approved use case. The analyst uploads a full claims dataset containing claimant names, addresses, policy numbers, claim amounts, medical diagnoses, and settlement outcomes. The task the AI actually needs to perform is identifying seasonal trends in claim frequency by region. For that purpose, the analyst needs claim dates, regions, and claim categories. She does not need claimant names, addresses, or medical diagnoses. Uploading all of that is a violation of the minimisation obligation under the DPDPA, even though the tool is approved and the use case is reviewed. A minimisation checklist built into the use case workflow would have prompted her to strip the unnecessary fields before uploading.

Departmental Enforcement: Who Does What

Department	Specific Action Required	Frequency	What Happens If They Do Not Do It
Legal and Compliance	Draft and maintain data minimisation guidelines aligned with Section 8(3). Provide specific examples for each business function of what minimisation looks like in their work.	Annual review	Data minimisation remains a legal concept employees cannot apply to real files.
IT Security	Provide tools that help employees anonymise or pseudonymise data before AI processing. Make these tools easy to find and use. Do not assume employees will develop their own workarounds.	Ongoing provision and maintenance	Employees want to minimise but have no practical way to do so efficiently.
Data Protection Officer	Include data handling protocol reviews in each DPIA. Check periodically whether approved use cases are actually following minimisation steps, not just specifying them.	In each DPIA and in periodic audits	Approved use cases drift from their approved parameters over time without detection.
Department Heads	Spot-check data inputs that team members use for AI tasks. If a team member routinely uploads more data than is necessary, correct this immediately and document the correction.	Monthly random checks	Over-sharing of data becomes normalised practice within the team.

C 9 Transparency And Disclosure: Analysis

Why This Clause Exists

The DPDPA is built on transparency. Section 5 requires the Data Fiduciary to give Data Principals a notice before or at the time of collecting their personal data, specifying the purposes for which it will be processed. If AI is used to process a client's personal data, AI must be in the privacy notice. It is not sufficient to have a notice that was accurate when it was written but has since become out of date. A notice that does not mention AI processing is an incomplete notice. Processing personal data under an incomplete notice is unlawful processing.

The Reasoning Behind Updating Privacy Notices Before The Policy Goes Live

Most Indian organisations have privacy notices that were written before AI tools existed. Those notices describe the purposes of processing in terms that do not include AI-assisted analysis, AI-assisted drafting, or AI-assisted decision support. Every AI use case that processes personal data adds a new purpose. Every new purpose must be in the notice. The sequence is non-negotiable: update the notice first, then deploy the AI tool. Not the other way around.

What The Privacy Notice Must Now Include

• A statement that the organisation uses AI tools to assist in processing personal data.

• The categories of personal data that may be processed using AI systems.
• The purposes for which AI processing is used.

• The names or categories of AI vendors used as Data Processors.

• The countries where data may be processed if AI tools are hosted abroad.

• How Data Principals can exercise their rights in relation to AI-processed data.

Checklist Before You Finalise This Clause

☐ Has the external privacy notice been reviewed and updated to include AI processing before the policy goes live?

☐ Has the employee privacy notice been updated to include AI systems used in HR processes?

☐ Is there standard disclosure language for employees to add to client deliverables where AI was materially involved?

☐ Have client engagement letters been updated to include an AI disclosure clause?

☐ Is there a process for obtaining specific client consent for AI processing where consent is the lawful basis?

Practical Illustration: The Section 11 Request

A client of a professional services firm requests information about how their data has been processed, exercising their right under Section 11 of the DPDPA. The DPO discovers that the engagement team has been using an approved AI tool to summarise client documents and draft deliverables for this client for eight months. The client's privacy notice, signed at the start of the engagement, makes no mention of AI. The DPO must inform the client that their data was processed by AI in a way that was not disclosed at the time of collection. The firm faces a potential complaint to the Data Protection Board for failure to give proper notice under Section 5 of the DPDPA. Updating the privacy notice and engagement letter before the AI policy went live would have prevented this entirely.

Departmental Enforcement: Who Does What

Department Specific Action Required Frequency What Happens If They Do Not Do It

Legal and Compliance	Update all privacy notices before the policy goes live. Update engagement letters, contracts, and consent forms. Draft standard disclosure language for employees.	Before policy goes live; annual review	The organisation processes personal data under AI without meeting the Section 5 notice obligation.
Client-Facing Teams	Ensure every client has received the updated engagement letter with the AI disclosure clause before AI tools are used on their data. Flag any client objection to Legal.	Every new engagement and at each renewal	Clients discover AI use after the fact. Regulatory risk and relationship damage both follow.
HR	Update the employee privacy notice before any AI tool is used in HR processes. Circulate to all current employees and obtain fresh acknowledgement.	Before any HR AI system is deployed	Employees whose data is processed by AI have not been informed, violating Section 5.
Data Protection Officer	Maintain a log of all active privacy notices. Ensure each is current and covers AI processing. Review notices when new AI use cases are approved.	Annual review and at each new use case approval	Privacy notices drift out of alignment with actual processing activities.

Part 4 DPDPA Compliance Map

This table maps every significant provision of the DPDPA to the AI risk it addresses and the policy clause that manages it. Use this when conducting a compliance review or when reporting to the Board.

DPDPA Section	AI Risk It Addresses	Policy Clause
Section 4: Lawful Processing	Every upload of personal data to an AI tool requires a lawful basis. Most current AI use in Indian workplaces has none.	Clauses 6 and 8
Section 5: Notice	Privacy notices do not disclose AI processing. Processing without proper notice is unlawful regardless of tool approval.	Clause 9
Section 6: Consent	Consent for one purpose does not cover AI processing of the same data. AI-specific consent is required.	Clauses 6 and 9
Section 8(1): Fiduciary Accountability	The organisation is accountable for all processing including that done by AI vendors on its behalf.	Clause 4, Principle 2
Section 8(2): Processor Obligations	AI vendors are Data Processors. Engaging them without a DPA is a direct violation.	Clauses 5 and 10
Section 8(3): Data Quality	AI perpetuates and amplifies inaccurate data. The accuracy obligation applies to AI outputs used in decisions.	Clause 4, Principle 6
Section 8(5): Security Safeguards	Uploading to public AI tools bypasses all organisational security. Security obligations cannot be met.	Clauses 5 and 6
Section 8(6): Breach Notification	AI tools can cause large-scale breaches rapidly. Mandatory notification requires a fast incident response.	Clause 12
Section 9: Children's Data	AI tools interacting with users may process children's data without age verification.	Clauses 6 and 10
Section 10: Significant Data Fiduciaries	SDFs must conduct algorithmic impact assessments and have enhanced AI governance obligations.	Clause 8
Section 11: Right of Access	Data Principals can request information about AI processing of their data. Records must support this.	Clauses 8 and 9
Section 12: Correction and Erasure	If AI produced an incorrect output affecting an individual, the individual can request correction.	Clauses 4 and 8
Section 13: Grievance Redressal	Individuals affected by AI decisions must have a mechanism to raise complaints.	Clauses 6 and 8
Section 16: Cross-Border Transfers	Most AI tools are hosted outside India. Every upload of personal data is a cross-border transfer.	Clauses 5 and 10
DPDP Rules: Security Standards	Minimum security standards for processing must be flowed through to AI vendors via DPAs.	Clause 10
DPDP Rules: DPIA Process	High-risk AI use cases require a Data Protection Impact Assessment before deployment.	Clause 8