India Digital Personal Data Protection Act + AI Advisory (MEITY) — vendor disclosure form

1. Vendor identification

2. AI system identification

3. Provision-specific questions

1. Deepfakes / Synthetic Content. Does the offered system generate or substantially modify audio / video / image / text in ways requiring disclosure or machine-readable provenance under India Digital Personal Data Protection Act + AI Advisory (MEITY) (MEITY Mar-2024 Advisory + IT Rules 2021 §3(1)(b)(v) deepfake takedown obligations)? Describe the disclosure + provenance mechanisms implemented and their robustness against removal.

   (Cite: MEITY Mar-2024 Advisory + IT Rules 2021 §3(1)(b)(v) deepfake takedown obligations)

2. Individual Redress. Describe the end-user redress + complaint channel offered for the system, including documented appeal path and response-time commitment, consistent with India Digital Personal Data Protection Act + AI Advisory (MEITY) (DPDPA §§13-15 (data principal rights, grievance + Data Protection Board)).

   (Cite: DPDPA §§13-15 (data principal rights, grievance + Data Protection Board))

3. Training-Data Rights. Identify the legal basis for training-data sourcing for the offered system (including copyright, consent, and any text-and-data-mining exemptions relied upon) and confirm consistency with India Digital Personal Data Protection Act + AI Advisory (MEITY) (DPDPA §§4-7 (consent + purpose limitation for AI training data)).

   (Cite: DPDPA §§4-7 (consent + purpose limitation for AI training data))

4. Development-Rights Framings. Describe the offered system's compliance posture relative to the India Digital Personal Data Protection Act + AI Advisory (MEITY) provisions identified at: Digital India framing centres development rights + tech-sovereignty; explicit in DPDPA preamble + MEITY's AI Mission documents.

   (Cite: Digital India framing centres development rights + tech-sovereignty; explicit in DPDPA preamble + MEITY's AI Mission documents)

4. Documentation enclosures expected

Tick each enclosure attached to the vendor response. Missing enclosures should be explained in the “Variances” field below.

• Copies of submitted regulatory reports / registrations
• Transparency documentation (per-instrument schema)
• Training-data summary / provenance log
• Vendor company registration + insurance certificates
• Sub-processor / supply-chain list (including model upstream)

5. Vendor attestation

The undersigned, on behalf of the vendor, attests that the disclosures above are true and complete to the best of their knowledge at the date signed, and undertakes to notify the buyer in writing within 30 days of any material change to those disclosures.