India Digital Personal Data Protection Act + AI Advisory (MEITY)

Scope and obligations

India's primary AI-adjacent statute is the DPDPA + MEITY's binding AI advisories (Mar 2024 + Apr 2024 walked-back versions). No dedicated AI law yet; the proposed Digital India Act was paused 2024-2025. Affects 1.4B people — the single largest population under any AI-governance regime tracked here.

India Digital Personal Data Protection Act + AI Advisory (MEITY) addresses 4 contested AI-governance topics explicitly, 4 via general principles,.

Topics governed

• implicit
  Foundation Models / GPAI— MEITY Apr-2024 advisory walked back the Mar-2024 pre-deployment-approval requirement; current approach is post-deployment incident reporting
• governs
  Deepfakes / Synthetic Content— MEITY Mar-2024 Advisory + IT Rules 2021 §3(1)(b)(v) deepfake takedown obligations
• implicit
  Transparency Obligations— DPDPA §5 notice requirements + MEITY Mar-2024 Advisory transparency mandates
• governs
  Individual Redress— DPDPA §§13-15 (data principal rights, grievance + Data Protection Board)
• governs
  Training-Data Rights— DPDPA §§4-7 (consent + purpose limitation for AI training data)
• governs
  Development-Rights Framings— Digital India framing centres development rights + tech-sovereignty; explicit in DPDPA preamble + MEITY's AI Mission documents
• implicit
  AI in Elections— DPDPA Art. 4 + MEITY Mar 2024 advisory on synthetic content ahead of national elections
• implicit
  National Security Carveouts in AI Regulation— DPDPA exemptions for state-security functions (Art. 17); not specifically AI but applies

Enforcement record

Documented enforcement actions catalogued against India Digital Personal Data Protection Act + AI Advisory (MEITY) (or against rules that this instrument now subsumes).

• MEITY deepfake takedown advisoriesIN · 2023–2024
  Ministry of Electronics and Information Technology (MEITY) v. Multiple intermediaries — Meta, YouTube/Google, X, several Indian social platforms — Failure to take down political deepfake content within statutory windows (36 hours under IT Rules 2021). MEITY's Mar-2024 advisory additionally required pre-deployment-approval for AI models above unspecified capability thresholds; rescinded Apr-2024 after frontier-lab pushback.
  Lesson: India's compressed legislative cycle: a sweeping pre-deployment-approval requirement (closer to CN registration than US sectoral) was rescinded within 5 weeks after industry + civil-society pushback. Demonstrates that Global South AI regulation is in active design AND that even nationally-coercive states face frontier-lab leverage. Indian regulatory approach now favours post-deployment incident reporting + IT-Rules takedown.
  Source record →

Cross-jurisdiction comparison

How peer instruments treat the topics India Digital Personal Data Protection Act + AI Advisory (MEITY) governs.

°= industry self-imposed voluntary framework. Comparing a voluntary code's "governs" tint with a binding regulation's "governs" tint flattens the legal-force distinction; use the instrument-page banner for the operative status of each.

How to cite this article

Policy Window. (2023). India Digital Personal Data Protection Act + AI Advisory (MEITY) [Wiki article — Instrument]. https://policywindow.org/wiki/india-dpdpa

Policy Window. 2023. "India Digital Personal Data Protection Act + AI Advisory (MEITY)." Wiki article (Instrument). https://policywindow.org/wiki/india-dpdpa.

@misc{policywindow-india-dpdpa,
  title  = {India Digital Personal Data Protection Act + AI Advisory (MEITY)},
  author = {Policy Window},
  year   = {2023},
  howpublished = {Digital Personal Data Protection Act, 2023 + MEITY AI Advisories (2024)},
  url    = {https://policywindow.org/wiki/india-dpdpa},
  note   = {Primary source: https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf}
}

Related instruments

• EU AI Act · EU
• Interim Measures for Generative AI Service Management · CN
• NIST AI RMF Generative AI Profile · US
• Brazil AI Bill (PL 2338/2023) · BR