この記事は現在英語でのみご利用いただけます。
AI and Your Rights in India: DPDP Act, Consumer Protection, and What You Can Do When AI Affects You
India's Digital Personal Data Protection Act 2023 creates data rights for Indian residents — including rights over personal data used in AI systems. Here is what those rights are and how to use them.
Key Takeaways
India's DPDP Act 2023 gives individuals (data principals) rights including: access to personal data held about you, correction of inaccurate data, withdrawal of consent, and the right to file complaints with the Data Protection Board.
Organisations must tell you what personal data they collect and for what purposes before or at the time of collection. Consent must be specific — you cannot be required to consent to AI training as a condition of a basic service.
If an AI system has made a decision affecting you, you can request access to the personal data the organisation holds about you and request correction of any inaccurate data.
The Consumer Protection Act 2019 applies to unfair trade practices and product liability for AI-driven consumer products — defective AI products that cause consumer harm may give rise to consumer court claims.
RBI regulations require banks and NBFCs to give specific reasons for credit rejections including AI-driven ones. The Banking Ombudsman Scheme provides a free complaint mechanism for banking-related AI decisions.
The Data Protection Board (to be established under DPDP Act rules) will be the primary complaint authority for data protection violations. Until then, existing consumer and financial regulators provide complaint mechanisms.
"情報提供のみを目的としています。この記事は法律、規制、財務または専門的なアドバイスを構成するものではありません。具体的なアドバイスについては、資格を持つ専門家にご相談ください。"
Your DPDP Act rights
The DPDP Act 2023 gives Indian individuals four categories of rights over their personal data. Right of access: ask any organisation what personal data it holds about you, for what purposes, and with whom it has been shared — including data used in AI systems. Right to correction and erasure: ask organisations to correct inaccurate or incomplete data, and erase data no longer necessary for the purpose for which it was collected. Inaccurate data in AI systems can produce inaccurate assessments — correcting it is an important first step. Right to grievance redress: have grievances addressed by organisations, and escalate to the Data Protection Board when established. Right to nominate: designate someone to exercise your DPDP Act rights in the event of death or incapacity.
Consent and AI
Organisations must obtain your specific, informed consent before using your personal data in AI systems for purposes you would not reasonably expect. Consent must be given through a clear affirmative action — pre-ticked boxes or buried terms do not constitute valid consent. You have the right to withdraw consent at any time. If an organisation is using your personal data in an AI system for a purpose you did not agree to, you can withdraw consent, file a grievance with the organisation, and when the Data Protection Board is operational, escalate the complaint there.
Financial services AI
The Reserve Bank of India requires banks and NBFCs to give specific reasons for credit rejections. If an AI-driven credit decision has rejected your application, the lender must provide specific reasons. If inadequate, file a complaint with the Banking Ombudsman at bankingombudsman.rbi.org.in. For securities-related AI decisions, file with SEBI at scores.gov.in.
Consumer protection
The Consumer Protection Act 2019 provides a framework for challenging unfair trade practices and defective products including AI-based consumer products and services. Consumer forums at the district, state, and national levels hear such complaints. The National Consumer Disputes Redressal Commission (NCDRC) handles larger claims. Complaints are generally free or low-cost and accessible without legal representation.