DPDP's AI rule is
one sentence long.

1 · The sentence

If you have been told that DPDP imposes a body of AI obligations, it is worth reading the only provision in the instruments that speaks to algorithms at all. Here it is in full, not paraphrased:

RULE 13(3) · DPDP RULES, 2025 · VERBATIM "A Significant Data Fiduciary shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals."

That is the whole of it. We quote it from a checksum-pinned copy of the government artifact — G.S.R. 846(E) as corrected by G.S.R. 892(E) — rather than from an explainer, because explainers drift and corrigenda get missed. The digest of that exact provision is cfd4b52d…f008c0a, and you are welcome to check it against the gazette yourself. That is rather the point.

2 · Three things it is not

It is not a duty for everyone. Rule 13 applies to Significant Data Fiduciaries — organisations notified as such by the Central Government. If you have not been notified, this is sound practice rather than an obligation. Establish which side of that line you are on before anyone builds a programme around it.

It is not an AI rule. Read it again: "technical measures including algorithmic software," across hosting, display, uploading, modification, publishing, transmission, storage, updating and sharing. AI is one instance of a much wider duty. An AI-governance module is part of the answer to Rule 13(3) and never the whole of it — including ours, which we will come back to.

It is not an approval regime. The duty is to observe due diligence and verify. Nothing requires pre-clearance and nothing prohibits a class of system. What can actually be checked later is whether you verified, against what, when, and whether it was written down.

3 · What the Act does not contain

Teams arriving from a GDPR programme routinely budget for controls DPDP does not ask for. As the instruments stand, there is no right against solely automated decision-making, no profiling provision, and no algorithmic explainability right. The rights the Act does confer are access, correction and erasure, grievance redressal, and nomination — S.11 through S.14, and none of them is an AI right.

A NOTE ON THAT COMPARISON The DPDP statements above come from our pinned, verifiable copy of the text. The GDPR contrast does not — it rests on general knowledge, and we hold no verified source for it the way we do for the Indian instruments. We would rather show you that difference than present both at the same confidence. Take the comparison as orientation and confirm it with your counsel.

4 · Where your AI is actually caught

Here is the part that gets lost when the conversation stays on Rule 13(3). Training a model on personal data is processing. Running inference on personal data is processing. So the ordinary obligations apply to your AI in full — notice and consent for the purpose it is used for, purpose limitation, reasonable security safeguards, breach notification, and the principal's rights. That surface is far larger than the one sentence everyone is asking about, and it is where the real work sits.

The hard one is erasure. When a person withdraws consent, the obligation reaches their personal data — and a model trained on that data raises a question most AI programmes have not answered, and cannot answer quickly. If you take one item away from this post, make it that one. It is much better surfaced now, while the architecture is still movable, than during a rights request with a clock running on it.

5 · Why we are the ones telling you the law asks less

It would be easier to sell you an AI compliance module by implying the Act demands one. A good deal of what you will read this year does exactly that. We would rather you knew that Rule 13(3) is narrow, binds a defined set of organisations, and is not the reason to buy anything — and then decide for yourself whether the wider surface in section 4 is worth help with.

For what it is worth, Consent Tree does keep an AI systems register, risk assessments that carry an expiry so "assessed" ages visibly rather than standing forever, a decision log with a human review path, and a reading of the Significant Data Fiduciary obligations that reports each limb as met, open, or could-not-assess — never as a score. That reading also states, in its own response, that it covers AI systems only and that Rule 13(3) reaches technical measures we do not yet register. We would rather hand you a measurement with its limits attached than a green tick you would have to take on trust.

And to answer the question your security team is about to ask: statutory answers in our own product are retrieved from that pinned corpus and must cite a provision or refuse. The law does not live in a model's weights. It never should.