What it means
- Before using personal data to train, test or run an AI system, confirm you have a valid basis under the DPDP Act 2023 (consent, or a listed legitimate use) for that specific purpose.
- If data was collected for one purpose (servicing a loan) and you now want to use it for another (training a marketing model), check whether the original notice and consent cover it.
- Notices tell people in plain language that AI is used and what data it uses; consent can be withdrawn, and withdrawal is honoured.
- Covers personal data sent to external AI providers too.
Why it matters
- RBI FREE-AI expects AI data use aligned with the DPDP Act.
- Using data beyond its stated purpose is one of the easiest DPDP breaches to prove.
- ICMR and NITI Aayog guidance both stress consent and user control.
Checklist
- For each AI system using personal data, record the purpose, data categories, and lawful basis in the record of processing.
- Check privacy notices mention AI use and the relevant purposes; update notices and consent flows where they do not.
- Assess whether new AI purposes are compatible with the original collection; seek fresh consent where needed.
- Build a way to honour consent withdrawal for AI uses (exclude from future training and inference).
- Ensure DPAs with AI vendors restrict use of personal data to your instructions.
- Have the DPO or privacy lead sign off before go-live.
Evidence examples
- Record of processing entry for the AI underwriting model with lawful basis.
- Updated privacy notice (version and date) mentioning AI-assisted decisions.
- Consent manager logs or consent records for AI-specific purposes.
- DPO sign-off on the AI system's privacy review.
- Vendor DPA clause restricting training on customer personal data.
Common pitfalls
- Assuming "we already have the data" means "we can use it for AI".
- Privacy notice silent on AI and automated decisions.
- Withdrawal honoured in the CRM but not in model training pipelines.
- Pasting customer data into public GenAI tools.
Satisfies
- BindingEU AI Act
- SupervisoryPRA SS1/23
- SupervisoryNYDFS AI Cybersecurity Letter 2024
- BindingTexas TRAIGA
- SupervisoryOSFI E-23
- VoluntaryRBI FREE-AI
Also relevant to
- ICMR AI in Healthcare Guidelinesno numbered obligations; mapped in its practical notes (consent, user control over data)
- NITI Aayog Responsible AI for Allno numbered obligations; mapped in its practical notes (privacy and security principle)
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- A.7.3 Acquisition of data
ISO/IEC 27001
- A.5.31 Legal, statutory, regulatory and contractual requirements
- A.5.34 Privacy and protection of PII
SOC 2
- P1.1
- P2.1
- P3.1
- P3.2
- P4.1
Key takeaways
- Every AI use of personal data needs a purpose and a valid basis under the DPDP Act.
- Partial reuse from ISO 27001 (A.5.31, A.5.34); much stronger reuse if you already run a DPDP privacy programme or SOC 2 Privacy criteria.
- Make sure consent withdrawal reaches training pipelines.