AI regulation in India

India has no dedicated AI statute. AI is governed through the Digital Personal Data Protection Act 2023 and its 2025 Rules, the Information Technology Act 2000 and intermediary rules, sector regulators, and non-binding policy such as the IndiaAI Mission and the India AI Governance Guidelines released by MeitY in November 2025. The stated direction favours enabling innovation with principle-based governance and enforcement through existing law.

Source-linked
Partially applicable Act / statuteBinding

Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025

The DPDP Act is India's cross-sector personal-data law. It applies to digital personal data processed in India and to processing outside India connected with offering goods or services to people in India. It requires a lawful basis (consent or specified legitimate uses), notice, purpose limitation, data accuracy, security safeguards, breach notification to the Data Protection Board and affected individuals, and grants rights of access, correction, erasure and grievance redress. Significant Data Fiduciaries face extra duties such as impact assessments and audits. The Act does not mention AI specifically, but it governs the personal data used to train and operate AI systems.

Key dates
DateMilestoneStatus
11 August 2023Presidential assentPassed
13 November 2025DPDP Rules 2025 notifiedPassed
12 to 18 months after Rules notification (to be confirmed)Phased commencement of substantive obligationsTbd

Full record: obligations, sources and change history

What is binding today?

The DPDP Act sets consent, notice, security, breach-notification and rights obligations for digital personal data, which covers most AI training and inference data about Indian residents. The IT Act and the 2021 intermediary rules apply to platforms hosting AI-generated or synthetic content. Sector regulators such as the RBI, SEBI and IRDAI regulate automated decisions in lending, markets and insurance under their own rules.

What is guidance?

The India AI Governance Guidelines describe principles, an institutional framework and voluntary commitments; NITI Aayog's Responsible AI papers and MeitY advisories add expectations without creating statutory duties. Treat them as signals of regulatory direction and of what a future law might contain.

Practical steps for teams operating in India

Map personal data flows into your AI systems and establish a lawful basis; prepare breach and rights processes for the DPDP commencement dates; if you run a platform, review synthetic-media duties; and align governance with the 2025 guidelines to be ready for voluntary commitments and sector expectations.

Recorded policy instruments

India Act / statute Partially applicable Binding

India DPDP Act

Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025

The DPDP Act is India's cross-sector personal-data law. It applies to digital personal data processed in India and to processing outside India connected with offering goods or services to people in India. It requires a lawful basis (consent or specified legitimate uses), notice, purpose limitation, data accuracy, security safeguards, breach notification to the Data Protection Board and affected individuals, and grants rights of access, correction, erasure and grievance redress. Significant Data Fiduciaries face extra duties such as impact assessments and audits. The Act does not mention AI specifically, but it governs the personal data used to train and operate AI systems.

Adopted 11 Aug 2023 Source-linked Official source
India Guidance Guidance

India AI Governance Guidelines

India AI Governance Guidelines (MeitY, 2025)

The India AI Governance Guidelines set out a principle-based, pro-innovation approach to governing AI in India. They articulate guiding principles (such as trust, people-first design, fairness, accountability, safety and transparency), propose an institutional framework including an AI governance group and an AI Safety Institute role, favour applying existing laws over a new AI statute, and recommend voluntary commitments, techno-legal measures, risk-based oversight and incident reporting for AI systems.

Adopted 5 Nov 2025 Source-linked Official source
India National strategy Adopted

IndiaAI Mission

A five-year national programme approved by the Union Cabinet with an outlay of about INR 10,372 crore. It funds shared public AI compute (10,000+ GPUs), an innovation centre for indigenous foundation models, a datasets platform, application development for public problems, skilling programmes, startup financing and work on safe and trusted AI. Implementation is handled by the IndiaAI division of Digital India Corporation.

Adopted 7 Mar 2024 Source-linked · checked 11 Sep 2026 Official source
India National strategy Adopted

National Strategy for Artificial Intelligence

National Strategy for Artificial Intelligence (#AIforAll)

A discussion paper that set out India's first national approach to artificial intelligence. It prioritises five sectors (healthcare, agriculture, education, smart cities and infrastructure, and smart mobility) and proposes research institutions, data ecosystems and skilling measures to support adoption. It also flags privacy, fairness and explainability as issues needing attention and recommends institutional structures for responsible AI.

Adopted 1 Jun 2018 Source-linked · checked 11 Sep 2026 Official source

Key obligations

Latest changes

Frequently asked questions

Does India have an AI Act?
No. India relies on the DPDP Act, the IT Act and sector regulation, plus non-binding AI governance guidelines.

Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.