{
    "data": [
        {
            "slug": "india-dpdp-significant-data-fiduciary-duties",
            "url": "https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties",
            "duty": "Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits",
            "category": "Impact assessment",
            "instrument": "India DPDP Act",
            "jurisdiction": "India",
            "actors": "Provider / developer, Deployer / user organisation",
            "binding": "Legal requirement",
            "reference": "Section 10",
            "applies_from": null,
            "summary": "Entities notified as Significant Data Fiduciaries, based on factors such as volume and sensitivity of data and risk to individuals, must appoint a Data Protection Officer based in India, an independent data auditor, and periodically undertake data protection impact assessments and audits.\n",
            "action": "Assess whether your AI data processing could trigger SDF designation and prepare DPIA tooling.",
            "evidence": "Data protection impact assessment",
            "iso": "Clause 6.1.4 AI system impact assessment",
            "nist": "",
            "verification": "Pending review · source-linked",
            "controls": "Privacy and data-protection controls for AI; AI impact and fundamental-rights impact assessment"
        },
        {
            "slug": "india-dpdp-security-and-breach-notification",
            "url": "https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification",
            "duty": "Implement reasonable security safeguards and notify breaches",
            "category": "Incident reporting and handling",
            "instrument": "India DPDP Act",
            "jurisdiction": "India",
            "actors": "Provider / developer, Deployer / user organisation",
            "binding": "Legal requirement",
            "reference": "Section 8(5) and 8(6); DPDP Rules on breach intimation",
            "applies_from": null,
            "summary": "Data Fiduciaries must protect personal data with reasonable security safeguards and, on a personal data breach, inform the Data Protection Board and each affected individual in the form and manner prescribed by the Rules.\n",
            "action": "Extend incident response to cover AI training data and model outputs that reveal personal data.",
            "evidence": "Breach notification procedure",
            "iso": "",
            "nist": "",
            "verification": "Pending review · source-linked",
            "controls": "AI incident management and regulatory reporting; Privacy and data-protection controls for AI; Accuracy, robustness, fairness and security testing"
        },
        {
            "slug": "india-dpdp-consent-and-notice",
            "url": "https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice",
            "duty": "Process personal data only with valid consent or a legitimate use, after notice",
            "category": "Privacy and personal-data protection",
            "instrument": "India DPDP Act",
            "jurisdiction": "India",
            "actors": "Provider / developer, Deployer / user organisation",
            "binding": "Legal requirement",
            "reference": "Sections 4 to 7",
            "applies_from": null,
            "summary": "Personal data may be processed only for a lawful purpose with the individual's free, specific, informed and unambiguous consent, or for certain legitimate uses listed in the Act. A notice must describe the data, purpose, and how to exercise rights and complain.\n",
            "action": "Inventory training and inference data sources and document the consent or legitimate use for each.",
            "evidence": "Consent records and notices",
            "iso": "Annex A controls on data for AI systems",
            "nist": "",
            "verification": "Pending review · source-linked",
            "controls": "Privacy and data-protection controls for AI; Data governance and dataset documentation"
        },
        {
            "slug": "nepal-privacy-act-consent-and-purpose",
            "url": "https://aipolicytracker.org/obligations/nepal-privacy-act-consent-and-purpose",
            "duty": "Collect and use personal information only with consent and for the stated purpose",
            "category": "Privacy and personal-data protection",
            "instrument": "Nepal Privacy Act 2075",
            "jurisdiction": "Nepal",
            "actors": "Provider / developer, Deployer / user organisation, Public authority / government body",
            "binding": "Legal requirement",
            "reference": "Chapter on collection and protection of personal information (reviewer to cite sections)",
            "applies_from": null,
            "summary": "Personal information may be collected only by authorised persons for a lawful purpose with the individual's consent, and must not be used or disclosed for other purposes without consent, subject to statutory exceptions. AI systems trained on or processing personal data of people in Nepal must respect these limits.\n",
            "action": "Document consent and purpose for any Nepal personal data used in AI training or inference.",
            "evidence": "Consent and purpose records",
            "iso": "Annex A controls on data for AI systems",
            "nist": "",
            "verification": "Pending review · source-linked",
            "controls": "Privacy and data-protection controls for AI; Training-data provenance and copyright register"
        },
        {
            "slug": "india-ai-guidelines-principles-and-risk-based-governance",
            "url": "https://aipolicytracker.org/obligations/india-ai-guidelines-principles-and-risk-based-governance",
            "duty": "Adopt the guiding principles and risk-based governance (voluntary)",
            "category": "Governance and accountability",
            "instrument": "India AI Governance Guidelines",
            "jurisdiction": "India",
            "actors": "Provider / developer, Deployer / user organisation",
            "binding": "Voluntary",
            "reference": "Guiding principles and recommendations sections",
            "applies_from": null,
            "summary": "The guidelines encourage organisations to embed principles such as fairness, accountability, safety and transparency, to classify and mitigate risks proportionately, and to participate in voluntary frameworks and incident reporting.\n",
            "action": "Map your existing AI governance programme to the guidelines' principles and note the gaps.",
            "evidence": "Principles alignment statement",
            "iso": "",
            "nist": "GOVERN and MAP functions",
            "verification": "Pending review · source-linked",
            "controls": "AI governance policy and accountability structure; AI risk assessment and lifecycle risk register"
        },
        {
            "slug": "nepal-ai-policy-responsible-ai-principles",
            "url": "https://aipolicytracker.org/obligations/nepal-ai-policy-responsible-ai-principles",
            "duty": "Government bodies to promote ethical, responsible and inclusive AI (policy commitment)",
            "category": "Governance and accountability",
            "instrument": "Nepal National AI Policy",
            "jurisdiction": "Nepal",
            "actors": "Public authority / government body",
            "binding": "Voluntary",
            "reference": "Policy objectives and strategies (to be confirmed against the official text)",
            "applies_from": null,
            "summary": "The policy commits the government to ethical, transparent and inclusive AI, data governance and institutional oversight. The specific strategies and any obligations on private actors must be confirmed from the official document; this record intentionally does not state details that could not be verified.\n",
            "action": "Public bodies and vendors should track implementing measures from MoCIT.",
            "evidence": "",
            "iso": "",
            "nist": "",
            "verification": "Pending review · source-linked",
            "controls": "AI governance policy and accountability structure; Public-sector AI use-case register and algorithmic transparency"
        }
    ],
    "meta": {
        "answers": {
            "jurisdictions": [
                "india",
                "nepal"
            ],
            "role": null,
            "use_case": null,
            "sector": null,
            "personal_data": null,
            "domains": [],
            "genai": null
        },
        "total": 6,
        "instruments_screened": [
            {
                "slug": "india-dpdp-act",
                "title": "India DPDP Act",
                "score": 1,
                "why": [
                    "binding instrument"
                ],
                "url": "https://aipolicytracker.org/policies/india-dpdp-act"
            },
            {
                "slug": "nepal-individual-privacy-act",
                "title": "Nepal Privacy Act 2075",
                "score": 1,
                "why": [
                    "binding instrument"
                ],
                "url": "https://aipolicytracker.org/policies/nepal-individual-privacy-act"
            }
        ],
        "downloads": {
            "xlsx": "https://aipolicytracker.org/tools/applicability-check/register.xlsx?jurisdictions%5B0%5D=india&jurisdictions%5B1%5D=nepal",
            "csv": "https://aipolicytracker.org/tools/applicability-check/register.csv?jurisdictions%5B0%5D=india&jurisdictions%5B1%5D=nepal",
            "pdf": "https://aipolicytracker.org/tools/applicability-check/register.pdf?jurisdictions%5B0%5D=india&jurisdictions%5B1%5D=nepal"
        },
        "page_url": "https://aipolicytracker.org/tools/applicability-check?jurisdictions%5B0%5D=india&jurisdictions%5B1%5D=nepal",
        "license": "CC BY 4.0",
        "disclaimer": "An educational screen over recorded scope, not a determination that any duty applies."
    }
}