Beyond Compliance: The Next Frontier Of DPDP Enforcement

When Software Learns to Control the Physical World

Technology no longer merely stores information; it increasingly controls the physical world. The law, however, still regulates it as if it were confined to a database.India’s recent controversy surrounding the BAT-BMS mobile application brought India's evolving relationship with technology into sharp focus. Reports suggested that the application could remotely connect to the Battery Management Systems (BMS) of certain e-rickshaws and disable them through a mobile interface, raising serious concerns about public safety, cybersecurity, and the misuse of connected technologies. The Ministry of Electronics and Information Technology (MeitY) reportedly directed app stores to remove such applications, recognizing that software capable of remotely controlling physical infrastructure presents risks extending far beyond conventional cybercrime.

While the incident primarily attracted attention as a public safety concern, it also exposed a far more significant legal reality. India has entered an era where software does not just process information; it influences decisions, controls infrastructure, manages transportation, assists in medical diagnosis, approves financial transactions, recruits employees, and increasingly performs functions once reserved exclusively for human judgment. The legal challenges arising from these technologies are no longer hypothetical; they are unfolding in real time.

The Silent Revolution Behind Every AI System

Artificial Intelligence (AI), the Internet of Things (IoT), and connected devices are transforming nearly every sector of the economy. Businesses today rely on AI-powered recruitment platforms to shortlist candidates, predictive algorithms to approve loans, cloud-based systems to store customer information, and intelligent devices capable of monitoring everything from employee productivity to vehicle performance. Every one of these technologies is fuelled by data and often personal data.

The Digital Personal Data Protection Act, 2023 ("DPDP Act") was enacted to regulate the processing of digital personal data and to recognize the rights of individuals in an increasingly digital society. Since its enactment, the conversation has largely revolved around compliance. Organizations have focused on updating privacy policies, redesigning consent mechanisms, mapping data flows, appointing grievance officers, and strengthening cybersecurity measures. Compliance workshops have become commonplace, and businesses are gradually adapting to a new regulatory landscape.

Yet, beneath these compliance discussions lies a question that has received surprisingly little attention.

Beyond Compliance: The Question No One Is Asking.

 When India's first major privacy disputes arise, who will actually decide them?

The instinctive answer is the Data Protection Board of India (DPB). After all, the DPDP Act establishes the Board as the statutory authority empowered to inquire into personal data breaches, investigate non-compliance, and impose financial penalties. On paper, the enforcement mechanism appears straightforward.

Privacy Breach.Complaint.Investigation.Penalty.

However, this simplistic understanding overlooks the reality of how digital businesses operate today.Modern technology functions through interconnected contractual ecosystems. A single AI-enabled application may involve an enterprise customer, a software developer, a cloud service provider, multiple third-party vendors, data processors, analytics platforms, cybersecurity providers, and overseas infrastructure partners. Personal data may pass through each of these entities before an AI system ultimately generates an output.

When something goes wrong, responsibility becomes remarkably difficult to identify.

Consider a bank deploying an AI-powered customer support platform developed by a third-party technology company. Customer conversations are processed by a large language model hosted on foreign cloud infrastructure. Months later, it is discovered that customer interactions have been retained beyond the disclosed purpose or have contributed to improving the vendor's AI model.

Who is responsible?Is it the bank that collected the customer's personal data? Or the AI developer whose model learned from that information? Or the cloud provider hosting the infrastructure? Or the outsourced data processor?Or all of them together?

The DPDP Act undoubtedly provides the regulatory framework for determining whether personal data has been processed lawfully. Yet, the commercial consequences of such an incident extend well beyond regulatory compliance. The customer may approach the Data Protection Board seeking enforcement of statutory rights.The bank may initiate arbitration against the technology vendor alleging breach of contractual data protection obligations.The vendor may invoke limitation of liability clauses contained within the technology agreement.Insurance providers may dispute coverage under cyber liability policies.Shareholders may question whether adequate governance mechanisms were implemented before deploying the AI system.

What appears to be a single privacy incident suddenly evolves into multiple legal proceedings before different forums, each applying different legal principles and pursuing different objectives.This is perhaps the greatest misconception surrounding India's privacy regime. The DPDP Act is often viewed solely as a regulatory statute. In reality, it is likely to become the foundation of an entirely new category of commercial disputes.

One Privacy Breach, Five Different Lawsuits.

The first generation of privacy litigation in India will not revolve around whether an organization possesses compliant privacy policies. It will concern contractual risk allocation, AI governance, cybersecurity obligations, vendor accountability, indemnity claims, and the legal consequences of automated decision-making. The future of privacy law therefore lies not in one forum but in many.Artificial intelligence makes this transition even more profound.

Traditional data protection law evolved during an era when personal information was collected, stored, shared, and eventually deleted. Legal concepts such as consent, retention, correction, and erasure were developed on the assumption that personal data exists as something tangible, a record stored within a database that can be located, modified, or permanently removed.AI fundamentally disrupts this assumption.

Modern machine-learning systems do not merely store information. They learn from it.When a large language model, recommendation engine, fraud detection algorithm, or predictive analytics platform processes personal data, that information may contribute to training datasets, statistical relationships, probability distributions, vector embeddings, and model parameters. The original data may eventually be deleted, but the knowledge derived from it may continue to influence the behaviour of the system.

This creates one of the most fascinating legal questions confronting privacy law.

Suppose a customer exercises the right to withdraw consent and requests erasure of personal data under the DPDP framework after that data has already been used to improve an AI model.What exactly must be erased?

Deleting the original dataset may not remove its influence from the trained model. Retraining sophisticated AI systems each time an individual withdraws consent may be technically impractical, commercially prohibitive, or even impossible depending upon the architecture of the model. Emerging concepts such as "machine unlearning" seek to address this challenge, but they remain technologically complex and legally untested.The law assumes data can be forgotten.

Artificial intelligence increasingly demonstrates that information, once learned, may not be forgotten so easily. It is this tension between legal rights and technological reality that will define India's next generation of privacy disputes.And these disputes are unlikely to remain confined within the walls of the Data Protection Board.

 From HR to Healthcare: Where the Battles Will Begin.

The increasing integration of AI into commercial decision-making means that India's earliest privacy disputes are unlikely to emerge from extraordinary cyberattacks or sensational data leaks. Instead, they will arise from ordinary business operations where personal data has quietly become the engine that powers commercial innovation. Every AI application is built upon data, and every dataset carries with it questions of ownership, consent, purpose, accountability and risk. Consequently, the first wave of litigation under the DPDP Act is likely to originate from industries that rely most heavily on data-driven technologies.

Perhaps the earliest disputes will emerge in the workplace.Employers today monitor attendance through facial recognition systems, analyse productivity through behavioural analytics, deploy AI-assisted recruitment software, and increasingly rely upon automated performance evaluation tools. Human resource departments are rapidly becoming technology departments, using algorithms to shortlist candidates, identify employee attrition risks, and evaluate performance patterns that would once have required extensive human intervention.

While these technologies undoubtedly improve efficiency, they also create complex legal questions. Can an employer rely solely on an employment contract to justify continuous monitoring of an employee? Does an employee, who is inherently in an unequal bargaining position, truly exercise free consent when personal data is processed through AI-powered monitoring systems? Can information collected for attendance management later be used to train predictive workforce models? At what point does legitimate supervision transform into disproportionate surveillance?

The answers are far from clear, and these questions are likely to feature prominently before regulators and courts in the years to come.

The financial sector presents an equally compelling picture.Banks and fintech companies increasingly rely on artificial intelligence to evaluate loan applications, detect fraud, verify customer identities, and analyse behavioural spending patterns. Creditworthiness is no longer assessed merely on the basis of income or repayment history; it is increasingly influenced by digital footprints, transaction behaviour, location data, device identifiers and predictive analytics.

For customers, however, these decisions often appear opaque. A loan may be rejected without any meaningful explanation, a transaction flagged as suspicious based upon behavioral modelling, or a credit limit reduced following algorithmic assessment. When personal data forms the foundation of these automated decisions, questions inevitably arise regarding transparency, purpose limitation and accountability.

Healthcare presents another sector where technology and privacy are becoming inseparable.Hospitals increasingly utilize AI-assisted diagnostic systems, predictive health analytics, telemedicine platforms and cloud-based medical record management. Wearable devices continuously collect biometric information capable of revealing not merely an individual's present medical condition but also future health risks.

If such information is subsequently analyzed to develop commercial AI products or shared with technology vendors beyond the scope originally disclosed to patients, disputes are almost inevitable. Unlike conventional medical negligence claims, these disputes will centre upon lawful processing, secondary use of personal data and the contractual obligations governing technology providers.

Educational institutions and ed-tech platforms are similarly positioned to become early participants in India's evolving privacy law. AI-driven learning platforms now monitor attendance, analyse academic performance, personalize educational content and generate behavioral insights regarding students. Where children are involved, the legal expectations become significantly more stringent, making educational technology one of the most closely scrutinized sectors under the DPDP framework.Even ordinary online shopping platforms may become fertile ground for future litigation.E-commerce platforms no longer simply process purchases; they observe browsing habits, analyse abandoned shopping carts, predict purchasing preferences and personalize recommendations using increasingly sophisticated algorithms. The commercial value of this behavioral information is immense, but so too are the legal risks associated with processing personal data beyond the purposes reasonably expected by consumers.

Collectively, these examples demonstrate an important shift. India's first privacy disputes are unlikely to concern isolated incidents of unauthorized disclosure. Instead, they will involve lawful businesses using AI-powered systems in ways that challenge traditional concepts of consent, transparency and purpose limitation.Yet, even more intriguing is the question of where these disputes will ultimately be resolved.Most discussions surrounding the DPDP Act assume that privacy disputes begin and end before the Data Protection Board. While the Board undoubtedly occupies a central position within the statutory framework, commercial reality suggests otherwise.

Privacy Is No Longer Just a Regulatory Issue.

Technology transactions are fundamentally contractual relationships. Businesses deploying AI rarely develop the entire technology stack independently. Instead, they rely on multiple vendors for software, cloud infrastructure, cybersecurity, analytics and AI capabilities. Each of these relationships is governed by commercial agreements allocating responsibilities, prescribing security standards, limiting liability and providing dispute resolution mechanisms. Almost invariably, these agreements contain arbitration clauses.

A data privacy incident can therefore trigger far more than regulatory scrutiny. While the Data Protection Board may examine whether obligations under the Digital Personal Data Protection Act, 2023 have been violated, parallel contractual disputes may arise between technology vendors, cloud service providers, insurers, customers and other commercial stakeholders. Claims for indemnification, breach of contractual obligations, allocation of liability and insurance coverage are all likely to be determined through arbitration or other civil proceedings.

As a result, a single data breach may give rise to multiple proceedings before different forums, each applying distinct legal standards. The Data Protection Board may determine statutory compliance, arbitral tribunals may allocate contractual liability, commercial courts may address interim measures or enforcement issues, and consumer forums may adjudicate compensation claims.

Privacy disputes are therefore no longer confined to questions of regulatory compliance. They have evolved into multifaceted commercial disputes where statutory obligations and contractual commitments operate simultaneously. As AI adoption accelerates and technology ecosystems become increasingly interconnected, the intersection between data protection law and commercial arbitration is likely to become one of the defining legal challenges of India's digital economy.

The Arbitration Clause No One Reads, Until a Data Breach Happens.

Historically, arbitration has been associated with infrastructure projects, shareholder disputes and international commercial transactions. The digital economy, however, is transforming arbitration into one of the principal mechanisms for resolving technology disputes.AI procurement agreements, software licences, cloud computing contracts, SaaS subscriptions and data processing agreements almost invariably contain arbitration clauses. Consequently, many of the most significant commercial consequences of a privacy incident will not be determined by the Data Protection Board alone. Instead, they will be decided by arbitral tribunals interpreting contractual obligations negotiated long before any breach occurred.

Questions that the DPDP Act does not expressly answer such as who bears regulatory penalties, whether an AI vendor must indemnify its customer, whether limitation of liability clauses survive a significant privacy breach, or whether reputational losses are recoverable or not. These are ultimately matters of contract. Arbitration is therefore not an alternative to privacy regulation; it is increasingly becoming its commercial counterpart.

 The Next Challenge: AI and the Limits of the DPDP Act.

Artificial intelligence exposes questions that existing privacy legislation only partially addresses. While the DPDP Act is founded on principles such as consent, purpose limitation, storage limitation and erasure, these concepts assume that personal data remains identifiable and capable of deletion.

AI systems operate differently. Once personal data contributes to training a machine-learning model, it becomes increasingly difficult to determine whether the model has truly "forgotten" that information, even after the original data has been erased.

This raises questions that the law has yet to answer. Does deleting the source data satisfy legal obligations if the model has already learned from it? Who bears responsibility where multiple technology providers jointly develop, deploy and maintain an AI system? Should contractual indemnities extend to future regulatory penalties arising from AI-enabled processing?

The answers will emerge gradually through decisions of regulators, courts and arbitral tribunals interpreting legislation in light of evolving technology. Those early decisions will shape not only the practical application of the DPDP Act but also the future contours of AI governance in India.

 Conclusion

India's digital economy is expanding at an unprecedented pace, with AI becoming integral to commerce, governance and public services. As technology ecosystems grow more interconnected, privacy disputes will increasingly involve not only statutory compliance but also contractual obligations, cybersecurity risks and commercial accountability.

The more important question is whether our legal institutions are prepared to resolve disputes where artificial intelligence, contractual obligations, cybersecurity, commercial relationships and statutory rights intersect. The answer cannot lie with any one institution acting in isolation. The Data Protection Board will enforce statutory compliance, commercial courts will address matters requiring judicial intervention, arbitral tribunals will increasingly determine contractual liability between technology providers and enterprise customers, and sectoral regulators will continue to oversee industry-specific concerns. Together, these institutions will shape India's emerging jurisprudence on privacy and artificial intelligence.

The future of data protection in India will not be written by regulators alone. It will be shaped through the interaction of legislation, technology, contracts and dispute resolution. The first generation of privacy disputes is not merely about data; it is about defining accountability in an economy where algorithms make decisions, software controls physical assets, and personal information has become one of the most valuable commercial resources of the digital age.

As India embraces AI-led innovation, the success of the DPDP Act will not be measured by the number of penalties imposed or compliance notices issued, but by whether it provides legal certainty, allocates responsibility fairly and resolves complex technology disputes without stifling innovation. That is the real road ahead for India's privacy law and perhaps the most important legal conversation that has only just begun.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.