The latest CISO Pulse Check Report by Sprinto presents a concerning reality for organisations in India embracing AI: over 30% of organisations that have used AI report having faced a major AI-related security incident in the past year, despite increasing awareness of AI risks and regulatory obligations.
The report highlights recurring issues such as shadow AI, data leakage through public AI tools, unauthorised access and weak policy enforcement. More importantly, it reveals a governance gap – organisations understand the risks but struggle to operationalise effective controls.
For Data Protection Officers (DPOs), this should not be viewed as merely a cybersecurity problem. It is increasingly becoming a personal data governance challenge with direct implications under India’s Digital Personal Data Protection (DPDP) Act, 2023.
AI tools do not transfer DPDP accountability
One of the most alarming findings in the report is that only 21% of organisations have implemented controls to prevent sensitive data from being uploaded into public AI tools. From a DPDP perspective, whenever employees upload customer information, employee records, financial data, health information, or other personal data into an AI platform, the organisation remains accountable as the Data Fiduciary. The fact that the processing occurs through an AI tool does not reduce or transfer that responsibility. Engaging with DPOs to expand the view of data protection governance to include every AI system that processes personal data is therefore essential.
Visibility is the foundation of AI governance
Many organisations have invested in AI policies, yet the report found that 39% of organisations do not consistently enforce those policies. For DPOs, the starting point is visibility. Without visibility into AI usage, compliance with purpose limitation, accountability, and security obligations becomes difficult to demonstrate.
Organisations should implement clear policies defining:
- which AI tools are approved
- what data may be entered into AI systems
- when anonymisation or masking is required
- escalation procedures for new AI use cases
Moving beyond policies to operational governance
A key finding from the report is that governance maturity remains low across many organisations. While policies exist, monitoring and enforcement often remain manual and inconsistent. Only 22% of organisations reported largely automated AI risk monitoring.
Under the DPDP framework, accountability cannot be demonstrated through policy documents alone. Having a DPO should support the establishment of:
- AI governance committees
- AI risk registers
- Periodic AI audits
- Privacy-by-design reviews for AI deployments
- Continuous monitoring of AI-related risks
- Board-level reporting on AI governance
Preparing for AI-related data breaches
The report lists incidents such as unauthorised access and data leakage. Many of these events could potentially involve unauthorised disclosure or compromise of personal data. DPOs should ensure AI-related incidents are incorporated into the organisation’s breach management framework by incorporating:
- AI-specific incident response playbooks
- escalation criteria for privacy teams
- breach assessment procedures
- coordination between legal, privacy, security, and compliance functions
Organisations that do not identify AI-related personal data incidents early may face both regulatory and reputational consequences.
From AI awareness to AI accountability
What is clear is that AI adoption is moving faster than governance. Organisations are not suffering from a lack of awareness; they are struggling with execution. For organisations, DPO oversight is expanding beyond privacy compliance into broader AI governance. Those organisations that build AI governance, privacy controls, and operational oversight together will be far better positioned to meet regulatory expectations while continuing to innovate. Those that rely solely on policies and awareness programmes may face AI-related incidents before their governance frameworks are ready.
The DPO’s role in AI governance
Under the DPDP Act, 2023, AI should be treated as a new mode of personal data processing—not a separate compliance domain. As an outsourced DPO, HewardMills proactively governs AI usage, monitors data flows, strengthensvendor oversight, and prepares for AI-related breaches, ensuring clients are best positioned to protect both individuals’ rights and organisational trust in the AI era.
