Across jurisdictions, governments are racing to establish frameworks that can keep pace with the speed of AI adoption, while organisations from global technology firms to domestic enterprises are grappling with the practical question of what responsible AI deployment actually requires of them. At the heart of this challenge lies data. AI systems are built on it, refined by it, and increasingly used to make decisions that affect individuals in consequential ways. That makes data privacy not a peripheral concern in AI governance, but its very foundation.
The global picture: Converging principles, diverging approaches
Internationally, a clear set of principles is crystallising across major frameworks, like transparency, accountability, fairness, human oversight, and risk-proportionality.
The European Union has taken the most structured approach through the EU AI Act, which came into force in August 2024. It classifies AI systems according to the level of risk they pose: unacceptable, high, limited, or minimal, and imposes corresponding obligations. High-risk systems, such as those used in recruitment, credit scoring, or law enforcement, must meet stringent requirements around bias testing, explainability, human-in-the-loop mechanisms, and technical documentation.
The EU AI Act operates alongside the GDPR, creating a layered compliance landscape where data protection obligations and AI-specific duties intersect and must be navigated together.
The United Kingdom has adopted a more principles-based, sector-led model, relying on existing regulators the Information Commissioners Office, the Financial Conduct Authority and the Competition and Markets Authority to apply AI guidance within their respective domains, rather than introducing a standalone AI statute. The approach prioritises flexibility and innovation, while the ICO’s guidance on AI and data protection continues to evolve.
The United States has pursued a similarly pro-innovation posture, anchored by the National Institute of Standards and Technology AI Risk Management Framework and a series of executive orders, including the 2023 Executive Order on Safe, Secure, and Trustworthy AI. Sector-specific regulation is expected to develop gradually, without a comprehensive federal AI law on the immediate horizon.
China has moved swiftly on generative AI specifically, implementing the Interim Measures for the Management of Generative Artificial Intelligence Services in 2023, with a focus on algorithmic transparency, content labelling, and data sovereignty.
What unites these varied approaches is the recognition that AI governance cannot be separated from data governance. Where personal data is processed to train models, generate outputs, or inform automated decisions, the obligations of data protection law apply in full and in most major jurisdictions, those obligations are becoming more demanding, not less.
India’s emerging AI framework
With over 1,500 AI-driven startups, a rapidly expanding digital economy, and ambitions to lead AI innovation across the Global South, the country has an enormous stake in getting AI governance right.
For organisations deploying AI systems, the Digital Personal Data Protection Act has immediate and material implications. Training AI models typically requires large datasets that may include personal data. Under the Act, this processing requires either valid consent or a defined legitimate use. Unlike the GDPR, the DPDPA does not recognise contractual necessity or legitimate interests as alternative processing grounds, making the consent architecture considerably more demanding in practice. Purpose limitation, data minimisation, and storage restrictions apply in full, as does the obligation to implement reasonable security safeguards and notify the Data Protection Board in the event of a breach.
Entities designated as Significant Data Fiduciaries (SDFs), determined by the volume and sensitivity of data processed and the associated risk, face additional obligations: appointing a Data Protection Officer (DPO) resident in India, conducting annual Data Protection Impact Assessments (DPIAs), engaging an independent auditor, and meeting algorithmic transparency requirements. These provisions signal a clear direction for organisations processing significant volumes of personal data in the context of AI; they will face heightened scrutiny and accountability obligations as the DPDPA is progressively enforced through to its full implementation deadline of May 2027.
The India AI Governance Guidelines, released by the Ministry of Electronics and Information Technology (MeitY) in November 2025 under the IndiaAI Mission, sit alongside the DPDPA as a parallel, and currently non-binding, framework. Anchored in seven guiding sutras, trust, human-centricity, responsible innovation, fairness and equity, accountability, understandability by design, and safety, resilience and sustainability, the guidelines articulate a comprehensive governance philosophy that prioritises voluntary compliance, self-certification, and industry-led accountability, with the explicit possibility of mandatory obligations as the ecosystem matures.
The guidelines introduce an AI Governance Group for high-level coordination, a Technology and Policy Expert Committee, and an AI Safety Institute to conduct model testing and engage with international safety networks. They also call for an India-specific risk assessment framework that reflects the country’s contextual realities bias in language models, vulnerability of specific communities, deepfake-related harms, and the particular risks associated with AI applications in sensitive sectors such as healthcare, finance, and education.
Crucially, the guidelines acknowledge that existing legislation including the DPDPA, the Information Technology Act, consumer protection statutes, and sector-specific regulation from bodies such as the Reserve Bank of India and Securities and Exchange Board of India can address many AI-related risks in the near term. This techno-legal philosophy, which uses existing law as the primary instrument of governance while developing new mechanisms in parallel, positions India closer to the UK and US models than the EU’s comprehensive regulatory approach.
What this means for organisations operating in India
For organisations currently developing or deploying AI in India, whether domestic enterprises, multinational technology firms, or service providers, the regulatory landscape demands structured, proactive engagement. The DPDPA is not a future obligation, its core provisions are in force, and enforcement timelines are running.
Organisations should be assessing how their AI systems interact with personal data across the full lifecycle from training data acquisition to model deployment, to the automated decisions that AI systems generate. Where personal data is involved at any stage, DPDPA obligations apply. This includes understanding the lawful basis for processing, reviewing consent mechanisms, mapping data flows across vendors and processors, and ensuring that data protection is embedded into the design of AI systems from the outset.
The AI Governance Guidelines signal that India expects enterprises to demonstrate accountability through documentation, transparency, and human oversight expectations that align closely with international standards and that will only become more formalised over time.
Organisations processing personal data in AI contexts which, in practice, covers a wide range of commercial activities, require the cross-functional oversight that a DPO provides such as translating legal obligations into operational controls, leading data protection impact assessments, coordinating with regulators, and ensuring that privacy principles are embedded into the design of AI systems.
As the India AI Governance Guidelines note, compliance cannot be siloed. AI governance, data protection, and risk management are converging disciplines, and organisations that treat them separately will find themselves managing fragmented, inconsistent frameworks that create both operational inefficiency and regulatory exposure.
At HewardMills, we work with organisations across jurisdictions to navigate precisely this complexity. We support clients in understanding how global frameworks, the EU AI Act, the GDPR and the UK regulatory landscape apply to their AI operations, and how emerging regimes such as India’s DPDPA interact with and add to those obligations.
As India’s data protection and AI governance landscape continues to develop, organisations that act now, investing in sound data governance, robust privacy controls, and expert DPO support will be better positioned to innovate responsibly, maintain regulatory compliance, and build the stakeholder trust that sustainable AI adoption requires.
To learn more about how HewardMills can support your organisation’s AI governance and data protection obligations in India and globally, contact our team.
