This post is an informational overview only and is not legal advice. For guidance specific to your business, consult a qualified legal practitioner familiar with Indian data protection law.
When you add an AI feature to your product, customer data often travels to the AI vendor's servers for processing. Under India's Digital Personal Data Protection Act 2023 (DPDP Act), you remain responsible for what happens to that data, even when a third party processes it on your behalf. The first step to managing that responsibility is knowing where the data goes.
What the DPDP Act Requires of Data Fiduciaries
The DPDP Act classifies your business as a Data Fiduciary if you determine the purpose and means of processing personal data. Regardless of which tools you use to do the processing, the obligations remain with you. These include obtaining valid consent, processing data only for the stated purpose, ensuring the data is accurate, and implementing security safeguards.
When you use a third-party AI tool, that vendor is usually a Data Processor under the Act, and a Data Fiduciary may engage a processor only under a valid contract (section 8(2)), and remains responsible for processing done on its behalf. Keep a signed agreement that binds the processor to handle the data only as you instruct, and keep a record of the due diligence you did before appointing them. The DPDP Rules were notified on 13 November 2025; Rules 3 and 5 to 16 come into force eighteen months after the gazette date, around 13 May 2027.
For a broader checklist of what India's DPDP rules require of apps, see our DPDP Act 2027 compliance checklist for apps, which covers consent flows, data minimisation, and breach response.
The Data Flow Problem With AI Tools
The challenge with AI tools is that the data flows are often implicit. A developer adds a call to an AI API inside a form submission handler. The API call sends the form content - which may include names, email addresses, or business details - to the vendor's servers. The privacy policy and data protection agreement for that vendor may have been reviewed once, at sign-up, and not revisited.
Common AI tools used by Indian SaaS products include the following (vendor terms change, so re-check them):
- OpenAI APIs - used for summarisation, content generation, and chatbots. OpenAI's API data controls page says API data is not used to train models unless you opt in, and that abuse-monitoring logs are kept for up to 30 days by default. Ask OpenAI for its DPA terms; we could not open its DPA page.
- Anthropic Claude APIs - Anthropic's data usage page says it does not train on commercial (API, Team, Enterprise) content unless the customer opts in, with a standard 30-day retention period and zero data retention available to qualified accounts.
- Google Gemini APIs - under Google's Gemini API terms, unpaid-tier content may be used to improve Google's products and can be read by human reviewers, while paid-tier prompts are not used to improve its products.
- AI features in third-party SaaS tools you already use (a helpdesk, notes or CRM assistant) - the data may flow through both the SaaS vendor and an underlying model provider. Ask each vendor, because you may have two processors in the chain, not one.
The last category is the one teams most often miss. When an AI feature is embedded in a tool you already use, you may not realise that customer data you enter into that tool is being sent to a large language model provider.
How to Map the Flows
A data flow map for AI tools does not need to be complex. Start with this template:
- What personal data enters this AI feature? (e.g. customer name, support ticket content, invoice data)
- Which vendor receives the data? (name and product)
- Where is the vendor's data centre? (required for cross-border transfer assessment)
- Does the vendor have a signed DPA with you?
- What does the vendor's DPA say about data retention and sub-processors?
- Is the processing disclosed in your privacy policy?
- Did you obtain consent that covers this processing purpose?
Run this for each AI tool your product uses, including tools used internally by your team that touch customer data. The shadow AI risk - where staff use personal AI accounts to process work data - is often larger than the tools you officially procured.
Cross-Border Data Transfers
Most major AI vendors process data in the United States or Europe. Section 16(1) of the Act lets the Central Government restrict, by notification, transfers of personal data to countries it names, and Rule 15 makes transfers subject to any requirements the government specifies for making data available to a foreign State or to entities under its control. Ask your adviser which notifications currently apply to the countries your vendors use.
The practical approach is to document each transfer, have a DPA in place, and keep watching for any government notification on cross-border requirements. A legal advisor familiar with the DPDP Rules can confirm whether this approach is appropriate for your specific context.
What to Include in Your Privacy Policy
Your privacy policy must disclose what personal data you collect, the purpose for which it is processed, and with whom it is shared. If you send customer data to an AI vendor for processing, that vendor should be disclosed as a data processor or service provider. The disclosure should be specific enough that a user reading your policy understands that their data is processed by AI tools.
Generic language such as "we may share your data with third-party service providers" is unlikely to be sufficient under the DPDP Act. Name the category of processing (AI-powered features) even if you do not name every vendor.
The Minimal Action List
- List every AI tool your product and your team use that touches personal data.
- For each tool, confirm a signed DPA exists and review the sub-processor list.
- Update your privacy policy to disclose AI-assisted processing.
- Check whether your consent language covers the purpose of each AI feature.
- Set a reminder to re-review when the government issues any cross-border transfer requirements.
If you run the Zovintra app health check, it surfaces third-party scripts and API calls from your app's front end. That is one layer of the picture. The back-end API calls to AI vendors are typically not visible from the front end and need to be mapped by reviewing your codebase. If you would like a technical review of what your app is sending and to whom, get in touch.
Making This Sustainable: Review Cycles
A data flow map done once becomes outdated the moment a developer adds a new AI call or a vendor updates their sub-processor list. Build a lightweight review into your quarterly cycle: check whether any new AI tools were added, whether any existing tools changed their DPA or sub-processor list, and whether your privacy policy still accurately reflects the processing you are doing.
This does not require a legal review every quarter. It requires one person who owns the list and checks it. Most teams find that the list is shorter than they expected - the work is in building the habit of updating it rather than in the review itself. The DPDP Act expects Data Fiduciaries to implement reasonable security safeguards and maintain accuracy; a documented and maintained data flow map is evidence that you take those obligations seriously.
Common questions
Am I responsible under DPDP when an AI vendor processes my customers' data?
Yes. As a Data Fiduciary you remain responsible for processing done on your behalf. You may engage a processor only under a valid contract (section 8(2)), so keep a signed agreement and a record of your due diligence. This is not legal advice.
How do I map where AI tools send personal data?
For each AI tool, note what personal data enters it, which vendor receives it, where the vendor's data centre is, whether a signed DPA exists, what it says on retention and sub-processors, and whether your privacy policy and consent cover it.
When should I get a technical review of my AI data flows?
Front-end tools only show part of the picture, because back-end API calls to AI vendors are usually not visible from the browser and must be mapped by reviewing your codebase. Zovintra can review what your app sends and to whom.
Sources
- Data controls in the OpenAI platform
- Data usage
- Gemini API Additional Terms of Service
- DPDP Rules, 2025 (Gazette of India)
- Digital Personal Data Protection Act, 2023
Building something similar?
Talk to our engineering team about your architecture, roadmap, and delivery timeline.
Request a Technical Review →
We design, engineer, and deploy high-performance web platforms, mobile applications, and intelligent cloud systems.
