The Legal Lens By Araina

Navigating Generative AI Under India’s DPDP Act, 2023

Artificial Intelligence is no longer a futuristic concept, it is already a part of our daily lives. Whether it is ChatGPT helping students draft assignments, AI tools generating images, or businesses automating customer interactions, generative AI has become impossible to ignore. As someone studying law and observing these developments closely, I often find myself wondering whether our legal framework is prepared for the privacy challenges that accompany this technological revolution.

The Digital Personal Data Protection Act is a significant milestone for India. It demonstrated the government’s recognition that personal data deserves protection in an increasingly digital world. However, the rise of generative AI raises questions that the Act does not fully answer.

Generative AI thrives on data. The more information it processes, the better it performs. But where does this data come from? Much of it may be collected from publicly available sources across the internet, often without individuals being aware that their information could contribute to training AI models. This creates an interesting tension between innovation and privacy.

In my view, one of the biggest challenges is consent. The DPDP Act places considerable emphasis on obtaining consent before processing personal data. Yet, in the context of AI training, obtaining consent from every individual whose data may have been included appears nearly impossible. This raises an important question, can traditional data protection principles effectively govern technologies that rely on massive datasets?

Another concern relates to the rights granted to individuals under the Act. If a person seeks to erase their data, what happens when that information has already been absorbed into an AI model? The law recognises the right, but the technology may not always make compliance straightforward.

While the DPDP Act provides a strong foundation for privacy protection, I believe that generative AI presents challenges that require more specific regulatory guidance. As AI continues to evolve, lawmakers, regulators, and courts will likely have to address issues that were unimaginable just a few years ago.

Ultimately, the debate is not about choosing between innovation and privacy. Both are essential. The real challenge lies in ensuring that technological progress remains accountable and respects individual rights. India’s DPDP Act is an important first step, but the conversation surrounding AI and data protection is only just beginning.