The DPDP Act does not use the words artificial intelligence anywhere in its text. That does not mean it is silent on what your model can do with personal data. For AI and product teams, the relevant obligations were already there; they just were not written with a neural network in mind.
The training data dilemma
Every input that contains personal data needs a basis under Section 4: consent under Section 6, or one of the legitimate uses under Section 7. The often-assumed shortcut, that scraped public web data is automatically free to use, is narrower than it looks. Section 3(c)(ii) excludes from the Act personal data that the individual has voluntarily made public, not personal data that is simply discoverable online. Where voluntarily public ends and merely accessible begins is one of the most actively contested points in current practice, and industry bodies are still seeking clearer carve-outs for AI training.
Purpose limitation and model drift
Consent under Section 6 is tied to a specified purpose. Data collected for customer support, account creation or transaction processing does not automatically carry a licence to fine-tune a model later. That is a new purpose, and a new purpose usually means fresh notice and consent. This is the provision most likely to catch out product teams who quietly repurpose old datasets for new AI features without checking the original consent boundaries.
Algorithmic due diligence
Rule 13(3) requires Significant Data Fiduciaries to exercise due diligence confirming that algorithmic software used in hosting, displaying, modifying or sharing personal data does not pose a risk to Data Principal rights. It is not a model-auditing regime in the style of the EU's AI-specific rules, but it is the clearest hook anywhere in the framework for scrutinising what an algorithm does with personal data, rather than only whether the data was collected lawfully in the first place. Map your datasets, treat repurposing as a new activity, and build output review for models that could infer personal data.