DPDP Rules and AI Chatbots: What Indian Businesses Must Fix Before May 2027

If your business uses a website chatbot, a WhatsApp bot or an AI calling agent in India, it is collecting personal data every day. Names, phone numbers, addresses, appointment details and sometimes health or payment information all pass through these tools. India's Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025 that put it into operation, now set clear rules for how that data must be handled.

The Rules were notified by the Ministry of Electronics and Information Technology in November 2025, with a phased rollout. The provisions setting up the Data Protection Board took effect straight away. The framework for registered Consent Managers comes into force 12 months after notification, in November 2026, which is now only weeks away. The core duties for businesses, including consent notices, security safeguards, breach reporting and the rights of individuals, become enforceable 18 months after notification, on 13 May 2027.

There is one more thing to watch. In January 2026, MeitY reportedly proposed shortening the 18-month window to 12 months for some provisions, mainly for large Significant Data Fiduciaries. Legal commentary as of September 2026 says no amending notification has been issued, so May 2027 remains the official date. Still, the proposal shows the government wants faster compliance, and any business that waits until the last month is taking a risk.

The penalties are serious. Under the Schedule to the Act, failing to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to 250 crore rupees. Failing to notify the Data Protection Board and affected individuals about a breach can attract up to 200 crore rupees. Under the Rules, after an initial intimation without delay, a business must give the Board a detailed report within 72 hours of becoming aware of a breach, unless the Board allows more time.

Why does this matter so much for AI tools in particular? Because chatbots and voice agents are often set up quickly, by different vendors, with data flowing to several places at once. A single conversation can be stored by the chat platform, sent to an AI model provider, logged in a spreadsheet, pushed into a CRM and kept in call recordings. If you cannot draw that map for your own business, you cannot give a clear notice, honour a deletion request or report a breach on time.

Consider a dental or physiotherapy clinic in Delhi that uses an AI receptionist to book appointments. Callers share their name, number and often a description of their symptoms. Under the new framework, the clinic should tell callers, in clear and simple language, what is being collected and why, and how they can withdraw consent. That can be a short spoken notice at the start of the call, with a link to the full notice sent by SMS or WhatsApp. Call recordings and transcripts should be kept only as long as there is a genuine need, then deleted on a schedule.

Now think of a real estate agency in Gurugram or Mumbai running a lead qualification bot on its website and on property portals. The bot asks about budget, location and timeline, and often the buyer's employer or income. Much of that data sits in old spreadsheets long after the lead has gone cold. A sensible approach is to collect only what the sales team actually uses, record when and how consent was given, and automatically clear out old leads who have not engaged for a defined period.

For an e-commerce brand selling across India, or from India to buyers in the UAE, UK or USA, the order support chatbot is usually the biggest data touchpoint. It handles order numbers, addresses and refund details. Here the key steps are clear consent for marketing messages kept separate from order updates, an easy way for customers to ask for their data to be corrected or erased, and access controls so that only the right staff and systems can see full customer records. Brands selling into the UK and the EU should note that those markets have their own data protection laws as well.

It is important to be honest about the limits of this guide. It is a practical overview, not legal advice, and the Rules contain details and exceptions that depend on your sector and size. Children's data, for example, needs verifiable parental consent, and businesses designated as Significant Data Fiduciaries carry extra duties. Commentary on the Rules also differs on some points. For anything beyond the basics, speak to a qualified data protection lawyer and check the official MeitY notifications for any changes.

Technology alone also will not make you compliant. An AI agent can display a consent notice, but someone in your business still needs to own the process, answer grievances and decide how long data is kept. The good news is that most of the work is the same discipline that makes AI systems reliable anyway: knowing where your data goes, collecting less of it, and keeping clean records.

This is where Legacy Services can help. When we build an AI calling agent, chatbot or WhatsApp assistant, we start by mapping every place customer data will travel, from the conversation itself to the AI model, the CRM and any spreadsheets. We then build the consent notice into the flow, so a caller hears a short notice and receives a link to the full version, and a chat user sees it before sharing personal details. Consent records are logged with a timestamp so you can show when and how consent was given.

We also use n8n workflows to handle the routine parts of compliance automatically. A workflow can delete or anonymise call recordings and chat transcripts after a retention period you choose, route correction and erasure requests to the right person with a deadline, and alert your team the moment unusual access or a possible breach is detected, so the 72-hour reporting clock does not catch you off guard. Because we can deploy n8n on infrastructure you control, your business keeps ownership of its data and the automations.

November 2026 and May 2027 will arrive faster than most businesses expect, and fixing data flows after an AI system is live is harder than designing them properly from the start. If you already use AI chatbots or calling agents, or plan to launch one, book a free 30-minute strategy call with Legacy Services at legacyservices.in/contact. We will walk through your current setup, show you where personal data is flowing, and suggest practical next steps for building AI automation that is ready for India's new data protection rules.