AI Training Data: Navigating DPDPA's Deemed Consent Against Global Standards

The rapid advancements in artificial intelligence (AI) have brought into sharp focus the complex challenge of legally and ethically sourcing and processing personal data for model training. For Indian businesses operating in this space, understanding the nuances of the Digital Personal Data Protection Act, 2023 (DPDPA) and comparing them with established global frameworks like the EU’s General Data Protection Regulation (GDPR) and the UK Information Commissioner’s Office (ICO) guidance is critical. As of October 2026, with the DPDPA fully operational and recent clarifications on consent and audit provisions, the specifics of AI training data remain a key area for interpretation.

India’s DPDPA: Deemed Consent and its Ambiguities for AI

The DPDPA anchors personal data processing on the twin pillars of consent and deemed consent. Section 6 mandates explicit, free, specific, informed, and unambiguous consent from the Data Principal for processing their personal data. However, for many AI training scenarios, especially those involving large, diverse datasets, obtaining such granular consent can be impractical or impossible. This is where Section 7, outlining circumstances for “deemed consent,” becomes highly relevant.

Section 7(a) allows for deemed consent when a Data Principal “voluntarily provides her personal data to the Data Fiduciary for a purpose, and it is necessary for the Data Fiduciary to process such personal data for that purpose.” Section 7(d) further permits processing for “public interest,” provided such purposes are notified by the Central Government. The current challenge for AI training data lies in whether the broad activity of training AI models, particularly for novel applications, can be neatly categorised under these deemed consent provisions without specific, granular rules. While recent governmental orders have sought to clarify aspects of consent, the application of deemed consent to the evolving landscape of AI training, especially for uses not explicitly foreseen by the data principal, remains an area requiring further interpretation by the Data Protection Board of India (DPBI). The DPDPA, in its current form, does not offer an explicit, flexible basis akin to “legitimate interests” for processing personal data for AI training without direct consent, which could be seen as a stricter stance compared to some global counterparts.

GDPR’s Legitimate Interests (Article 6(1)(f))

In the European Union, the GDPR offers a more flexible, yet rigorously balanced, legal basis for processing personal data for AI training: legitimate interests, as articulated in Article 6(1)(f). This provision allows processing if it is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.”

This framework requires a three-part test: identifying a legitimate interest, demonstrating the necessity of processing for that interest, and conducting a balancing test to ensure the data subject’s rights and freedoms are not unduly prejudiced. For AI training, this often involves demonstrating the societal or commercial benefits of the AI, the necessity of using personal data (including efforts towards anonymisation or pseudonymisation), and implementing robust safeguards to protect data principals. Controllers are also required to conduct Data Protection Impact Assessments (DPIAs) under Article 35 for high-risk processing, including novel AI systems, and maintain transparency (Articles 13 and 14) about their AI training practices. This approach provides a pathway for innovation while demanding accountability and robust risk mitigation.

UK ICO Guidance: Practicalities for AI Development

Following Brexit, the UK’s data protection regime largely mirrors the GDPR (UK GDPR), but the Information Commissioner’s Office (ICO) has issued specific and comprehensive guidance on AI and data protection. The ICO’s framework elaborates on how legitimate interests can be applied to AI training, emphasizing fairness, transparency, and accountability. The ICO stresses that organisations must clearly define their legitimate interest, assess the necessity of using personal data, and thoroughly balance this against data subjects’ rights.

Notably, the ICO guidance highlights the importance of data minimisation, urging developers to use the least amount of personal data necessary and to explore anonymisation or pseudonymisation techniques wherever possible. It also provides practical advice on ensuring fairness in AI systems, mitigating biases, and upholding data principal rights, including the right to object to processing. The UK ICO’s detailed guidance offers a practical roadmap for businesses, translating the legal principles of legitimate interests into actionable steps for AI development, providing a level of clarity that is still evolving under the DPDPA.

Comparative Analysis: Stricter, Looser, or Silent

Comparing these frameworks reveals distinct approaches to AI training data:

• Legal Basis for Processing: The DPDPA is generally stricter, primarily relying on explicit consent (Section 6) or specific categories of deemed consent (Section 7). It lacks a direct, flexible equivalent to GDPR’s Article 6(1)(f) for novel processing like AI training, which could be seen as a “gap” for innovative uses not explicitly covered by existing deemed consent provisions. This places a higher burden on Indian data fiduciaries to secure explicit consent or demonstrate clear alignment with notified public interest purposes.
• Balancing Test: GDPR and UK ICO guidance explicitly require a rigorous balancing test for legitimate interests, weighing the data fiduciary’s interests against data principal rights. The DPDPA’s deemed consent provisions do not feature an equivalent explicit balancing test for AI training, potentially requiring a more literal interpretation of “purpose” for which data was voluntarily provided or for which processing is “necessary” for public interest.
• Guidance and Clarity: The UK ICO offers extensive, practical guidance specifically tailored to AI development, providing clarity on applying data protection principles. While the DPDPA is newer and the DPBI will likely issue specific guidance, the current framework is comparatively silent on the detailed application of its provisions to the unique challenges of AI training data acquisition and use.
• Risk Assessment: Both GDPR (Article 35) and DPDPA (Section 17, for Significant Data Fiduciaries) mandate impact assessments for high-risk processing. However, the scope and specific requirements for AI training under DPDPA are still being defined, whereas GDPR’s DPIA framework is well-established for AI.

Practical Takeaway

Indian businesses, General Counsels, and Data Protection Officers engaged in AI development must proactively navigate this evolving landscape. Given the DPDPA’s emphasis on consent and the lack of a broad “legitimate interests” basis, a conservative approach is advisable. Prioritise obtaining explicit, informed consent wherever feasible. For situations relying on deemed consent, ensure the AI training purpose is demonstrably “necessary” for the purpose for which the data was voluntarily provided (Section 7(a)) or falls squarely within notified public interest categories (Section 7(d)). Implement robust data minimisation and anonymisation techniques from the outset. Maintain meticulous records of processing activities and conduct thorough internal assessments, anticipating future guidance from the DPBI. Closely monitor global developments and regulatory interpretations, as these often influence domestic policy and best practices.