DPDP Act “Specified Purpоse” Cоnsent Vs Generative AI Data Use
- IJLLR Journal
- 2 hours ago
- 1 min read
Inaan Prashere, Punjabi University, Patiala
Emal Biju Pappachan, Punjabi University, Patiala
1. ABSTRACT
This report analyses the tension between India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the data requirements of generative AI systems. While the DPDP Act requires personal data to be processed only with free, informed, specific, and purpose-bound consent, generative AI models rely on large, diverse datasets and continuous training, often making compliance with these requirements difficult. The study identifies key legal and technical conflicts, including the mismatch between AI’s broad data use and the Act’s purpose limitation, data minimisation obligations, and challenges in deleting or "untraining" data following consent withdrawal.
It also compares the DPDP Act with the EU GDPR and the UK Data Protection Act, highlighting that these frameworks provide broader legal bases for processing than the DPDP Act. The report evaluates potential compliance measures such as the use of genuinely public data, anonymisation, privacy-enhancing technologies, dynamic consent, and stronger data governance, alongside policy reforms including research exemptions and clearer regulatory guidance. It concludes that, without greater flexibility and clearer interpretation of consent requirements, the DPDP Act may hinder AI innovation or result in widespread non- compliance, and recommends practical compliance strategies and policy reforms to better balance privacy protection with AI development.
Keywords: DPDP Act,2023, Generative AI Cоnsent, Specified Purpоse, Data Minimizatiоn, GDPR, UK Data Prоtection, AI Cоmpliance, Purpоse Limitatiоn, Data Flоw, AI Training.
