How AI training models could compromise privacy

Giant eye watching at man working at the computer. Surveillance, hacking, internet security concept. Flat vector illustration. | Photo Credit: Moor Studio The right to privacy is a constitutional right upheld by the Supreme Court in 2017. However, the legal instruments currently in place to safeguard this right seem inadequate, especially considering the technological revolution led by Artificial Intelligence (AI) around the world. While AI regulation is one of the most commonly discussed issues within governments today, the recommendations have been broad, vague and have only led to further questions. AI has immense potential to boost productivity and have positive effects on people’s lives; any indiscriminate regulatory or policy measure risks inhibiting innovation and economic growth. However, there are lower hanging fruits; specific gaps that can be filled to better safeguard people’s constitutional rights without permanently losing out in the AI race.The Digital Personal Data Protection (DPDP) Act was passed in 2023, with the DPDP Rules being notified in November 2025. The implementation is phased with some provisions on consent and safety becoming effective only in 2027. Prior to the DPDP Act, the primary legal instrument to regulate the use and management of personal data was the Information Technology (IT) Act, 2000. Together the IT Act, 2000 and its 2011 Rules broadly regulated the export of “sensitive personal data” on the condition that the recipient ensured a level of data protection required under Indian law, and that the transfer was either necessary to perform a lawful contract or had been consented to by the data provider. An assertion and claim were sufficient to record adequacy. The criminal penalty for unauthorised disclosure was capped at three years’ imprisonment or a fine of ₹5 lakh. These penalties only applied to disclosure of sensitive personal data that were listed in the Rules such as financial data, medical or health details, sexual orientation, biometric information etc. The Rules did not apply to personal data such as names, addresses, phone numbers, caste, religion, political affiliations, browsing history, social media activity, online or offline behavioural patterns, institutional affiliations etc. Published - November 03, 2026 01:32 am IST