The dates that actually matter
India's Digital Personal Data Protection framework has firm dates now. The consent manager registration window opens November 13, 2026, and full applicability of the Act follows on May 13, 2027. At a Bengaluru startup consultation, a MeitY official confirmed the timelines will not be extended. That gives AI companies building on personal data roughly eight months from today to revise consent systems, privacy notices, and data handling before the Data Protection Board is expected to begin active enforcement.
Why AI products specifically are exposed
AI systems are data-hungry by nature, and most of that data is personal: user inputs, behavioral signals, documents uploaded for processing, conversation history used to improve a model. That makes consent and purpose limitation central, not peripheral, for any AI startup. The Act introduces a category called Significant Data Fiduciaries, designated based on data volume and sensitivity, who carry direct liability if their AI-driven algorithmic software harms a data principal's rights. If your product processes personal data at any meaningful scale and makes automated decisions with it, that category is worth assuming applies to you until proven otherwise.
What founders are actually worried about, and what it costs to get wrong
At the same Bengaluru consultation, founders raised consent fatigue (users clicking through consent prompts without reading them, which doesn't protect anyone legally), breach notification thresholds, legacy data collected before the rules existed, and the specific question of using personal data to train AI models. The stakes are real: one engineering guide to the Act cites maximum fines around ₹250 crore for failing to maintain reasonable security safeguards, and around ₹200 crore for a missed breach notification. Those figures should be verified against the Act's text directly before you rely on them for planning, but the order of magnitude alone is reason enough to start now.
Where to actually start
Industry framing from a recent Bengaluru summit put it well: compliance here is a growth strategy, not a box to tick, because getting consent, data lineage, and model training rights right from the start is cheaper than retrofitting it under enforcement pressure. The practical starting point is an honest audit: what personal data does your product actually collect, where does it flow, what was it consented for, and does your AI training or inference pipeline use any of it in a way the original consent didn't cover. That audit is the same first step we run before any AI transformation engagement, because you can't fix what you haven't mapped.