The DPDP Act for Indian Law Firms: What It Means When You Put Client Data into an AI Tool

By Akshit Agrawal, Founder, Lawgix AI · Published 12 October 2026 · Figures as at 2026-10-12

If your firm uploads client documents to an AI tool, your firm is the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023, and stays responsible for the data even though the vendor processes it. The main duties start on 13 May 2027; the maximum penalty for failing to secure data is ₹250 crore (as of 12 October 2026).

Lawgix AI is a legal AI vendor, so treat this article as a buyer's guide written by a vendor. Every legal point below is tied to the Act or the Rules, and the parts we could not verify are marked "not found".

What are the key facts as of 12 October 2026?

Is a law firm a Data Fiduciary under the DPDP Act?

Yes, in almost every case. Section 2(i) defines a Data Fiduciary as "any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data." A firm decides why it holds client, witness and opponent data and how it is used, so it is the fiduciary. An AI vendor that processes documents on the firm's behalf is a Data Processor under section 2(k).

The Act applies to digital personal data, including paper records that are later digitised. A scanned case bundle uploaded to an AI tool is covered.

Who is responsible when the AI vendor handles the data?

You are. Section 8(1) makes the Data Fiduciary "responsible for complying" with the Act even where a processor does the work. Section 8(2) allows a processor to be engaged "only under a valid contract". Section 8(5) requires "reasonable security safeguards to prevent personal data breach", and that duty covers data held by processors.

In practice this means a click-through terms page is a weak basis. The firm should hold a written processing agreement with each AI vendor.

Does the "legal claims" exemption cover litigation work?

Only partly. Section 17(1)(a) exempts processing "necessary for enforcing any legal right or claim". But section 17(1) disapplies Chapter II "except sub-sections (1) and (5) of section 8". So even where the exemption applies, the firm's overall responsibility (s. 8(1)) and the duty to keep data secure (s. 8(5)) remain, and s. 8(5) carries the ₹250 crore ceiling.

Whether a given AI workflow, such as bulk summarising of a client's own documents for advice rather than a pending claim, falls inside the exemption is not settled. We found no Board decision or court ruling on it. This is the question to put to your advocate or data-protection counsel.

What changes on 13 May 2027?

Per a law-firm summary of the Rules, the following start on 13 May 2027:

• Notice and consent for personal data collected from individuals, in plain language.
• Security safeguards (Rule 6 in the notified Rules).
• Breach reporting: intimation to the Board and each affected person "without delay", then a detailed report to the Board within 72 hours. Check the Rules text for the exact wording before relying on the 72 hours.
• Erasure when the purpose ends or consent is withdrawn, unless another law requires retention (s. 8(7)). Certain logs must be kept for at least one year.
• Data Principal rights such as access, correction and erasure, with a response time the PIB release gives as a maximum of 90 days.

The Board and its appeals route (TDSAT) are in the Rules. An August 2026 summary says the Board should not yet be described as fully operational.

What should a firm check before using an AI tool on client files?

Seven checks, in the order we would run them:

1. Role. Is the vendor a processor on your instructions, or does it use your data for its own purposes (for example, to train models)? Get the answer in writing.
2. Contract. A signed processing agreement covering security, confidentiality, sub-processors, breach notice to you and deletion on exit (s. 8(2)).
3. Where data is processed. Region of storage and of model inference, and any sub-processor abroad. The Rules leave cross-border transfer restrictions to the Central Government; we found no notified list of restricted countries.
4. Security evidence. Encryption, access control, audit logs and an independent report if one exists, so you can show "reasonable safeguards".
5. Breach path. How fast the vendor tells you, and who tells the Board and clients.
6. Retention and deletion. Can you delete a matter's data and get confirmation, including from backups?
7. Client permission. Whether your engagement letter says client documents may be processed by AI tools.

For the verification duty that sits on top of this, see what rules govern an advocate's use of AI and the AI rules in Indian courts tracker.

How do vendors compare on these points?

We have not compared vendors on data handling, because no vendor we checked publishes all seven points above in one place. Our price comparisons are in Legal AI pricing in India and Harvey AI alternatives for Indian law firms; the alternatives post includes a data-region column.

Disclosure: Lawgix AI is a vendor in that market. Where Lawgix AI processes client data is a question we are still confirming, and this article does not state it. Our security notes are on the Lawgix AI homepage.

Sources

• Digital Personal Data Protection Act, 2023: MeitY (PDF); enactment date per India Code
• Schedule of penalties: dpdpa.com
• DPDP Rules, 2025 press release: PIB
• Phased dates and breach, retention rules: Khurana & Khurana
• Status in August 2026: Mondaq, 14 August 2026
• Proposal to shorten timelines: Business Standard, 22 January 2026

Related

• What rules govern an advocate's use of AI
• AI rules in Indian courts: 2026 tracker
• AI-hallucinated citations in Indian courts
• Legal AI pricing in India (2026)

This is general information, not legal advice. Status as of 12 October 2026.

Keep reading

• What Rules Actually Govern an Indian Advocate's Use of AI (October 2026)
• AI-Hallucinated Citations in Indian Courts: Case Tracker and Pre-Filing Checklist
• Harvey AI Alternatives for Indian Law Firms (2026): India-Built and Global Options Compared