DPDP ACT 2023 · AI DATA PROTECTION

Keep Every AI Prompt DPDP Compliant

Every prompt can carry personal data out of your control. Wald detects Aadhaar, PAN, customer and employee data on the device and stops it before it reaches ChatGPT, Gemini, Claude, or Copilot.

Book A Demo

Built for DPDP:

Security safeguards Purpose limits Breach response Children’s data Audit logs
Flowchart: email, endpoint and cloud are protected but AI prompts are not, so an employee pasting customer data into ChatGPT leads to DPDP non-compliance with penalties up to ₹250 crore

Trusted By

55+

Regulated Organizations

WHY AI IS THE NEW DPDP RISK

AI Is Now the Biggest Leak Channel for Personal Data

Email, file sharing and USB have had DLP for years. AI prompts have not. Employees copy and paste whole records into a browser tab, often from personal accounts, and legacy DLP never sees it.

#1

GenAI is now the top channel for corporate data moving to personal accounts, carrying 32% of it.

77%

of employees using GenAI paste data straight into prompts.

82%

of those pastes happen in unmanaged personal accounts your tools can’t see.

Source: LayerX, Enterprise AI & SaaS Data Security Report 2025

A
Ananya · Claims executiveFree ChatGPT · personal account · Tue 11:04 AM
TYPICAL SCENARIO

Write a polite rejection email for claim CLM-88231. Customer: Priya Sharma, Aadhaar 5521 8830 4417, mobile +91 98201 44730. She had a cardiac stent fitted at a Pune hospital in May, and the claim is rejected for a pre-existing heart condition.

Personal data in one prompt: NameAadhaarMobileHealth conditionClaim record

What just happened

  • Customer data sent to an AI tool that may train on it
  • No processor contract, no safeguard, no audit log
  • If Priya asks for her data to be erased, you can’t trace where it went
One prompt, sent in under a second. Instant DPDP exposure.
MAXIMUM DPDP PENALTY
Up to ₹250 crore

For failing to take reasonable security safeguards to prevent a personal data breach. When personal data walks out through an unguarded AI prompt, that is the obligation in question.

Up to ₹200 croreFailing to notify the Board and affected people of a breach
Up to ₹200 croreBreaching obligations for children’s data

Why Employee AI Use Puts DPDP Compliance at Risk
‍

01

Free AI Plans Can Train on Prompts

Consumer tiers of popular AI assistants may train on conversations, depending on user settings. Personal data pasted in is used in ways your notices never covered.

02

Paid Plans Don’t Close the Gap

Business plans stop model training, but prompts still leave the device and sit on third-party servers. Under DPDP, that data is still your responsibility as the Data Fiduciary.

03

Personal Data Hides in Everyday Work

A customer list to clean up, a CV to summarise, a support ticket to rewrite. Employees rarely see these as personal data. DPDP does.

04

No Record, No Defence

Without a log of what went to which AI tool, you cannot act on an erasure request, assess a breach, or show the Board you took reasonable safeguards.

The Personal Data DPDP Protects

DPDP covers all digital personal data, not just a ‘sensitive’ list. These are the classifiers that surface most often in employee AI prompts. Wald detects each one on the device, and you choose Allow, Warn, or Block.

Government IDs

IDs employees paste while verifying customers or vendors.

  • Aadhaar number
  • PAN
  • Passport number
  • Voter ID
  • Driving licence

Contact details

The basics that make any record identifiable.

  • Full name
  • Mobile number
  • Email address
  • Home address
  • Date of birth

Financial data

Account and payment details from finance and support work.

  • Bank account & IFSC
  • UPI ID
  • Card number
  • Salary & payslips
  • Credit score

Health data

Patient and claims data in health, insurance, and HR.

  • Medical records
  • Diagnoses
  • ABHA number
  • Insurance policy no.
  • Lab reports

Children’s data

Needs verifiable parental consent, with penalties up to ₹200 crore.

  • Names of minors
  • Student records
  • Age & date of birth
  • Parent contacts
  • School details

Employee & HR data

Records that flow through HR, payroll, and hiring.

  • Employee ID
  • CVs & resumes
  • PF / UAN number
  • Appraisals
  • Background checks

Customer records

Bulk exports that end up in prompts for analysis.

  • CRM exports
  • Support tickets
  • Chat transcripts
  • KYC documents
  • Order history

Online & biometric IDs

Digital and biometric data that can identify a person.

  • IP address
  • Device ID
  • Precise location
  • Biometrics
  • Call recordings

Failing to take reasonable security safeguards against a personal data breach carries penalties of up to ₹250 crore under the DPDP Act.

Stop personal data before it reaches AI

Wald’s on-device models recognise Indian identifiers such as Aadhaar, PAN, and UPI IDs, plus customer, employee, and health data by context, so personal data never leaves the laptop inside a prompt.

  • Aadhaar, PAN, UPI & Indian ID detection
  • Customer, employee & health data
  • Context, not just pattern matching

Apply DPDP policies with Allow, Warn, or Block

Set rules per classifier, team, and AI tool. Block Aadhaar and bank details outright, warn on customer contact data, and coach employees in the moment instead of after an incident.

  • Per-classifier, per-team policies
  • Inline coaching before a block
  • Free and paid AI tools covered

Evidence for the Data Protection Board

Every AI interaction is logged with user, tool, data type, and policy outcome, so your DPO can show reasonable safeguards, investigate incidents fast, and support breach reporting.

  • Centralised audit trail
  • Exportable reports for DPOs & auditors
  • Per-user, per-tool records

An Enterprise AI Plan Alone vs. Wald

Enterprise AI plan alone
With Wald
Personal data still leaves the device
Personal data stopped on the device
Covers only the one tool you license
Covers the AI tools employees actually use
No control over what employees paste
Allow, Warn, or Block on every prompt
Usage logs held by the AI vendor
Your own record of every AI interaction
Jonathan Antonio
Wald enables our employees to safely leverage leading AI models so they can reduce the time they spend on manual tasks. Our traditional DLP was built for email and file transfers and not AI prompts. Wald gave us real visibility and control over how our employees use LLMs without slowing productivity.
Jonathan Antonio
Jonathan Antonio
Vice President of Infrastructure @Suki

Stop Personal Data Leaking Into AI

Keep personal data out of AI tools, and keep the proof that you did. See how Wald fits your DPDP programme in a 30-minute demo.

Book a Demo
3D illustration of Wald AI visibility and protection

Frequently Asked Questions

Talk to Sales

What is the DPDP Act?

India’s Digital Personal Data Protection Act, 2023 sets rules for how organisations process digital personal data. The DPDP Rules were notified in November 2025, and most obligations, including security safeguards and breach reporting, apply from May 2027.

‍

MeitY has consulted on shortening that window, so many organisations are planning for an earlier date.

Does DPDP apply to data employees paste into AI tools?

Yes. A prompt containing a customer’s or employee’s personal data is processing of digital personal data.

‍

Your organisation remains the Data Fiduciary and stays responsible for purpose limitation and reasonable security safeguards, even when the processing happens inside a third-party AI tool.

Is a paid ChatGPT or Gemini plan enough for DPDP?

Business plans typically stop the vendor from training on your data, but personal data still leaves the device and is stored by a third party. They also cover only the tool you license, not the free tools employees use on the side. Wald adds on-device detection and control across the AI tools your teams actually use.

Which personal data does Wald detect?

Indian identifiers such as Aadhaar, PAN, passport, voter ID and UPI IDs, plus contact details and financial, health, HR, customer and children’s data.

‍

On-device models understand context, not just patterns, and you decide whether each type is allowed, warned on, or blocked.

What are the penalties under DPDP?

Up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach.

‍

Up to ₹200 crore each for failing to notify the Data Protection Board and affected people of a breach, and for breaching obligations around children’s data.

How quickly can we roll out Wald for DPDP?

Wald runs as a lightweight agent across browser and desktop, so you can start seeing AI usage across your workforce soon after rollout. We'll map out a deployment plan with you during your demo.

Maintains compliance with:

SOC2 TYPE II
HIPAA
GDPR
CCPA
GLBA