Shadow AI and personal data: governing AI tools under DPDP
Reviewed against the law as of 28 September 2026
Pasting customer data into AI tools is processing under the DPDP Act. How to find shadow AI, what AI vendors need, and an AI governance checklist.
"Shadow AI" is AI used at work without approval: a chat assistant used to summarise a customer complaint, a meeting note-taker that joined every call, a browser extension that rewrites e-mails. Each one can move personal data to a third party, often outside India, with no contract, no purpose record and no way to delete it.
Why it is a DPDP issue
The DPDP Act does not mention AI, but it does not need to. Pasting a customer's complaint into an AI tool is processing of personal data. That brings the usual questions:
- Lawful basis. Was the data collected under consent or a legitimate use that covers this purpose?
- Processor contract. Section 8(2) requires processors to be engaged under a valid contract. A personal account on a consumer AI service has no such contract with your organisation.
- Security safeguards. Can you control access, retention and deletion at the provider?
- Erasure. When the purpose is served, can you make the provider delete the data?
- Breach. If the provider has an incident, will you know?
- Transfers. Where is the data processed?
Significant Data Fiduciaries have an additional duty under the Rules to carry out due diligence that algorithmic software they use does not pose a risk to the rights of Data Principals.
Finding shadow AI
Two sources show most of it:
- Egress logs. Web proxy, DNS or firewall logs list the domains staff reach. Matching them against known AI services shows which tools are used, by how many people, and how much data is uploaded.
- Enterprise app grants. Identity providers such as Entra ID, Okta and Google Workspace list third-party apps users have granted access to. AI note-takers and assistants show up here with access to mail, calendars and files.
An AI governance checklist
- Inventory every AI system: approved, under review, prohibited.
- Record for each: purpose, provider, whether it processes personal data, which categories, where, and whether it makes or supports decisions about people.
- Approve with a named approver, after checking contract terms, data use for training and retention.
- Human oversight for any system that supports decisions about people, such as hiring or credit.
- Block or replace prohibited tools, and give staff an approved alternative.
- Review periodically, because new tools appear every month.
How TrustNiq helps
TrustNiq keeps an AI system inventory, imports proxy or DNS logs to detect unapproved AI services, checks enterprise apps granted access in your identity provider, and tests AI governance as a control, so it shows up in your posture alongside everything else. Start a free trial.
Frequently asked questions
Does the DPDP Act regulate AI?
The Act has no AI-specific chapter, but any processing of digital personal data by or through an AI tool is processing under the Act. Significant Data Fiduciaries must also carry out due diligence on algorithmic software under the DPDP Rules.
Is an AI provider our Data Processor?
When it processes personal data on your behalf, yes, and you must engage it under a valid contract. Check whether the provider uses your inputs for its own purposes, such as training, which could make it more than a processor.
How do we find AI tools staff already use?
Look at web proxy, DNS or firewall logs for traffic to AI services, and at the enterprise apps granted access to your identity provider. Both reveal tools that were never approved.
Sources
- Digital Personal Data Protection Act, 2023meity.gov.in
- Digital Personal Data Protection Rules, 2025meity.gov.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.