India: How the DPDP Act Became the De Facto AI Regulation

India took a regulatory shortcut: instead of writing an AI law from scratch, it extended its existing data protection law until it started functioning as one de facto.

The legal vehicle: the DPDP Act, not an AI law

India doesn't have a law dedicated to artificial intelligence. Instead, the Digital Personal Data Protection Act (DPDP Act), passed in August 2023, ended up being the real legal vehicle: as of February 20, 2026, India has its first set of binding AI-specific obligations, applied through this data protection law.

NITI Aayog's principles framework

NITI Aayog, the Indian government's public policy agency, has been building the responsible-governance scaffolding since 2018 with its National AI Strategy, focused on five priority sectors (healthcare, agriculture, education, smart cities, smart mobility). Its 2021 document on Principles for Responsible AI established seven baseline principles: safety and reliability, equality, inclusion and non-discrimination, privacy and security, transparency, accountability, and protection of positive human values.

The 2025-2026 governance guidelines

The India AI Governance Guidelines were published in November 2025, with a full launch at the AI Impact Summit in February 2026. The approach is explicitly “AI for all” — a hybrid model combining horizontal principles with sector oversight, aiming to balance rapid innovation with safety without slowing the growth of India's AI industry.

Who enforces real sanctions

India's Data Protection Board (DPB), created under the DPDP Act, has the power to investigate data breaches caused by AI systems and impose significant sanctions — it is, in practice, India's de facto AI regulator, even though its formal mandate is data protection, not AI specifically.

What it means for companies operating in India

The Indian pattern is a useful reminder: the absence of a law called exactly “AI Act” doesn't mean the absence of real obligations. For any company processing Indian personal data with AI systems, the DPDP Act and its new AI-specific obligations (in force since February 2026) are already binding — it's worth treating them with the same seriousness as a dedicated AI law, even if the name on the door says otherwise.