• Insured
  • Counsel-reviewed
  • De-identified
Call +1 656 800 9088Partner portal
Call+1 656 800 9088Partner portal

Rules by region

Selling company data to AI labs in India

Before company data goes to an AI lab, the privacy law where the people in it live asks one question: can anyone still be identified from it? This page explains the main laws in India, what counts as no longer personal, and what to check first. General information as of 2026-10-28, not legal advice: your counsel confirms what applies to your company.

Ask about de-identificationWhat's my data worth?

At a glance

Main lawThe Digital Personal Data Protection Act, 2023 (the DPDP Act) is India's general privacy law for digital personal data. The DPDP Rules, 2025 were notified in November 2025 and give organizations an eighteen month period of phased compliance, so which parts apply on a given day depends on the phase. Check the current dates on the MeitY site before relying on any one provision.
What it coversPersonal data means any data about an individual who is identifiable by or in relation to that data. The Act applies to digital personal data processed in India, including data collected on paper and digitised later, and to processing outside India connected with offering goods or services to people in India.
What it leaves outIt does not apply to personal data an individual processes for personal or domestic purposes, or to personal data that the person made public or that someone made public under a legal duty. Company records with no data about identifiable people are outside it.
Who is whoA Data Fiduciary decides the purpose and means of processing, a Data Processor acts on a fiduciary's behalf, and a Data Principal is the person the data is about. A company that licenses data about people usually acts as a fiduciary for that data.

The main laws, and what each means for selling data

Digital Personal Data Protection Act, 2023

Processing of digital personal data. A person may process it only for a lawful purpose, with the individual's consent or for a listed legitimate use, after a notice that says what data is used and why (sections 4 to 7).

Licensing records that name staff or customers is a new use of personal data. The Act expects a lawful purpose, a notice and consent, or a legitimate use, and it expects the data to be erased once the purpose is served. A seller either checks that the original notice and consent cover this use, or removes the personal data so that no individual is identifiable from it.

Source: The Gazette of India: DPDP Act, 2023 (MeitY copy)

Digital Personal Data Protection Rules, 2025

The rules that put the Act into practice: notices, consent managers (which must be companies based in India), personal data breach reporting and the Data Protection Board, phased in over eighteen months.

A seller with records about people in India plans for the notice and breach duties as they come into force. Consent managers matter if a company relies on individuals' consent through one.

Source: Press Information Bureau: DPDP Rules, 2025 notified

Cross-border transfers (section 16)

The central government may by notification restrict transfers of personal data to specified countries or territories. Other laws that restrict transfer more strictly continue to apply.

The Act starts from permission and restricts by exception, but a sector law, such as one for finance or health, can still limit a transfer. Check the current list of restricted countries and the rules of your own sector before sending data to an AI lab abroad.

Source: DPDP Act, 2023, section 16

Processing for foreign clients (section 17(1)(d))

The Act's main duties and the transfer rule do not apply where personal data of individuals outside India is processed under a contract with a person outside India by a person based in India.

An outsourcing company in India that holds a foreign client's data under such a contract is largely outside these duties for that data. The client's own privacy law, and the contract, still apply, and the data usually belongs to the client, not to the outsourcer.

Source: DPDP Act, 2023, section 17(1)(d)

Research, archiving and statistics (section 17(2)(b))

The Act does not apply to processing necessary for research, archiving or statistical purposes if the data is not used to take a decision specific to a person and prescribed standards are followed.

The exemption is written for research, archiving and statistics. It is not a general permission to license people's data for AI training, so do not rely on it without advice.

Source: DPDP Act, 2023, section 17(2)(b)

How India decides data is no longer personal

The Act defines personal data as data about an individual who is identifiable by or in relation to that data. It does not define anonymization and does not set a test for it. The question is whether any individual can still be identified from the data or in relation to it.

The words "by or in relation to" point to a wide reading that takes account of other information connected to the data, so a careful seller treats removal of names alone as not enough. We found no published test from the Data Protection Board as of the date above, and counsel confirms which standard to apply.

Data that an individual made public, or that someone made public under a legal duty, falls outside the Act (section 3(c)(ii)). That is a narrow exception for the data itself and does not make a company's own records public.

Sources: DPDP Act, 2023, section 2 and section 3

Records that carry extra rules

Children

Before processing the personal data of a child, or of a person with a disability who has a lawful guardian, the fiduciary needs verifiable consent from the parent or guardian. It may not track or monitor children's behaviour or direct targeted advertising at them, subject to exceptions the government may set.

Source

Significant Data Fiduciaries

The government may designate fiduciaries as significant based on factors such as the volume and sensitivity of the data. They have extra duties, including a data protection officer based in India.

Source

Start-ups and exempted classes

The government may exempt some fiduciaries, including start-ups, from some duties, and may exempt classes of fiduciaries for a period. Whether a company qualifies depends on notifications at the time.

Source

Sending data to an AI lab in another country

India's Act does not require approval for each transfer. The central government may notify countries to which transfers are restricted, and a stricter law in the seller's sector still applies on top.

A company that sends de-identified data abroad in a license should confirm three things: that the data no longer identifies individuals, that no sector rule bars the transfer, and that the destination is not on the restricted list at the time.

Sources: DPDP Act, 2023, section 16, Press Information Bureau: DPDP Rules, 2025

Who enforces it

Questions about selling data from India

Is it legal to sell company data to an AI company in India?

It depends on what is in the data. Business records with no data about identifiable people are outside the Act. Records that name staff or customers are covered, and need a lawful basis and a notice, or the personal data has to be removed first.

Do the DPDP Rules apply yet?

They were notified in November 2025 and phase in over eighteen months. Which duties apply depends on the date, so check the current timetable on the MeitY site.

Does India have a standard for anonymous data?

The Act has none. It asks whether an identifiable individual remains, and we found no test from the Data Protection Board as of the date above. Counsel confirms the standard for a given set.

We are an outsourcing company in India. Can we license our client's data?

Section 17(1)(d) takes processing for a foreign client out of most of the Act, but it does not give you the right to license the data. That depends on your contract with the client, so the client's agreement comes first.

Can data about people in India go to a lab abroad?

Generally yes unless the destination is on the government's restricted list or a sector law bars it. Check both at the time of transfer.

Didn't find your question? Ask us directly.

What we do about it

We find and remove the personal information in your company data, test whether anyone could still be identified, and write down how it was done for your counsel. If you license the data through us, the AI lab usually pays for that work, and the AI lab pays our broker fee, only after the deal closes. See how de-identification works and how licensing your data works.

Rules in other regions