DPDP Act AI compliance means personal data in training sets, prompts and model outputs has an owner and a purpose. The DPDP Rules, 2025 were notified on 13 November 2025. Main fiduciary duties start on 13 May 2027. An ISO 42001 system is where you hold that record. This article is general guidance, not legal advice.

What DPDP Act AI compliance means in the model file

The DPDP Act, 2023 is the statute. The Rules were notified on 13 November 2025 as G.S.R. 846(E). On 31 October 2026 only part of the rulebook is in force. Rules 1, 2 and 17 to 21 cover definitions and the Data Protection Board. Rule 4, Consent Managers, starts on 13 November 2026. Rules 3, 5 to 16, 22 and 23, notice, security, breach intimation, rights and the other main duties, start on 13 May 2027. Do not tell the board the full rulebook is already live.

DPDP Rules 2025 AI work is a calendar with three dates, not one switch. DPDP Rules 2025 AI planning that assumes everything starts in May will miss Consent Managers, two weeks from today. The records should already mark which systems touch personal data.

DPDP Act AI compliance, in practice, is four places personal data hides: training sets, prompts, outputs and vendor models. A file named Final_v7 full of tickets is a training set. A prompt with a résumé and an output that repeats a phone number are in scope. A paid chatbot is still your processing if you send it customer text.

Where DPDP Act AI compliance sits inside the AIMS

ISO/IEC 42001:2023 is the AI management system, the AIMS. It does not replace the Act. Clauses 4 to 10 are the loop. Annex A has 38 controls. The Statement of Applicability says which apply and why.

Run ISO 42001 and ISO 27701 as neighboring systems. ISO/IEC 27701 is the privacy layer. One asks what the model may do. The other asks why you hold the personal data. Keep two Statements of Applicability if you run both.

DPDP Act AI compliance shows up on the inventory row: owner, model purpose, data purpose, training flag, prompt log, output store, vendor and retention. This article will not tell you that you are a Significant Data Fiduciary. If you are designated as one, check that algorithmic software used on personal data does not put Data Principal rights at risk.

DPDP Act AI compliance records kept inside an ISO 42001 system inventory
Place Record in the AIMS Tuesday question
Training set Source, purpose, retention Who approved it, and can you delete a person
Prompt Whether the log is kept, and who can read it Did a customer sentence get stored
Output Where the answer sits, and for how long Can the model write personal data into a ticket
Vendor model Contract on logs and training What happens to text you send tonight

DPDP Act AI compliance is this table filled, not a privacy policy that never names a model. An AI system that is already in production needs an owner, a purpose, and a record of how it was tested. Add the personal-data purpose beside the model purpose.

Three dates, said once

DPDP Rules 2025 AI dates are easy to blur on a slide. Separate them. Board machinery is not your notice or your breach clock. Consent Managers start on 13 November 2026. If you will not use one, write that down.

Main duties on 13 May 2027 include notice, security safeguards, breach intimation and rights. DPDP Act AI compliance for that date means a person can be found in a training set, a prompt log and an output store, and you know who approves the search.

DPDP Rules 2025 AI guidance for staff should say what they may paste into a tool. Do not paste customer files into a public chatbot. Log a vendor exception and name the purpose.

DPDP Act AI compliance also covers models you did not train. If a vendor may train on your prompts, accept that in the contract or forbid it. An AI risk assessment scores a leak or a missed right. An AI impact assessment asks who is affected. A deletion drill belongs in DPDP Act AI compliance before May, even if the legal clock has not started.

The two management systems

ISO 42001 and ISO 27701 fit a firm that already runs ISO 27001. Security asks who can read the data. Privacy asks why you have it. The AIMS asks what the model may say or decide. Shared document control can live in one manual. The registers stay distinct.

ISO 42001 and ISO 27701 projects fail when the notice describes a product the model no longer matches. If you added a feature that reads email, the notice and the inventory change the same week.

DPDP Act AI compliance for a vendor tool is a due-diligence file: where it runs, whether prompts are kept, whether outputs train another system, and how a deletion request is passed on. Annex A supplier controls are the hook. The privacy system holds the agreement.

ISO 42001 and ISO 27701 certification, if you want either, comes from a certification body. Seven Step Consulting does not issue ISO certificates. Check NABCB or IAF scope. Do not treat a body as accredited until you have looked. Stage 1 reads documents. Stage 2 samples live systems. A surveillance audit asks whether a bad output changed a control. Do not promise a certificate in 90 days.

DPDP Rules 2025 AI scope can be one product. Write the name, the data classes and the vendors. DPDP Rules 2025 AI owners should show one deleted record, or a dated reason a backup still holds it.

ISO 42001 and ISO 27701 staff time is the cost people skip. The lawyer, the data scientist and the product owner sit in one workshop or the row stays wrong. Figures below are 2026 India market ranges, not a Seven Step rate card.

Work 2026 India market range, not a Seven Step fee
Gap analysis ₹1.5 lakh to ₹4 lakh
Single-product firm ₹4 lakh to ₹8 lakh
Several systems, one entity ₹8 lakh to ₹15 lakh
Bank, hospital, insurer or multi-site ₹15 lakh to ₹30 lakh, sometimes more

The certification-body invoice for Stage 1 plus Stage 2 is separate, often about ₹2 lakh to ₹8 lakh. Annual surveillance is often about 40 percent of that initial audit fee.

What the board should see

Give the board the calendar and four counts: systems with personal data, logged prompts, vendors who can train on your text, rows with no owner. DPDP Act AI compliance at that meeting is the decision to fund the May 2027 build. Four checks close DPDP Act AI compliance for the quarter: a training purpose, a prompt retention date, a vendor clause you have read, and a rights path. DPDP Act AI compliance is those four, dated.

Consent Manager decisions are part of DPDP Act AI compliance from 13 November 2026, even when you decide not to use one. DPDP Act AI compliance does not require you to certify. The legal duties do not wait for a certificate.

ISO 42001 and ISO 27701 together show the model file and the privacy file without pretending they are one binder. Sample the same system from both sides.

A training export named customers_final needs a source column and a purpose a colleague can read without a meeting. If the field list includes a phone number, a health note or a government id, say why the model needs it. If you cannot say why, drop the field before the next training run. Prompt logs are the same problem in a different bucket. A support bot that stores the full customer sentence for ninety days has a retention rule. Write the days on the row. An output that copies a training row into a reply is an incident, even when a tester found it on purpose. Record the test, the date and the fix.

ISO 42001 and ISO 27701 give you two places to put that fix. The AI system row records the model, the test and the owner. The privacy record records the purpose, the retention and the path for a person’s request. Link them with the system name so a Stage 2 sample can walk from the reply back to the field. Document control can be shared. The two Statements of Applicability stay separate pages.

Counsel still decides whether a purpose is lawful. The registers do not make that decision. They stop the model team and the privacy team from keeping two lists that drift. A focused firm can be audit-ready for Stage 1 in about 90 days if the inventory is small and leadership shows up. That is readiness, not a certificate, and it is not a claim that the May 2027 duties have already been met.

DPDP Rules 2025 AI checks for a designated Significant Data Fiduciary include the algorithmic-software test. Ask counsel if the designation applies. If it does not, the May duties still need a purpose and a safeguard.

DPDP Act AI compliance training can be one hour for anyone who pastes text into a tool, and a longer session for owners. Keep attendance.

MeitY’s India AI Governance Guidelines of 5 November 2025 are non-binding. They are not the Act and they are not a substitute for the commencement dates. Hold the legal dates in the calendar above.

Ask for a combined read

If prompts are logged and nobody can say why, ask for a DPDP + AI combined assessment. We read the inventory, the calendar and the vendor clauses. The assessment is not legal advice and it is not a certificate. Start here: https://www.sevenstepconsulting.com/contact-us/

Questions people ask before they buy

Is the full rulebook in force now?

No. On 31 October 2026 the Board provisions are in force, Consent Managers start on 13 November 2026, and the main duties start on 13 May 2027. DPDP Act AI compliance work should follow that calendar. This is general guidance, not a legal opinion.

Do training sets count if you bought them?

If they contain personal data and you use them, record the source, the purpose and whether a person can be removed.

Are prompts personal data?

Often yes, when they include a name, a number or a customer email. DPDP Act AI compliance treats the log as a store. Know who can read it and when it is deleted.

Do you need both standards?

You need the Act’s duties whether or not you certify. ISO 42001 and ISO 27701 are voluntary systems that hold the evidence. Many firms add them beside ISO 27001.

What will Stage 2 sample?

A live system: a training set, a prompt log and a vendor. DPDP Rules 2025 AI evidence is the row, the contract and a sample deletion or a dated reason deletion is pending.

If you want DPDP Act AI compliance to be a record you can show before 13 May 2027, book a DPDP + AI combined assessment. We will map training data, prompts, outputs and vendor models to owners and purposes. Write via https://www.sevenstepconsulting.com/contact-us/