This is a general guide, not legal advice. Confirm every date and obligation with your counsel and the official sources linked below.
Dated milestones
- 11 August 2023: the Digital Personal Data Protection Act, 2023 received Presidential assent.
- Commencement of core obligations: the date from which the main duties on data fiduciaries apply is set by the DPDP Rules and the Gazette notifications under the Act. We have not stated a calendar date here because it must be read from the notification itself. Check the official Gazette entry before you plan against any date, including dates quoted in the press.
Official sources: The Gazette of India (egazette.gov.in) and Ministry of Electronics and Information Technology (meity.gov.in).
Checklist: records to hold for training data
For every dataset that touches personal data, an AI team should be able to produce the following without a scramble.
- Source: Where each dataset came from: the provider or collection method, the date acquired, and the contract or terms it was acquired under.
- Consent basis: The legal basis for using the personal data in training, the notice shown, the purpose it covered, and how a withdrawal of consent is recorded and acted on.
- Processing steps: What was done to the data before and during training: cleaning, de-identification, annotation, filtering, and which tools and teams were involved, with versions and dates.
- Access logs: Who accessed the data, when, from where and for what task, including annotators, vendors and engineers.
- Retention logs: How long each dataset is kept, the reason, when it was deleted or returned, and evidence that the deletion happened.
Where Indika fits
Indika is GDPR compliant, and its data handling practices are built around documented processing and controlled access. Ask any annotation vendor, including us, to supply the access and processing records above for the work done on your data.