The AI Mirage: Why MeitY’s Reliance on the DPDP Act and Existing IP Laws is a Ticking Time Bomb for Commercial Contracts

For IP and technology lawyers, 2026 is shaping up to be a year of regulatory whiplash. The Ministry of Electronics and Information Technology (MeitY) finally notified the Digital Personal Data Protection (DPDP) Rules on November 13, 2025. With the full enforcement of the DPDP Act, 2023 slated for May 13, 2027, the clock is officially ticking. But while corporate teams are scrambling to decipher the new compliance metrics, the real story is what the government has decided not to do.

MeitY has explicitly signaled that India will not see a bespoke Artificial Intelligence regulation anytime soon. Instead, the government intends to govern AI using the existing matrix of the DPDP Act and current intellectual property frameworks. For practicing lawyers, this "wait and watch" approach is not a breather—it is a drafting nightmare.

The AI Regulatory Void: Trying to Fit a Square Peg in a Round Hole

The government's rationale is that a heavy-handed AI law might stifle innovation. By relying on the DPDP Act to govern the data feeding AI, and the Copyright Act, 1957 to govern the output, they believe they have covered the bases. This is a classic bureaucratic punt, and it leaves tech lawyers holding the bag.

Let’s look at the practical reality of advising an AI startup today. When your client scrapes the internet to train a Large Language Model (LLM), they are invariably ingesting personal data and copyrighted works. Under the Copyright Act, does this scraping fall under the "fair dealing" exception of Section 52(1)(a) for research? The jurisprudence is entirely unsettled. Meanwhile, under Section 6 of the DPDP Act, processing personal data requires free, specific, informed, and unconditional consent. How do you obtain specific consent for data scraped at scale to train a neural network whose exact future outputs are unknown?

"Relying on a privacy statute designed for linear data processing to regulate generative AI is like using a scalpel to chop wood. It technically cuts, but it ruins the tool and leaves a mess."

Without a specific AI framework carving out safe harbors for text and data mining (TDM)—similar to what the EU has attempted—Indian AI developers are exposed to massive infringement and privacy liabilities. Lawyers must now draft AI development agreements with indemnities that border on the draconian, simply because the underlying statutory protection does not exist.

The SDF Black Box: Navigating Section 10 Ambiguity

The operationalization of the DPDP Rules has also thrown a wrench into corporate compliance via the looming specter of the Significant Data Fiduciary (SDF). Under Section 10 of the DPDP Act, SDFs are subject to onerous obligations, including mandatory Data Protection Impact Assessments (DPIAs), appointing a resident Data Protection Officer (DPO), and periodic algorithmic audits.

However, the government committee tasked with identifying SDFs is dragging its feet. There are currently no clear rubrics, timelines, or quantitative thresholds to determine who gets slapped with the SDF tag.

Why does this matter for your practice today? Because tech M&A and vendor agreements are being negotiated now for terms that extend well past the May 2027 enforcement date. If you represent a mid-sized SaaS company, advising them that they aren't an SDF just because the government hasn't named them yet is a fast track to professional negligence. Prudent counsel must advise clients to build SDF-level compliance architecture—particularly AI due diligence and stringent data localization capabilities—preemptively.

Practice Point: Time to Rip Up Your Boilerplate Contracts

If your firm’s standard commercial contracts still rely on Section 43A of the Information Technology Act, 2000, and the SPDI Rules of 2011, you are doing your clients a disservice. The 2026 commercial landscape demands an immediate overhaul of tech contracts.

Here is what needs to change in your drafting practice immediately:

1. Purpose-Limited Consent Clauses: Broad, catch-all consent provisions are dead. Under the DPDP Rules, consent mechanisms must be verifiable and strictly tethered to a specific purpose. Vendor agreements must now explicitly restrict subcontractors from using client data to train their own AI models without secondary, granular consent.

2. Breach Notification Timelines: The DPDP Rules enforce strict breach notification protocols. Your limitation of liability and indemnification clauses must be updated to reflect the specific financial penalties prescribed by the DPDP Act (which can range up to ₹250 crores), rather than generic "direct damages."

3. ESG and AI Cross-Pollination: We are seeing a distinct merger between data privacy and ESG reporting. SEBI’s BRSR Core requirements are increasingly encompassing digital governance. Contracts for publicly listed companies must now include representations and warranties regarding ethical AI use and data minimization as part of their broader ESG commitments.

The India-EU FTA: A Silver Lining?

There is one bright spot on the horizon. The ongoing India-EU Free Trade Agreement negotiations suggest that the DPDP Act's alignment with the EU’s GDPR will significantly reduce cross-border data friction. For IP lawyers, this means a likely influx of IP-protected R&D and digital trade shifting from Europe to India, provided Indian vendors can demonstrate DPDP compliance.

Ultimately, the government's strategy of regulating tomorrow's technology with yesterday's IP laws and today's privacy rules places the burden of clarity entirely on the legal profession. As we march toward the 2027 enforcement deadline, the lawyers who will thrive are those who stop waiting for government clarifications and start contractually engineering their own regulatory certainty.