Section 8(3) · Rule 13
AI governance for personal data under DPDP
When personal data trains or feeds an AI model, DPDP's purpose, notice and accuracy duties follow it. TruePrivacy keeps the inventory that shows where.
Sample workspace
AI inventory
- Credit risk model v3Assessed
- Support chatbotNot assessed
- Dataset · loan_applications_2025Assessed
- Algorithmic due diligenceRule 13
Credit risk model v3
- Model added to inventory
- Assessment completed
- Check the notice covers model training
Short answer
When personal data trains or feeds an AI system, that use is processing under the DPDP Act: where it rests on consent, the purpose must be in the notice (s.5, Rule 3) and consent is limited to the specified purpose (s.6(1)); data used for decisions must be complete and accurate (s.8(3)). Rule 13 asks Significant Data Fiduciaries for due diligence that algorithmic software does not risk Data Principals' rights. TruePrivacy keeps an inventory of the AI models and datasets you use, with assessments.
What AI governance does
An AI model can use personal data in two ways: as training data, and as input when the model runs. Both are processing under the Act, so both need a specified purpose and a ground under s.4. Rule 13 adds algorithmic due diligence for SDFs.
Record the AI models you use, including those from vendors.
Record the datasets you use.
Assess each model or dataset and keep the result with the record, so the review is there when someone asks.
For SDFs, a yearly clock for algorithmic due diligence in the SDF workspace.
Run a DPIA or PIA from a template or blank when a model uses personal data.
How to govern AI that uses personal data
- 01List models and datasets
Record each AI model and dataset your teams use, including models bought from vendors.
- 02Check the purpose
For each one that uses personal data, check that the purpose is in your notice and covered by consent or a legitimate use (s.4). See purpose limitation.
- 03Check accuracy
If a model's output feeds decisions about people, check that the personal data behind it is complete and accurate (s.8(3)).
- 04Assess
Record an assessment, and run a DPIA where the risk calls for one.
- 05Repeat yearly if you are an SDF
Rule 13 asks for algorithmic due diligence. The SDF workspace runs a yearly clock once you record the designation.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Itemise each purpose in the notice | s.5, Rule 3 | An inventory of models and datasets to check against your notices |
| Consent limited to the specified purpose | s.6(1) | Assessments that record your review of each use |
| Completeness and accuracy when data is used for decisions | s.8(3) | Assessments per model |
| Due diligence that algorithmic software does not risk Data Principals' rights (SDFs) | Rule 13 | A yearly algorithmic due diligence clock in the SDF workspace |
| Erase when the purpose is no longer served | s.8(7) | Dataset records to plan erasure and retention against |
What the inventory does not settle
TruePrivacy records models, datasets and your assessments. Whether a model's use of personal data fits the notice and consent you hold, and how you erase data a model has already used, are questions for your team and counsel.
The AI systems guide walks through notices, consent and erasure for AI use.
Works with
Does the DPDP Act apply to AI training?
If personal data is used to train or run an AI system, that use is processing under the Act, so notice, consent or a legitimate use, and the other duties apply. Check specific cases with counsel.
What does Rule 13 say about algorithms?
Rule 13 asks a Significant Data Fiduciary for due diligence that algorithmic software does not risk Data Principals' rights.
What does the AI inventory record?
The AI models and datasets you use, with assessments.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin