If your AI chatbot ever sees a customer’s name, phone number, order details, or anything else that identifies a real person, India’s Digital Personal Data Protection (DPDP) Act likely applies to you. This isn’t a niche compliance detail — it’s relevant to nearly every business chatbot, because “answers customer questions” almost always means “handles personal data.”
This is a plain-language overview, not legal advice — talk to a lawyer for anything you’re relying on for actual compliance decisions.
Why a chatbot puts you in scope
Under the DPDP Act, a business that processes personal data is a “Data Fiduciary” — and that comes with real obligations: giving notice about what’s collected, having a lawful basis for processing it, keeping it secure, not holding onto it longer than needed, and being able to respond if something goes wrong. A chatbot processing customer messages does exactly the kind of processing this covers.
What this actually requires in practice
- Clear notice — customers should be able to find out what data your chatbot collects and why, not have it buried or unmentioned.
- A real reason for collecting each piece of data — not “we might use it someday.”
- Retention limits — not keeping conversation history indefinitely with no reason.
- Separate consent for anything beyond the immediate purpose — using chat logs to train a model, for example, isn’t automatically covered by the consent to use the chatbot itself.
- A way to respond to a breach or a data request — an actual process, not something figured out after it’s needed.
Questions worth asking any AI chatbot vendor
- Where is customer conversation data stored, and for how long?
- Is data used for anything beyond answering that specific customer — training, analytics, or otherwise — and is that separately disclosed?
- Who has access to conversation history, and how is access controlled?
An AI agency that hasn’t thought through these questions probably hasn’t thought through your compliance exposure either.
Where this fits
This applies across everything we build — WhatsApp Business AI, AI agent development, and AI voice agents all handle customer data, and how that data is stored and used is a fair question to ask about any of them. Ask us directly if you want specifics for your setup.