India, AI, and the data privacy reckoning: How DPDP could ignite innovation

By Anshu Sharma, Co-founder & CEO, Skyflow 

India is one of the world’s fastest adopters of AI, and according to a recent study from the Boston Consulting Group (BCG), it leads the world in enthusiasm for generative AI. Enterprises in India are building faster, deploying smarter, and automating more than ever before.

But there’s a growing challenge that can’t be ignored: Training AI and building agentic workflows requires massive amounts of data. And increasingly, that data is personal, regulated, and sensitive. At the same time, India has witnessed a dramatic increase in data breaches over the last few years, exposing sensitive information from government, banking, healthcare, and telecom sectors.

This creates a deep tension between innovation and privacy: how can companies ensure that the sensitive data they collect will be protected end to end, that it was given with consent, and that it will be managed and secured?

The Digital Personal Data Protection (DPDP) Act of India, a comprehensive governmental law to enforce data privacy protections, was developed to ensure just that. DPDP isn’t just another regulation – it’s a signal that the way we build systems and govern data needs to change, and that privacy and security must be built into the foundations of our products, not bolted on as an afterthought.

Security & Privacy Are Not a Trade-Off – They’re the Foundation

AI doesn’t just store data – it processes it, transforms it, learns from it, and builds upon it. That means it’s harder to track, manage, and delete, and it raises fundamental questions:

• Where is the sensitive data – and how many times has it been replicated?
• Who or what has accessed it?
• Which AI system or agent used it last, and under which policy?

Security techniques like authorization, access control, RBAC, and encryption at rest are patchwork solutions that were designed for another era. They were hardly sufficient at protecting data before AI, and they’re certainly not going to cut it in the age of AI.

What we need now is a purpose-built privacy and governance layer that understands agents, apps, and data flows.

AI Makes Privacy Harder and More Urgent

AI can do incredible things like accelerate support, improve diagnoses, and streamline back-office operations. But behind every one of these breakthroughs is access to a large and often sensitive data set.

The risk is that once sensitive, personal data is ingested by a model, it’s difficult if not impossible to remove. If it’s used even once during fine-tuning, the data could be permanently encoded. That’s not just a technical concern; it’s a regulatory and ethical concern, too.

DPDP aims to address this risk by enforcing clear rules around consent, purpose limitation, data minimization, and localization. It requires organizations to know who is using which data, for what purpose, and under what permissions.

DPDP isn’t just a checkbox for compliance. It’s a foundation for trust, and ultimately for innovation.

Building AI on a Foundation of Privacy

Imagine this: A healthtech startup in Bangalore is building an AI assistant to help manage chronic illnesses. They need data to train the model, sure. But do they really need names, addresses, or raw medical records? Could they train on protected, tokenized data instead?

This is what modern privacy infrastructure makes possible.

At Skyflow, we believe companies need a dedicated privacy layer—a zero-trust vault that isolates and governs PII by default, putting privacy at the foundation of innovation. With Skyflow, companies can run powerful AI workflows, without ever exposing raw sensitive data. That’s what compliance-first, privacy-by-architecture looks like.

In today’s AI-powered world, the priority must be protecting the data itself. That means:

• Tokenizing and encrypting sensitive data before it reach downstream tools
• Auditing access at the agent, user, and API level
• Controlling usage through dynamic, policy-based consent and access frameworks
• Governing application and analytical systems
• Ensuring continued usability of protected data in agentic workflows, analytics, and other applications

The DPDP Act accelerates this shift to privacy-by-design architecture, ensuring that companies can innovate responsibly.

India’s DPDP Act: Not Just Regulation – A Platform Shift to Ignite Innovation

We’re still early in the AI revolution, but the landscape is shifting quickly. Regulatory expectations are increasing, and the cost of a breach has never been higher.

India’s new Digital Personal Data Protection (DPDP) Act is a wake-up call, not just for Indian companies, but for anyone doing business in one of the world’s largest markets.

India has the opportunity to not just lead the world in AI adoption, but to set a global benchmark for responsible AI development, starting with treating privacy as a design principle to unlock innovation.

Rather than asking what’s the minimum we can do to comply, we should be asking: how much better could we build if privacy was embedded from the start?

Let’s stop seeing privacy as a barrier, and start seeing it as a superpower.