AI Laws in India
India has not enacted a standalone AI statute. AI is governed indirectly through the Digital Personal Data Protection Act, 2023 — passed in August 2023, with its implementing Rules notified in 2025 and commencing in phases — which sets consent, purpose-limitation and breach-notification duties (with penalties up to ₹250 crore) that apply to any personal data used to train or run AI. The older Information Technology Act, 2000 and the 2021 IT Rules cover intermediary liability and have driven MeitY advisories requiring labelling of AI-generated and deepfake content. A promotion-first IndiaAI Mission and NITI Aayog's voluntary 'Responsible AI' principles guide policy, and a 'Digital India Act' to replace the IT Act has been signalled but is not yet law.
Applicable laws
Penalty: DPDP Act: data-protection penalties up to ₹250 crore (~US$30M) per instance
High-risk industries to watch in India
US-based? Check your state laws too
If you're a US company serving India customers, you need to comply with both your state's AI laws and India regulation.
Sources verified against official .gov filings · Last verified Jun 18, 2026.
- ↗meity.gov.inhttps://www.meity.gov.in/data-protection-framework
- ↗prsindia.orghttps://prsindia.org/billtrack/digital-personal-data-protection-bill-2023
- ↗indiaai.gov.inhttps://indiaai.gov.in/