DPDP-Aligned AI Data Handling Assessment

• Data Protection Officer
• Chief Compliance Officer
• CISO
• Head of Data and AI

AI features copy personal data into places privacy programmes were not built for: prompts sent to model providers, conversation logs, vector stores, evaluation datasets and call transcripts. Under the DPDP Act 2023, a fintech remains responsible as data fiduciary for that data wherever its processors handle it. Most teams cannot yet show where it goes, how long it stays or whether an erasure request reaches it.

We assess your AI features against the data handling duties in the DPDP Act 2023, working alongside your DPO and legal counsel. We trace personal data through each AI system: what is collected, which prompts and tools receive it, where it is logged, embedded, cached or sent to a provider, how long it is kept and who can access it. We test the controls instead of only reading policies: redaction, access controls, retention jobs and whether a seeded erasure request removes data from every AI store. You receive a data-flow map, a gap register mapped to DPDP obligations with owners and priorities, and an evidence pack your compliance team can maintain.

• Data-flow mapping across prompts, retrieval indexes, logs, transcripts, evaluation sets and model providers
• Notice and consent review: whether AI uses match the purposes customers were told about
• Control testing for redaction, access, retention and deletion, including a seeded erasure request
• Model provider and processor review covering retention, training use and hosting location
• Breach-readiness check on detecting and scoping a leak from an AI system
• Gap register and evidence pack mapped to DPDP obligations for your DPO

1. 01Scope AI systemsWe list AI features, internal copilots and vendor tools that touch personal data, with an owner for each.
2. 02Trace data flowsThrough interviews, configuration review and logs, we map personal data from collection to every AI store and processor.
3. 03Assess against obligationsEach flow is checked for notice and consent, purpose, minimisation, security safeguards, retention and data principal rights.
4. 04Test controlsWe test redaction, access and retention, and run a seeded erasure request to see which stores it reaches.
5. 05Record gapsGaps are logged with a risk rating, an owner and a practical fix, then reviewed with your DPO and counsel.
6. 06Assemble the evidence packThe data-flow map, test results and decisions are packaged for your DPO to maintain and report from.

1. Discovery
   • Stakeholder interviews and questionnaires
   • Configuration export from AI platforms and cloud
   • Vendor contract and terms review
2. Data-flow mapping
   • Personal data inventory per AI system
   • Map of stores and processors
3. Control testing
   • PII probes in prompts and logs
   • Seeded erasure test across stores
   • Access checks on indexes and logs
4. Assessment and evidence
   • DPDP obligation checklist
   • Gap register with risk ratings
   • Evidence pack and remediation tracker

Your DPO and legal counsel interpret the obligations and accept or adjust each gap rating. We provide technical findings and evidence; we do not give legal opinions.

• Cloud platforms such as AWS, Azure and GCP and their logging
• LLM gateways and model provider consoles
• Vector databases such as pgvector, Pinecone or OpenSearch
• Consent management platform
• GRC or privacy management tool for the gap register

• Testing uses synthetic or seeded records, not real customer data
• Read-only configuration access unless a specific test is agreed
• Findings framed as technical evidence, with legal interpretation left to your counsel
• Sensitive findings shared only through an access-controlled channel

• Structured around DPDP Act 2023 duties such as notice, consent, purpose limitation, reasonable security safeguards, breach intimation and data principal rights, with the DPDP Rules phasing in detailed requirements.
• This is a technical assessment, not legal advice, and is designed to support your DPO and counsel.
• Can be extended to GDPR for EU customers and to RBI's direction on storage of payment system data.

• Fintech & Payments

  Pre-Launch Security Assessment for LLM Features

  Test a new chatbot, copilot or LLM feature for prompt injection, cross-customer data leakage, off-policy answers and unsafe output handling before release, with evidence and a retest.

• Fintech & Payments

  AI Agent Permission and Tool-Use Security Review

  Find out what your AI agents can actually do: which tools, credentials and money-moving actions they reach, where approvals sit, and whether injected text can make them misuse tools.

• SaaS & AI Product Companies

  RAG Data-Leakage and Access-Control Testing

  Test whether your RAG pipeline leaks documents across users, roles or tenants through retrieval, caching, citations or logs, using seeded canary documents and role-based test personas.

• Telecom & Contact Centres

  Compliance Evidence for AI Calling (TRAI and DPDP)

  Test and document how your AI calling handles consent, DND preferences, calling hours, disclosures, opt-outs and personal data, and give compliance teams and clients an evidence pack.