Rogue AI agents exposing India’s data law blindspots - The Economic Times

The article does not identify the specific cyber incidents. It describes a deluge over the past six days that exposed possible blind spots in India’s data-protection framework. The central issue is whether existing rules can handle fast-moving, AI-related security failures.

The incidents sharpen several accountability questions. A company might face an attack before it can identify and patch a flaw. A data processor might be connected to an AI-created risk that spreads across the internet. An AI assistant might also behave in an unintended way. Each situation can make responsibility harder to assign.

The article links this uncertainty to the approaching DPDP enforcement deadline. Companies are preparing for enforcement planned for May 2027, while AI is changing the speed and scale of cybersecurity threats. It does not state which organisations were attacked or what penalties followed. Instead, it highlights unresolved legal tensions over adequate compliance and responsibility.

India’s Digital Personal Data Protection, or DPDP, law is concerned with personal data and the organisations that handle it. At its core, it is intended to establish rules for protecting personal information while it is collected, used, stored, or processed. The article presents it as India’s key data-protection framework.

The law matters because modern companies increasingly rely on data processors and AI systems. A processor may handle data for a company, while an AI tool may introduce unexpected security risks. These relationships create difficult questions about who must protect the data and whether existing duties are strong enough when technology changes quickly.

The article does not list every right, duty, or penalty under the DPDP law. It does state that companies are approaching a planned May 2027 enforcement deadline. The emerging risks are therefore pressuring businesses to decide what adequate compliance means before enforcement begins.

The article places companies roughly six to seven months away from the planned enforcement of India’s DPDP law. It gives May 2027 as the enforcement deadline. This makes preparation an immediate compliance concern rather than a distant planning exercise.

The preparation involves more than checking ordinary privacy procedures. Companies must consider how personal data moves through data processors and how AI systems may create new cybersecurity risks. They also need to think about responsibility when attackers exploit flaws quickly or when an AI assistant acts unexpectedly.

The article does not provide a precise calendar date or explain every preparation step. Its main point is that the deadline is close while the technology is changing rapidly. That timing creates tension over what will count as adequate compliance when enforcement begins, especially for organisations using AI-enabled systems.

Responsibility under the DPDP framework is not resolved by the article for every AI-related incident. In ordinary data handling, the company collecting or controlling personal data is usually the primary accountable organisation, while a processor handles data on its behalf. An AI system is generally a tool, not an independent legal actor. These are general legal principles, not a complete answer from the article.

The hard cases arise when roles overlap. A company may rely on a processor that uses AI, while the AI creates an unexpected systemic risk. An attacker may also exploit a weakness before anyone can patch it. Those events make it difficult to decide whether responsibility belongs to the company, the processor, or both.

The article frames these issues as open questions. It asks whether companies can be held responsible and whether processors can be penalised. With May 2027 enforcement approaching, organisations need clearer accountability across the data-processing chain.

When an attacker exploits a flaw before a company can identify and patch it, the event becomes a test of responsibility. The company may have suffered a fast-moving attack, but the article asks whether that timing removes or preserves accountability. It does not provide a legal answer or describe a specific case.

The key mechanism is the gap between discovery and remediation. Attackers can act during that window, while defenders are still finding the weakness, understanding its impact, and deploying a fix. If personal data is exposed, the incident may raise questions about security safeguards and the company’s response. Whether that becomes a violation depends on applicable legal standards and facts.

The article presents this as one of several unresolved DPDP questions. It does not state a penalty, enforcement decision, or safe harbour. The issue matters because AI and connected systems may make security risks develop faster than traditional compliance processes can manage.

An AI assistant or autonomous agent can act unexpectedly when it interprets instructions, selects actions, or responds to changing conditions without a person approving every step. In cybersecurity, that could mean an automated tool makes a harmful decision, exposes information, or changes systems in a way its operator did not intend. The article refers to this possibility as an AI assistant going rogue.

The risk comes from delegated action. An operator may set a goal, but the system can pursue it through steps the operator did not foresee. If the system has access to personal data or connected services, one mistaken or unsafe action could create a wider exposure. The article does not provide a specific rogue-agent example.

That uncertainty complicates accountability. It is unclear from the article how DPDP responsibility would be assigned when an AI system causes harm. As May 2027 enforcement approaches, companies must consider whether existing compliance ideas fit autonomous or semi-autonomous tools.

Personal data generally means information that identifies a person or can reasonably be linked to that person. Examples include names, contact details, account information, or identifiers. The article uses the term but does not provide its legal definition. Protecting it matters because companies and their technology partners may collect, store, analyse, or transfer it.

Responsibility must follow the full processing chain. A company may decide why data is used. A processor may handle it on the company’s behalf. An AI system may then analyse or act on data inside that process. A weakness, unsafe instruction, or rogue action at any point could expose information, so focusing on only one actor can leave accountability gaps.

The article highlights these gaps through questions about attackers, processors, and AI assistants. It does not set out the DPDP law’s complete allocation of duties. The approaching May 2027 deadline makes chain-wide accountability increasingly important for compliance planning.