Privacy, Copyright, and Trade Secret: The Growing Conflict Between Personal Data Rights and AI Training in India - Nasscom

AI systems need enormous datasets, but those datasets often include personal information and copyrighted material. India’s DPDP Act, 2023, and DPDP Rules, 2025, seek to strengthen privacy rights and regulate how personal data is collected, processed, and stored. They emphasise consent, purpose limitation, and transparency.

AI developers commonly use publicly available material, including articles, social media posts, customer records, reviews, and behavioural patterns. Public availability does not automatically resolve whether personal data may be collected and reused for model training. Individuals may argue that such use lacks consent or exceeds the original purpose.

The tension is especially sharp when AI systems affect loans, jobs, insurance, healthcare, surveillance, or content moderation. Companies may face demands to explain decisions or comply with privacy duties, while protecting confidential technology. The article presents this as a larger challenge: allowing AI innovation without weakening privacy rights.

The Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025, are designed to regulate personal data throughout its handling. Their purpose is to strengthen privacy rights and place clearer responsibilities on organisations that collect, process, or store such information. The framework reflects the idea that people should have meaningful control over their data.

The article connects these rules to consent, purpose limitation, and transparency. Organisations may not be able to treat personal information as freely reusable simply because they possess it. The rules also strengthen obligations for organisations classified as Significant Data Fiduciaries, based on factors such as data volume, sensitivity, and risks to individuals’ rights.

These requirements matter for AI companies because training and operating models can involve large amounts of personal data. Systems used in lending, hiring, insurance, healthcare, surveillance, and content moderation may affect people directly. The framework therefore raises questions about lawful data use, access, explanations, and accountability.

Large language models rely on massive datasets because broader data can strengthen a model. The article describes these sources as publicly available information collected at very large scale. It does not give a numerical size, but it stresses that AI developers need enormous quantities of data to train machine-learning systems.

The material can be highly varied. Examples include articles, social media posts, customer records, reviews, and behavioural patterns. Some sources may contain personal data, while others may contain copyrighted content. A single dataset can therefore combine ordinary public material with information linked to identifiable people or protected creative works.

That mixture creates legal uncertainty. Public availability does not answer whether personal information was used with consent or for a compatible purpose. Copyright questions also arise when protected content is copied or processed during training. The article identifies this overlap as a central conflict between AI development, privacy law, and copyright principles.

A Significant Data Fiduciary, or SDF, is an organisation designated because of the volume and sensitivity of its personal-data processing, risks to individuals’ rights, or effects on democracy and public order. The DPDP Rules, 2025, strengthen obligations for such entities. The article links these duties to greater accountability for high-impact data use.

The issue becomes concrete when an AI system denies a loan, rejects a job application, or flags someone for fraud detection. Similar concerns arise in insurance, healthcare, surveillance, and content moderation. An affected person may seek an explanation rather than accept an unexplained automated outcome. Meaningful access rights may require information about the logic involved.

This does not necessarily mean publishing an entire model. The article’s proposed middle path includes outcome-based explanations, regulator or auditor access, and confidential algorithmic audits. The aim is to make powerful systems accountable while avoiding unnecessary disclosure of proprietary technology.

A trade secret is confidential commercial information that gives a business value because it is not generally known. The article says Indian law protects such information through contracts, equity principles, and judicial recognition. It cites American Express Bank Ltd. v. Priya Puri and Zed Telefilms Ltd. v. Sundial Communications Pvt. Ltd. as examples of protected commercial confidentiality.

An AI company may rely on private model structures, training methods, algorithms, or decision rules. If privacy compliance requires detailed disclosure of the logic behind a loan denial or fraud flag, that explanation could expose commercially valuable information. Competitors might learn how the system operates or reproduce important features.

This creates what the article calls “forced transparency.” The company may need to satisfy an individual’s access or explanation rights while protecting confidential technology. The proposed solution is regulated disclosure: share suitable information with regulators or certified auditors, under confidentiality, without exposing source code publicly.

If an AI company uses personal data without satisfying consent, purpose limitation, or transparency requirements, it may face non-compliance penalties. The article describes a legal conflict in which companies could be forced to choose between revealing proprietary logic to meet access duties and facing penalties for refusing. The exact penalty amounts are not provided.

The same concern extends to copyrighted material used in training. AI developers may argue that copyright principles permit their practices, but the supplied article ends before explaining its fair-dealing analysis. It therefore does not state specific copyright penalties or outcomes. Any conclusion about those consequences would require additional legal details.

The immediate implication is uncertainty for AI developers using mixed datasets. They may need stronger consent records, clearer purposes, careful data governance, and protected audit processes. The article proposes regulated disclosure, outcome-based explanations, and statutory safe harbour for compliance disclosures, while leaving copyright consequences unresolved.

Copyright fair dealing is a legal principle that can permit limited use of copyrighted works for recognised purposes, subject to the applicable law and circumstances. It concerns the lawful use of creative expression. The supplied article introduces this principle in its heading but does not explain its tests, permitted purposes, or application to AI training.

Purpose limitation is different. It is a privacy principle requiring personal data to be collected for a specified purpose and not reused incompatibly. For example, information gathered for one stated reason may not automatically be repurposed for model training. The focus is the person’s data and the reason for processing it.

The two principles can overlap when a dataset contains both copyrighted material and personal information. Fair dealing may address copyright use, while purpose limitation addresses data governance. Satisfying one does not automatically satisfy the other. The article presents this overlap as a major unresolved issue for AI developers.