AI Governance Frameworks — What Indian Agencies Are Actually Building Internally Post-DPDP - Agency Reporter

Indian advertising agencies are developing internal AI governance frameworks rather than relying on informal experimentation. These frameworks translate broad principles into everyday decisions for creative, planning, account, production and technology teams. Their purpose is to make AI useful without weakening confidentiality, intellectual property, consumer trust or data protection.

A working framework can specify approved tools, prohibited uploads, access rights, retention and deletion practices, and review requirements. For example, an agency might allow AI brainstorming for a fictional campaign but restrict uploading a client database or confidential pitch deck. It can also require people to check generated copy, images and claims before publication.

There is no single publicly established template used by every Indian agency. Controls will vary by agency size, clients, infrastructure and external partnerships. Still, the direction is clear: AI governance must operate inside workflows, not remain a policy document reviewed only after campaign work is complete.

The article identifies at least six specific advertising workflow activities affected by AI. Teams use it to explore creative territories, draft copy, develop visual references, analyse audience behaviour, automate reporting and accelerate production. More broadly, AI is moving into campaign conception, production and delivery, making it part of everyday agency work.

For example, one team might use generative AI to suggest campaign routes, create draft language and develop image references. Another might analyse audience behaviour and automate performance reporting. These are different uses, with different risks, especially when identifiable consumer information or client material enters the workflow.

The article does not give a percentage or fixed total for AI’s reach across agencies. Its list shows the technology already touches multiple stages and functions. Governance therefore needs to cover the whole workflow, rather than treating AI as only a creative-production tool.

Agencies need controls that turn responsible AI principles into clear daily instructions. These include a list of approved tools, rules for what information may be uploaded, access permissions, retention and deletion practices, and defined reviewers. The framework should also identify when human judgement must override or check machine-generated output.

For example, employees might be allowed to use an approved model for fictional brainstorming but barred from uploading a confidential pitch deck or client database into a free application. Generated copy, images and product claims could require review by designated creative, account, legal or subject specialists before client delivery or publication.

The article presents these controls as operational preparation, not an end-stage legal formality. Privacy compliance should influence how data enters an AI workflow and who can access outputs. Agencies also need controls for copyright, confidentiality, cybersecurity, advertising standards and synthetic content authenticity.

The Digital Personal Data Protection Act, 2023, focuses on processing digital personal data. It does not regulate every use of AI merely because artificial intelligence is involved. Its relevance depends on the information being processed and the agency’s role in handling it. That role may involve processing data for a client, determining purposes and means itself, or participating in a vendor chain.

Using AI to brainstorm a fictional campaign is different from using it to analyse identifiable customer profiles or generate personalised messages from identifiable records. The latter can raise obligations involving lawful processing, notice, consent where required, purpose limitation, security and responsibility among parties handling the data.

The DPDP Rules, 2025, were notified in November 2025 with phased implementation. Agencies must distinguish provisions already in force from later requirements and prepare operations accordingly. Privacy work should begin when data enters an AI workflow, not only at campaign review.

Uploading personal data or confidential client material into an unapproved AI application can create risks beyond ordinary technology failure. The information may be processed outside the organisation’s approved environment, and the agency may face questions about lawful processing, security, purpose limitation, access and retention. Client confidentiality and intellectual property can also be affected.

The article gives two clear examples. An employee might place a confidential pitch deck into a free application without knowing the information could be retained or processed externally. Separately, a chatbot could produce a misleading product claim, while an AI image might unintentionally resemble copyrighted work. Each case requires review of different risks and controls.

The article does not state a specific penalty or enforcement outcome. It does establish that these incidents can affect data protection obligations, brand reputation, consumer trust, copyright, contractual confidentiality, cybersecurity and advertising standards. Approved tools and human checks reduce the chance of unmanaged exposure.

An AI system does not replace organisational responsibility when a campaign contains a misleading claim, copyright problem, privacy breach or harmful depiction. The article argues that internal governance must assign accountability and define when human judgement takes precedence over generated output. Responsibility should therefore be built into the workflow before publication.

For example, an agency can designate reviewers for copy, images, product claims and data use. If a model produces a questionable claim, a person should stop it from reaching the client or public until it is checked. If client data is involved, the agency must also examine whether it acts for the client, determines processing itself or works within a vendor chain.

The article does not name one universal accountable role. Agencies differ in structure and partnerships, so responsibility depends on the actual arrangement. A credible framework makes ownership visible across creative, account, planning, production, technology and leadership teams.

Data protection is only one part of responsible AI use because an agency’s risks do not arise solely from personal information. An AI-generated image may resemble copyrighted work. A model may produce a false product claim. A confidential pitch deck may leave an approved environment. Synthetic content may also raise questions about authenticity. These issues can affect clients, consumers and brands even when personal data is absent.

For example, an agency could use AI to create a fictional visual without personal data, yet still need to check intellectual property and authenticity. If it analyses identifiable customer profiles, privacy obligations are added. If the output promotes a product, advertising and consumer-protection concerns may also apply. Human review connects these checks before publication.

The article therefore presents DPDP compliance as necessary but incomplete. Agencies need a framework covering privacy, copyright, contractual confidentiality, cybersecurity, advertising standards, consumer protection and synthetic content. This broader approach helps governance match the real range of agency workflows.