AI Data governance in India: Building the controls that DPDP, RBI, and SEBI now expect

The world has shifted from asking, “What can AI do?” to “What should I do?” Today, the question confronting everyone is not related to AI capabilities but AI ethics and governance. India is no exception to this new development.

The days when Indian regulators treated AI as a technology question are over. They are, just like the world over, treating it as a data question. The Digital Personal Data Protection Rules, the Reserve Bank of India’s FREE-AI framework, and the Securities and Exchange Board of India’s AI/ML guidelines all point to one conclusion: AI data governance in India is no longer another tick box on a long checklist. Rather, it has emerged as an operating requirement.

Every one of these frameworks starts from the same premise. An AI system is only as accountable as the data it is trained on. Boards that cannot show where training data came from, who accessed it, and how a model behaved will struggle to satisfy any of the three regulators. That gap is why AI data governance has moved from a compliance checklist to a board-level priority across banking, capital markets, and enterprise India.

This blog maps the controls that DPDP, RBI, and SEBI now expect from Indian organizations deploying AI. It also lays out a practical path for building those controls, starting with data discovery and ending with continuous, audit-ready compliance.

Why AI data governance has become a boardroom mandate

AI models learn from data most organizations never fully mapped. Customer records, transaction logs, emails, and support tickets are used in training pipelines without a clear inventory of what left the source system. That blind spot is precisely what India’s new AI governance guidelines were built to close.

Three regulators, one data problem

DPDP governs how personal data gets collected and processed. RBI governs how regulated financial entities deploy AI on top of that data. SEBI governs how market participants use AI and ML models that touch investor information. The three frameworks were written separately, yet they converge on nearly identical demands: know your data, control access to it, and prove that AI systems built on it behave as intended.

For an Indian C-suite audience, this convergence changes how compliance programs should be structured. Treating DPDP, RBI, and SEBI as three separate workstreams duplicates effort and leaves gaps between them. A unified AI data governance program, anchored in continuous data discovery, satisfies all three at once.

The cost of waiting

Regulatory patience is thinning. The DPDP Rules were notified in November 2025 with a staggered enforcement timeline, RBI’s FREE-AI report set expectations for board-approved AI policies within the next reporting cycle, and SEBI’s consultation closed in July 2025 ahead of formal guidelines. Organizations that start building AI data governance controls now will spend the next enforcement wave demonstrating maturity. Those that wait will spend it explaining gaps.

The DPDP act and rules 2025: The Foundation layer

Under the DPDP Act and the notified DPDP Rules, organizations operating as Data Fiduciaries face rigid operational requirements regarding personal data processing. When feeding user data into machine learning models or Large Language Models (LLMs), processing must adhere to explicit, purpose-bound consent.

Significant Data Fiduciaries (SDFs) are subject to heightened duties, including mandatory Data Protection Impact Assessments (DPIAs), independent data audits, and strict data localization provisions.

Consent, purpose limitation, and AI training data

Consent under DPDP must be specific, informed, and tied to a stated purpose. That requirement collides directly with how AI training pipelines often work, where data collected for one purpose gets repurposed to train a model for another. Registered consent managers now sit between data principals and data fiduciaries, giving individuals a single interoperable point to grant, review, and withdraw consent. Any AI data governance program built after DPDP must map every training dataset back to the consent that authorized it.

Purpose limitation also forces a harder conversation inside product and data science teams. Data gathered during onboarding cannot quietly become fuel for a recommendation model without a fresh legal basis. This is where most Indian enterprises discover they have no reliable map of what data lives where, a gap that data discovery tools were built to close.

Significant data fiduciary obligations for AI systems

Organizations classified as significant data fiduciaries carry a heavier load. Rule 13 requires annual data protection impact assessments, independent audits, and verification that algorithms and software used for processing personal data do not cause harm to data principals. These entities must also restrict certain categories of personal data and related logs from leaving India unless the government permits the transfer.

For any organization running large language models or recommendation engines on Indian user data, the algorithm-harm verification requirement is the clause to watch. It effectively mandates ongoing model risk assessment as a data protection obligation. Building that verification into an AI data governance program early avoids a scramble once enforcement begins.

RBI’s FREE-AI framework: What banks and NBFCs must build

RBI released its Framework for Responsible and Ethical Enablement of Artificial Intelligence in August 2025, built around seven guiding principles that the committee called sutras. Trust, People First, Innovation over Restraint, Fairness and Equity, Accountability, Understandable by Design, and Safety, Resilience and Sustainability now anchor RBI AI compliance expectations for every regulated entity, from banks to NBFCs to payment operators.

The seven sutras applied to data controls

Each sutra translates into a concrete data control. Trust requires documented data lineage. Fairness and Equity requires bias testing on training datasets before deployment. Accountability requires a named owner for every AI system, tied back to the data it consumes. Understandable by Design requires that data used in credit decisions can be explained to a regulator and, eventually, to the customer affected.

RBI’s survey work found that only about 20.8 percent of regulated entities had AI systems in production for functions like credit underwriting and customer support, while a much larger share expressed concern about governance gaps. That gap between adoption and governance readiness is exactly where AI data governance programs need to focus first.

Board-approved AI policy and incident reporting

FREE-AI expects regulated entities to adopt board-approved AI policies covering governance, lifecycle management, and vendor oversight, alongside a tiered incident reporting system for AI failures such as bias, explainability gaps, and unintended outcomes. This incident reporting obligation sits on top of RBI’s existing cybersecurity framework for banks, which already mandates continuous monitoring and structured incident disclosure.

For a bank or NBFC, this means the data team, the model risk team, and the board reporting process must connect. A model that drifts and produces biased credit decisions is no longer just a technical bug. It is a reportable AI incident with a data governance root cause that the board must be able to trace.

SEBI’s AI Guidelines: Accountability for market participants

SEBI released its consultation paper on responsible AI and ML usage in June 2025, targeting exchanges, brokers, mutual funds, and other intermediaries that already rely on AI for KYC, order execution, and surveillance. SEBI AI guidelines rest on the same accountability logic as RBI and DPDP, applied to securities markets instead of banking or personal data broadly.

Model governance and vendor oversight

The paper places strict, non-delegable senior management accountability across the entire AI lifecycle, meaning a regulated entity stays liable for an AI system’s behavior regardless of whether the tool was built in-house or licensed from a vendor. That single clause raises the bar for every Indian brokerage or asset manager that outsources model development, because contract language alone will no longer transfer accountability for data misuse or model failure.

Firms deploying AI must maintain skilled internal teams for human oversight, establish fallback plans for when a model fails, and negotiate strong agreements with third-party vendors. Investor protection provisions also require plain-language disclosure whenever AI materially shapes an investment decision or recommendation.

Cybersecurity and cyber resilience framework ties

SEBI’s existing Cybersecurity and Cyber Resilience Framework already requires market infrastructure institutions to run security operation centers and submit regular compliance reports. AI-driven trading algorithms and surveillance systems fall squarely inside that framework, linking automation directly to accountability for market integrity. Any AI data governance program for a SEBI-regulated entity therefore needs to sit inside, not beside, the existing cybersecurity compliance structure.

Building the control stack: From discovery to governance

Reading the three frameworks side by side reveals a shared sequence of controls. Every regulator expects an organization to know its data before it can govern the AI built on top of it.

Data discovery and classification comes first

None of the three frameworks can be satisfied without a live inventory of sensitive data across cloud, SaaS, and on-premises systems. Manual spreadsheets cannot keep pace with data that AI pipelines pull, transform, and duplicate continuously. Organizations need continuous discovery and classification that extends into AI data stores themselves, not just traditional databases.

Managed DSPM as the operational backbone

This is where managed DSPM earns its place as the operational backbone of AI data governance. Data security posture management tools discover sensitive data, classify it by risk, and flag excessive access before that exposure reaches an AI model. Extending DSPM to cover AI training sets and inference data closes the exact blind spot that DPDP, RBI, and SEBI all describe. Gruve’s approach to this problem applies continuous discovery and exposure analysis across both traditional and AI data stores, so overexposed data gets found regardless of whether a person or a model is consuming it.

Continuous compliance over point-in-time audits

A point-in-time audit satisfies a regulator for a single moment. AI systems retrain, ingest new data, and drift within weeks. Continuous compliance monitoring, evidence that stays current rather than a report generated once a year, is what holds up against RBI’s tiered incident reporting and SEBI’s ongoing cybersecurity obligations. Programs like Gruve’s continuous compliance monitoring service exist precisely to keep that evidence current between audit cycles.

A Practical roadmap for Indian C-Suite leaders

Building AI data governance from scratch feels overwhelming only if it gets treated as one large project. Broken into phases, it becomes a manageable, sequenced program that most enterprise security and compliance teams can execute within a year.

Short-term actions: Zero to six months

Start with a full data discovery exercise across cloud, SaaS, and AI data stores to understand what personal and sensitive data exists. Map every active AI use case back to its data source and the consent or legal basis that authorizes it. Stand up a board-level AI policy that names an accountable owner for every production model, satisfying RBI’s Accountability sutra and setting the foundation for SEBI’s senior management liability requirement.

Medium-term actions: Six to eighteen months

Move from discovery to continuous monitoring by deploying data security posture management that covers AI pipelines, not just traditional databases. Build a tiered AI incident reporting process modeled on RBI’s expectations, then extend it to cover DPDP and SEBI triggers so one process serves all three regulators. Formalize vendor oversight agreements for every third-party AI tool, closing the non-delegable liability gap that SEBI’s framework highlights. Organizations that want structured support at this stage can explore Gruve’s privacy and AI governance readiness service, built specifically around what comes after initial DPDP compliance.

By the time these two phases are complete, an organization holds a data governance program that satisfies DPDP’s data protection impact assessments, RBI’s board-approved AI policy requirement, and SEBI’s model governance expectations from a single, continuously updated evidence base rather than three disconnected compliance efforts.

Conclusion

AI data governance in India will keep tightening. DPDP enforcement is staggered but active, RBI has already published enhancements to its master directions for AI, and SEBI’s consultation is expected to convert into binding guidelines. The organizations best positioned for that shift are not the ones with the most AI models in production. They are the ones that can show, at any moment, exactly what data feeds those models and who is accountable for the outcome.

That capability does not come from a compliance document sitting in a shared drive. It comes from data discovery, access governance, and continuous monitoring working together as one program. Boards that build that program now will spend the next regulatory cycle demonstrating readiness instead of explaining gaps.

To see how a unified data foundation supports that readiness across DPDP, RBI, and SEBI obligations at once, explore Gruve’s governance, risk, and compliance services.