Make Enterprise AI DPDP-Compliant
At the Infrastructure Layer

DPDP enforcement is phased. The Data Protection Board was constituted on 13 November 2025. The Consent Manager regime activates 13 November 2026. Substantive duties (security safeguards, data principal rights, breach notification, algorithmic diligence) enforce from 13 May 2027.

You're a Data Fiduciary if your business determines the purpose and means of processing personal data of Indian residents, regardless of business location. A Significant Data Fiduciary (SDF) is notified by the Central Government based on data volume, sensitivity, and risk to Data Principals. No SDFs notified yet. Banks, healthcare providers, and major internet platforms are widely expected to be first.

Rule 13(3) requires SDFs to verify that their AI systems (including algorithmic software) are not likely to threaten Data Principal rights. In practice this means demonstrable safeguards against prompt injection and adversarial attacks, data leakage protection, and proof that access, correction, and erasure rights can still be honoured across the AI surface.

Usually yes. On the free tier, yes. There's no data processing agreement with OpenAI, no consent from the customer for AI processing, and no technical safeguards on the data being pasted. That fails Section 6, Section 8(2), and Section 8(5) simultaneously. Enterprise ChatGPT with a DPA closes the processor-contract gap, but it still isn't safe. Once unmasked customer data has been pasted into an LLM, you can't reliably honour a Data Principal's right to erasure under Section 12. The data may persist in vendor logs, caches, or model context you don't control. The only clean answer is to keep personal data out of the LLM in the first place.

Yes, if the prompt contains personal data. Section 16 permits cross-border transfer except to countries on a government-notified negative list. Even where permitted, sector restrictions apply (RBI for banking data, MeitY for sensitive personal data), with auditing obligations that don't apply in-country.

Existing tools weren't built for the AI prompt layer. Privacy GRC platforms track policies and produce compliance reports, but they don't act on a live prompt. Privacy vaults tokenize data at rest, but by the time a prompt is being assembled, that data is already decrypted. Most AI gateways use regex pattern matching: they can detect sensitive content and block the prompt, but they can't safely let it through. Mavs AI operates at the prompt level. It understands the context and meaning of each prompt, accurately transforms personal data into synthetic equivalents, and lets the prompt continue to the LLM. Productive output, with your data never reaching third-party LLMs.

Yes. Rule 6 enumerates the safeguards: masking or encryption, access control, logging and monitoring with one-year retention, continuity, and a cascade to processors. Mavs AI implements each for AI surfaces: synthetic substitution at the prompt boundary, role-based access, immutable per-prompt audit trails, processor cascade. Each safeguard maps to its Rule 6 provision in the DPA.

Mavs deploys inside your perimeter, on-premises or in your VPC. Original data and the substitution mapping never leave your environment, meeting Section 16 cross-border obligations by design. Options: proxy-mode integration (no code changes), SDK for embedded use, browser plugin for employee LLM use, and native enterprise AI platform connectors. Most enterprises go live in two to four weeks.