Current Affairs · · GS2 · Governance

AI training on public data exposes gaps in India's data protection law

Technology companies increasingly train AI models on personal data that is publicly available online. An analysis by the World Privacy Forum argues India's DPDP Act, 2023 leaves such data unprotected, has no sensitive-data category and sets no AI-specific safeguards. The Act's main duties apply only from May 2027.

Event date:

REq1
  1. Note1 / 7

    WHY IN NEWS?

    • Technology firms are using publicly available personal data to train AI models. This has raised concerns over privacy, data scraping and profiling without consent.
    • An analysis by Tulika Avni Sinha of the World Privacy Forum highlights gaps in India's Digital Personal Data Protection (DPDP) Act, 2023.
    • It flags three gaps: an exclusion for publicly available data, no separate sensitive-data category, and no explicit safeguards for AI training.
  2. Note2 / 7

    HOW AI TRAINING CAN COMPROMISE PRIVACY

    Each risk below works differently. Notice that some arise during data collection and others after the model is built.

    RiskHow it worksExample
    Data scrapingCollects personal information without meaningful consentScraping photographs from social media
    MemorisationThe model stores and later reproduces parts of its training dataResearchers extracted GPT-2 training data (USENIX, 2021)
    Re-identificationMatches "anonymised" records back to real peopleLinking health records with location data
    Membership inferenceReveals whether a person's data was used in trainingShowing someone was in a medical dataset
    Inferential profilingDeduces sensitive traits from ordinary activityGuessing a health condition from shopping patterns
  3. Note3 / 7

    INDIA'S LEGAL FRAMEWORK

    Privacy law in India has moved from rules under the IT Act to a dedicated statute. Note the commencement dates.

    InstrumentWhat it does
    Article 21Puttaswamy judgment (2017) recognised privacy as a fundamental right
    IT Act, 2000, Section 43ACompensation for failure to protect sensitive personal data; to be omitted from 13 May 2027
    SPDI Rules, 2011Listed passwords, financial, health and biometric data among sensitive personal data
    DPDP Act, 2023Consent, accountability, and rights to correction and erasure; core duties apply from 13 May 2027
    DPDP Rules, 2025Notified 13 November 2025; set data security, breach notification and extra fiduciary duties
  4. Note4 / 7

    KEY CONCEPTS: THE REGULATORY GAPS

    1. What does the public data exclusion mean?

    Section 3(c)(ii) keeps the Act away from personal data made public by the person, or by someone legally required to publish it. A public social media post can therefore fall outside the Act's protection.

    1. Why does a missing sensitive-data category matter?

    The DPDP Act treats all personal data alike. Biometrics and health records get no higher protection than an email address, unlike under the SPDI Rules.

    1. Is AI training regulated at all?

    Not specifically. There are no dedicated safeguards against memorisation and extraction. People have no specific statutory right to object to AI training on their public data.

    1. What about research use?

    Section 17(2)(b) exempts processing for research, archiving or statistics, subject to conditions. Whether commercial AI training qualifies remains unclear.

  5. Note5 / 7

    GLOBAL EVIDENCE AND RULES

    Research has documented these risks, and other jurisdictions have begun to respond. The table lists the main markers.

    SourceContribution
    USENIX Security (2021)Showed memorised information could be extracted from GPT-2
    NIST (2025)Listed model inversion and membership inference as AI privacy risks
    UNESCO (2021)Recommendation on the Ethics of AI calls for privacy safeguards across the AI lifecycle
    EU GDPRArticle 17 gives a right to erasure; Article 21 a right to object
    EU AI ActRisk-based rules with extra duties for high-risk systems; most high-risk duties now deferred to December 2027

    Model inversion means rebuilding training data, such as a face, from a model's outputs.

  6. Note6 / 7

    IMPLICATIONS FOR INDIA

    • Individual autonomy: Profiling weakens people's control over information about themselves, for example by inferring health conditions.
    • Identity theft: Leaked data, such as biometrics, can help criminals impersonate people.
    • Democratic freedoms: Fear of surveillance can make citizens avoid voicing opinions online.
    • Algorithmic discrimination: Inferred traits can reinforce inequality, for example caste bias in recruitment.
    • National security: Exposed data can be used to profile defence personnel.
  7. Note7 / 7

    WAY FORWARD

    These are the analysis's suggestions, not adopted policy.

    • Extend DPDP safeguards to personal information scraped from public sources.
    • Create a sensitive-data class with stronger protection for biometrics, passwords and health records.
    • Let individuals opt out of specified AI-training uses.
    • Build privacy in from the start, using encryption, data minimisation and differential privacy, which adds statistical noise so no individual can be singled out.
    • Promote federated learning, where models train on devices without pooling raw data. Add machine unlearning, which removes a person's data from a trained model, and independent privacy audits.

Sources

Syllabus

PaperSubjectSub-topic
GS2GovernanceGovernance, government policies and fundamental rights
GS2PolityFundamental right to privacy under Article 21
GS3Science & TechnologyScience and technology, IT and cyber security
PrelimsPolityPolity and current events

Topics

Fundamental RightsGovernanceInformation and Communication Technology

Related previous-year questions

Asked in earlier UPSC Prelims papers on this topic. Answer, then check.

  1. UPSC Prelims 2018 · Polity · Fundamental Rights

    Right to Privacy is protected as an intrinsic part of Right to Life and Personal Liberty. Which of the following in the Constitution of India correctly and appropriately imply the above statement?

    1. Article 14 and the provisions under the 42nd Amendment to the Constitution
    2. Article 17 and the Directive Principles of State Policy in Part IV
    3. Article 21 and the freedoms guaranteed in Part III
    4. Article 24 and the provisions under the 44th Amendment to the Constitution
    Show answer

    Answer: C. Article 21 and the freedoms guaranteed in Part III are the correct reference, so the answer is (c). In K. S. Puttaswamy and others versus Union of India and others, the Supreme Court held that the right to privacy is an integral part of the right to life and personal liberty guaranteed by Article 21, adding that the right to privacy is intrinsic to the entire fundamental rights chapter of the Constitution. Option (c) captures both halves of that holding, the specific Article and the wider Part III. The distractors pair an unrelated Article with an unrelated amendment or Part. Article 14 concerns equality, Article 17 abolishes untouchability, and Article 24 prohibits child labour in hazardous employment, and none of these was the basis of the privacy judgment. SOURCE: The Hindu resource page on the Supreme Court verdict on the right to privacy. HOW TO CRACK IT: The stem quotes the judgment's own language, right to life and personal liberty, which is the heading of Article 21, so the answer is signposted in the question itself. Read the stem for constitutional phrases that map directly onto an Article, since UPSC often embeds the answer in the wording. Learn the landmark judgment together with the Article it construes.

    Difficulty: easy · direct

    Open this question on its own page, with the full explanation →

  2. UPSC Prelims 2021 · Polity · Fundamental Rights

    Right to Privacy' is protected under which Article of the Constitution of India?

    1. Article 15
    2. Article 19
    3. Article 21
    4. Article 29
    Show answer

    Answer: C. In K. S. Puttaswamy Case (2017), Supreme Court of India has held that right to privacy is a Fundamental Right and it is protected under Article 21 of the Constitution of India. The Court reasoned that privacy is an incident of fundamental freedom or liberty guaranteed under Article 21. The Court overruled M.P. Sharma, and Kharak Singh judgements, in so far as the latter did not expressly recognize the right to privacy. Hence option (c) is the correct answer.

    Difficulty: easy · direct

    Open this question on its own page, with the full explanation →

  3. UPSC Prelims 2024 · Polity · Fundamental Rights

    Under which of the following Articles of the Constitution of India, has the Supreme Court of India places the Right to Privacy?

    1. Article 15
    2. Article 16
    3. Article 19
    4. Article 21
    Show answer

    Answer: D. The Supreme Court of India in Justice K.S. Puttaswamy (Retd) vs Union of India has declared that the Right to Privacy is a fundamental right under Article 21. In doing so, the Supreme Court overruled verdicts given in the M.P. Sharma case in 1958 and the Kharak Singh case in 1961, both of which had held that the right to privacy is not protected under the Indian Constitution. Article 21 guarantees protection of life and personal liberty, and the Right to Privacy has been placed under this article. Hence option (d) Article 21 is the correct answer.

    Difficulty: easy · direct

    Open this question on its own page, with the full explanation →

Practice questions

  1. With reference to the Digital Personal Data Protection Act, 2023, consider the following statements: 1. It does not apply to personal data made publicly available by the Data Principal; 2. It creates a separate category of sensitive personal data with higher protection; 3. It allows conditional exemptions for research and statistical purposes. Which of the statements given above are correct?

    1. 1 and 2 only
    2. 1 and 3 only
    3. 2 and 3 only
    4. 1, 2 and 3
    Show answer

    Answer: B. Section 3(c)(ii) excludes such public data and Section 17(2)(b) gives the research exemption; the Act has no sensitive-data category.

    Difficulty: medium · statement

  2. Consider the following pairs of AI privacy risks and their meanings: 1. Membership inference – finding whether a person's data was in the training set; 2. Model inversion – reconstructing training data from model outputs; 3. Re-identification – deleting a person's data from a trained model. How many pairs are correctly matched?

    1. Only one
    2. Only two
    3. All three
    4. None
    Show answer

    Answer: B. Re-identification links anonymised data back to individuals; removing data from a model is machine unlearning.

    Difficulty: medium · statement

  3. Under the EU General Data Protection Regulation, the right to erasure and the right to object are found respectively in:

    1. Articles 15 and 20
    2. Articles 17 and 21
    3. Articles 16 and 22
    4. Articles 12 and 18
    Show answer

    Answer: B. Article 17 provides the right to erasure, often called the right to be forgotten, and Article 21 the right to object.

    Difficulty: medium · statement

Mains practice

Answer-writing practice on this article. Attempt it first, then open the hints.

  1. GS2 · 250 words

    The exclusion of publicly available personal data from the DPDP Act, 2023 leaves Indians exposed in the age of AI. Critically examine, and suggest safeguards that protect privacy without stifling innovation.

    Show hints
    1. Explain how scraping, memorisation and profiling harm privacy
    2. link to Puttaswamy
    3. analyse Sections 3(c)(ii) and 17(2)(b) and the missing sensitive-data class
    4. compare GDPR and the EU AI Act; note industry's case for public-data use
    5. suggest opt-outs and privacy-enhancing technologies.