For years, data privacy and artificial intelligence sat in different rooms. Privacy was a legal and compliance concern. AI was something the technology team was experimenting with. In 2026, that separation has collapsed, and for Indian businesses it happened almost overnight.
On 13 November 2025, India's Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025, giving the Digital Personal Data Protection Act, 2023 real operational force. At the same time, AI adoption inside Indian companies has moved from experiment to everyday operation. The result is a single, pressing question that lands squarely on the leadership table: can you prove that the AI systems handling your customers' personal data are governed, accountable, and safe?
For most organisations, the honest answer today is no. This article explains why that gap has become a serious business risk, and how a single international standard, ISO 42001, gives you a structured, auditable way to close it.
Why DPDP and AI collided into one problem#
The DPDP Act governs how any organisation collects, processes, stores, and protects the personal data of individuals in India. The 2025 Rules turned its principles into concrete duties: obtaining clear and informed consent, honouring individual rights to access and erase data, reporting breaches promptly to the Data Protection Board, and applying reasonable security safeguards. Larger organisations, designated as Significant Data Fiduciaries, carry heavier obligations still, including audits and impact assessments.
Here is where AI enters. Modern AI systems are built on data, and very often that data is personal. A recommendation engine learns from customer behaviour. A support chatbot processes names, emails, and account details. An underwriting model ingests financial records. Every one of these is a personal-data processing activity under the DPDP Act, whether or not anyone labelled it as such.
The problem is that AI introduces risks the DPDP Act did not have to spell out, because they are specific to how AI behaves: models can be opaque, so you cannot always explain a decision; they can drift, so a system that was safe last quarter may not be safe today; and they can encode bias, producing unfair outcomes at scale. Using AI does not exempt you from your data obligations. It makes meeting them harder.
Using AI does not exempt you from your data obligations. It makes them harder to meet, and much harder to prove you have met.
This is why AI governance has moved out of the technology team's column and onto the boardroom agenda. Regulators, clients, and auditors are no longer satisfied that an AI system works. They want evidence that it is governed. And evidence is exactly what most organisations cannot yet produce.
What is ISO 42001, in plain terms?#
ISO/IEC 42001, published in December 2023, is the world's first international standard for an Artificial Intelligence Management System, often shortened to AIMS. If that phrase sounds abstract, here is the practical version.
ISO 42001 does for artificial intelligence what ISO 27001 does for information security and ISO 9001 does for quality. It gives you a structured set of policies, roles, processes, and controls to govern AI responsibly across its whole lifecycle, from the decision to build or buy a system, through deployment, monitoring, and eventual retirement. Crucially, it is certifiable: an accredited third party can audit your organisation and confirm you meet the standard.
That certifiability is what sets it apart from principles and guidelines. Government frameworks tell you what values to uphold. ISO 42001 tells you what to actually put in place, and then lets you prove you have done it.
What an AI Management System actually covers#
A properly implemented AIMS under ISO 42001 addresses the areas that keep compliance officers, and increasingly boards, awake at night:
- Governance and accountability: clear ownership of every AI system, with defined roles and responsibility for its behaviour.
- Risk and impact assessment: a structured way to identify and manage AI-specific risks such as bias, opacity, and privacy exposure before a system goes live.
- Human oversight: defined points where a person reviews, approves, or can override an AI decision.
- Transparency: documentation of how systems work, what data they use, and their limitations, so decisions can be explained.
- Lifecycle controls: monitoring for drift and performance issues, and safe processes for updating or decommissioning systems.
- Supplier oversight: governance that extends to the third-party AI tools and APIs you rely on, not just what you build in-house.
Read that list again with the DPDP Act in mind, and the overlap is obvious. Accountability, security safeguards, transparency, and risk management are exactly what the Act demands for personal data. That overlap is the heart of why ISO 42001 is so useful to an Indian business right now.
How ISO 42001 supports DPDP compliance#
ISO 42001 is not a data protection law, and it does not replace the DPDP Act. What it does is give you the operational machinery to meet many of the Act's requirements in the specific context of AI, and to demonstrate that you have. The two are complementary: the Act sets the legal duty, the standard provides a structured way to discharge it.
The table below maps common DPDP obligations to the ISO 42001 controls that help you meet them.
| DPDP Act obligation | How ISO 42001 helps you meet it |
|---|---|
| Accountability for personal data | Formal AI governance roles and clear ownership for every system that processes personal data |
| Reasonable security safeguards | Lifecycle controls, risk assessment, and monitoring built into how AI systems are run |
| Transparency and purpose limitation | Documented records of what each system does, what data it uses, and why |
| Managing risk to individuals | AI impact assessments that surface bias and privacy risks before deployment |
| Oversight of processing | Defined human oversight and escalation points across the AI lifecycle |
| Handling third parties | Supplier and vendor governance covering third-party AI tools and models |
The practical takeaway is efficiency. If you build an AI governance programme around ISO 42001, you are not doing separate, duplicated work to satisfy the DPDP Act. Much of the documentation, risk assessment, and accountability structure the Act expects is produced as a natural output of implementing the standard. You build once and satisfy both.
Why this matters commercially: beyond avoiding penalties, a certified AI management system is fast becoming a condition of doing business. Enterprise and overseas clients now ask for proof of AI governance in their procurement and due-diligence checks. A recognised certification answers that question in a format buyers and their compliance teams already trust, often replacing lengthy security questionnaires and shortening your sales cycle.
Who needs to pay attention to this now?#
Not every organisation faces the same urgency, but the circle is wider than most people assume. You should be treating this as a near-term priority if any of the following describe you.
- You use AI on personal data. If any AI system in your business touches customer, employee, or user data, DPDP obligations already apply to it.
- You serve enterprise or overseas clients. Large customers, especially in the EU, US, and regulated sectors, increasingly require documented AI governance before they sign or renew.
- You operate in a regulated sector. Financial services, healthcare, and similar industries face both DPDP duties and sector-specific expectations around AI.
- You build or resell AI products. If AI is part of what you deliver, your clients will expect you to govern it, and to prove it.
- You rely on third-party AI tools. Governance applies whether you build AI or simply adopt it. Using an external model does not move the responsibility off your books.
If you recognise your organisation in even one of these, the gap between "we use AI" and "we can prove our AI is governed" is a risk worth closing deliberately, rather than discovering it during a client audit or a regulatory query.
What implementing ISO 42001 looks like#
Implementation is a structured project, not an open-ended burden. For a mid-sized organisation it typically takes three to six months, and moves faster if you already hold ISO 27001, because the underlying management-system discipline is shared. A typical path runs as follows.
- Gap assessment and scope. Define which AI systems and business areas are in scope, build an inventory of your AI (including third-party tools), and measure your current position against the standard.
- Risk and impact assessment. Identify the specific risks each system carries, including bias, transparency, and personal-data exposure, and decide how to treat them.
- Build the management system. Draft your AI policy, define governance roles, implement the relevant controls, and prepare the required documentation.
- Operate and internally audit. Run the system for a full cycle, then test it with an internal audit and a management review to confirm it works and to close any gaps.
- Certification. An accredited body conducts a two-stage external audit, a documentation review followed by an on-site assessment, and issues the certificate.
The most valuable part is often the gap assessment itself. Organisations frequently discover during it that they are running AI systems no one is formally responsible for, or that their risk processes have blind spots. Even before certification, that clarity is worth the exercise.
Is ISO 42001 mandatory in India?#
The distinction matters less than it first appears, for several reasons. Client contracts are making it functionally mandatory: a voluntary standard becomes unavoidable when your largest customers will not award work without it. Sector regulators are moving in the same direction, with growing expectations around board-approved AI policies and accountability. And in any future dispute involving an AI system, being able to show a certified, well-governed management system is a far stronger position than having no formal governance at all.
The sensible way to read this is not "do I have to?" but "when will my clients and regulators expect it, and would I rather be ready or scrambling?" Organisations that move early gain a genuine advantage in the conversations where governance is a deciding factor.
Frequently asked questions#
This article is for general information only and does not constitute legal advice. Regulatory requirements evolve, and organisations should seek advice specific to their circumstances. Details of the DPDP Rules and ISO 42001 are accurate to the best of our knowledge at the time of writing, July 2026.
What is ISO 42001?
ISO 42001 is the international standard for an Artificial Intelligence Management System (AIMS). It provides a structured, certifiable framework of policies, roles, and controls to govern how an organisation develops and uses AI responsibly across its lifecycle.
How does ISO 42001 help with DPDP compliance?
ISO 42001 does not replace the DPDP Act, but its controls for accountability, security, transparency, and risk management overlap strongly with the Act's obligations. Implementing the standard produces much of the governance and documentation the Act expects for AI systems that process personal data, so one programme supports both.
Is AI governance mandatory under the DPDP Act in India?
The DPDP Act does not name AI specifically, but its obligations apply to any processing of personal data, including by AI systems. So while ISO 42001 certification itself is voluntary, the underlying duty to govern how AI handles personal data is not.
What is an AI Management System (AIMS)?
An AIMS is the set of policies, processes, roles, and controls an organisation uses to manage artificial intelligence responsibly across its lifecycle. ISO 42001 defines the requirements an AIMS must meet to be certified.
Who needs ISO 42001 certification in India?
It is most relevant to organisations that use AI on personal data, serve enterprise or overseas clients who ask for governance proof, operate in regulated sectors, or build and resell AI products. It also applies to businesses that rely on third-party AI tools, since responsibility for governance stays with you.
How long does ISO 42001 implementation take?
For a mid-sized organisation it typically takes three to six months, depending on the maturity of existing management systems. Organisations that already hold ISO 27001 can often move faster because the underlying processes are shared.