Imagine an e-commerce company using AI to analyse customer behaviour and respond to customer queries. Every purchase, search or interaction generates information that may include a customer’s name, contact details and purchase history. As this information moves between different applications and AI systems, how can the business ensure that personal data remains protected at every stage?
This is a challenge that businesses across sectors are beginning to face with the adoption of AI. Indian enterprises are increasingly adopting artificial intelligence across various business functions. However, as data moves between applications, cloud platforms and other AI systems, managing personal information can be challenging. With the implementation of India’s Digital Personal Data Protection (DPDP) Rules, 2025, businesses will need to examine whether their existing data management practices can meet requirements around consent and protect personal data from unauthorised access.
This issue is becoming more relevant as AI moves beyond employee productivity. Enterprises are now incorporating AI into several business workflows. Personal information collected through applications may be processed by various business softwares, stored in cloud environments or accessed through third-party AI agents. Organisations will need transparency into these processes to establish what data is being collected, why it is being used, where it is being processed and how long it is retained.
Two recent studies by Avanade and Cognizant point to the growing use of AI in Indian businesses, while also highlighting gaps in integrating technology into business operations and translating AI adoption into measurable business gains.
AI adoption increases the complexity of enterprise data management
The Avanade AI Reality Report highlights the gap between confidence in AI and the extent to which organisations have changed their operations around the technology. While 82% of Indian business leaders surveyed expressed high or complete confidence in their organisations’ use of AI, only 23% said their teams had fundamentally reshaped how they operate around it.
The study also found that 47% of Indian respondents had encountered integration or scaling problems while deploying AI. Further, 75% said AI had not yet delivered returns that justified the money and effort invested, while 74% said their organisations had not formally calculated AI ROI.
Cognizant’s report on AI-driven productivity offers another perspective on the adoption landscape. Based on a survey of 700 enterprise employees and 75 C-suite and business executives in India, the study found that 97% of employees reported some productivity improvement from AI, with an average reported uplift of 15%.
However, the findings also point to limitations in wider adoption. Business leaders estimated that, on average, only 36% of employees had access to AI tools. The research also estimates that AI-driven productivity could add between $28 billion and $84 billion to India’s annual nominal GDP under realistic adoption scenarios. Sandeep Bhambure, MD and VP – India and SAARC at Veeam, believes the shift to AI requires organisations to rethink their existing security and trust frameworks. “Whatever trust and security infrastructures that were built in the pre-AI era can no longer be useful in the post-AI era,” he notes.
Together, the two studies show that while AI adoption is growing among Indian enterprises, organisations are still working through challenges related to its wider adoption and integration. This is particularly important as India moves towards implementing the DPDP framework.
DPDP implementation brings data management into focus
The challenges around integrating AI into business operations also raise questions about how organisations manage the data used by these systems. As enterprises handle increasing amounts of digital personal data across applications, cloud platforms and third-party services, they will need to ensure that this information is collected and processed in line with applicable data protection requirements. India’s Digital Personal Data Protection (DPDP) Act, 2023, and the DPDP Rules, 2025, establish the framework for organisations handling digital personal data.
The government notified the DPDP Rules on 14 November 2025, with implementation planned in phases over 18 months. The provisions relating to Consent Managers are scheduled to take effect in November 2026, while most of the key requirements, including those covering consent, data security, breach reporting and individual rights, are scheduled to come into effect in May 2027.
Under the Act, organisations that determine how and why personal data is processed are referred to as Data Fiduciaries. They are responsible for ensuring that personal data is processed for lawful purposes and giving individuals greater control over their information. This includes allowing people to withdraw their consent and exercise their rights relating to access, correction and erasure of personal data, subject to the provisions of the Act.
For businesses, this will require a closer look at how personal data is handled across their systems. They will need to identify what information they collect, where it is stored, how it is used and who has access to it. These responsibilities can become harder to manage when personal data moves between different enterprise applications or is handled by external service providers and AI systems. “You’ll need to prove how you secured data, not just that you tried,” says Mini Gupta, Partner – Cybersecurity Consulting at EY, highlighting the importance of accountability and privacy.
Governance extends across the AI value chain
As personal data moves between enterprise applications, AI platforms and external service providers, identifying who is responsible for its handling becomes an important part of data governance. This is particularly important when AI systems involve multiple technology providers, models and service partners.
DSCI’s recently released report, AI Liability: Industry Guidance for Agentic AI, examines how accountability should be understood and allocated as organisations adopt autonomous AI systems. Mouli S., Global CTO of HGS, has also emphasised the need for stronger oversight as AI systems become more autonomous. “Governance is increasingly becoming a business imperative rather than a standalone compliance function. As AI becomes more autonomous, organisations need adaptive oversight, clear accountability, human supervision and traceability built into day-to-day operations,” he adds.
A similar consideration arises when organisations work with external AI providers. Technology companies are increasingly collaborating with AI developers to bring AI capabilities into enterprise workflows and business operations.
These collaborations often focus on adapting AI tools to industry-specific requirements while defining where human involvement and operational controls are needed. For enterprises, such arrangements also make it important to understand how data is shared with external providers and how processing responsibilities are established.
Privacy management tools target operational requirements
Alongside AI deployment, technology providers are also introducing tools to help organisations manage personal data and privacy-related workflows.
Many leading cybersecurity firms are increasingly developing solutions to help organisations manage personal data and strengthen their privacy practices. These include tools to identify and classify personal data stored across different systems, manage consent and track how personal information is being used. They also help organisations handle individual requests to access, correct or delete their personal data.
Such tools can help organisations identify where personal data is stored and manage privacy-related processes across different systems. However, their effectiveness will depend on how well they integrate with existing enterprise systems, the range of data repositories they cover and how organisations implement the associated workflows.
Technology tools alone cannot establish compliance. Businesses will still need to define processing purposes, review their data retention practices, assess third-party arrangements and ensure that internal teams follow the required procedures.
From AI deployment to data accountability
The DPDP framework is placing greater emphasis on how organisations handle personal data at every stage. As AI adoption expands, this will involve reviewing not only the information collected directly from customers and employees but also how it moves through enterprise applications, cloud services and external AI platforms.
For CIOs, CISOs and data protection teams, the focus will be on making sure that the company’s technology systems follow data privacy requirements. This includes knowing where personal data is stored, checking who has access to it, keeping records of how it is used and ensuring that external service providers follow the required safety measures.
As AI agents gain access to data, organisations will also need to keep track of the actions performed by these systems. “For CXOs, explainability must extend beyond model outputs to agent actions, why a particular tool was selected, why specific data was accessed and why a workflow was triggered,” says Nitin Mehta, Digital Risk Leader at EY India, highlighting the importance of transparency in businesses.
Alongside transparency, restricting the access available to AI agents will also be important. As these systems interact with enterprise applications and databases, organisations will need to ensure that they can access only the information required to perform their assigned tasks. Ninad Katkar, Leader, Security, Cisco India and South Asia, stressed the importance of this approach, saying that organisations “have to make sure that we give the least privilege access.”
The upcoming implementation milestones give organisations time to review their existing infrastructure and make the necessary changes before most of the main DPDP requirements take effect in 2027. The key challenge will be to ensure that businesses are aware of how personal data is collected, stored and accessed through different applications and AI systems.