DPDP Act & AI-Written Code: A 2027 Readiness Guide
What India's DPDP Act means for teams using AI coding agents, the real 2027 timeline, and a developer readiness checklist.
India's DPDP Act is not in force yet, its core obligations phase in to 13 May 2027, but that deadline is exactly why software teams using AI coding agents should prepare now. The Act's security-safeguard, breach-reporting, and accountability duties apply to the systems that process personal data, and a growing share of that code is now written by AI agents you may not be able to audit. Readiness means building the logging, oversight, and evidence trail before the deadline arrives, not after.
This guide covers the real timeline, what the Act asks of engineering teams, where AI-written code creates exposure, and a practical checklist to be ready for 2027.
What is the DPDP Act, and when does it actually take effect?
The Digital Personal Data Protection Act (DPDP) is India's comprehensive data-protection law. The Act itself passed in 2023, but it needed implementing rules to become operational, and the timeline is staggered, so it's easy to get wrong.
| Milestone | Date | What happens |
|---|---|---|
| DPDP Act passed | 2023 | Framework enacted, awaiting rules |
| DPDP Rules notified | 13 Nov 2025 | Implementing rules published; clock starts |
| Data Protection Board established | Immediately | Regulator stood up |
| Consent Manager rules | ~13 Nov 2026 (+12 months) | Consent-manager registration framework |
| Core obligations effective | 13 May 2027 (+18 months) | Notice, consent, data-principal rights, security safeguards, breach reporting, cross-border rules |
The headline: the core obligations are not mandatory today. They phase in through 13 May 2027, an 18-month transition from the November 2025 rules. That's a feature, not a footnote, it's a runway. Teams that use it to build auditable controls will be ready; teams that treat May 2027 as far away will be assembling evidence under pressure.
Anyone telling you DPDP is "already in force" is wrong, and building on that claim leads to bad prioritization. The correct framing is: prepare now for a deadline that is real, dated, and close.
What does the DPDP Act require from software teams?
DPDP is written in terms of obligations on the data fiduciary (the organization deciding how personal data is processed), but several of those obligations land squarely on engineering:
- Reasonable security safeguards, the fiduciary must protect personal data with appropriate technical and organizational measures. That includes the code paths that touch personal data.
- Breach notification, personal-data breaches must be reported to the Board and affected individuals. You can't report what you can't detect, so this implies logging and monitoring.
- Accountability and demonstrable compliance, the fiduciary must be able to show it met its obligations. In practice: records, audit trails, evidence.
- Data-principal rights, access, correction, and erasure requests must be honored, which means knowing where personal data lives and flows in your systems.
None of these say "AI" explicitly. But all of them apply to code, and a fast-growing share of that code is now authored by AI agents.
Where does AI-written code create DPDP exposure?
AI coding agents don't change what the law requires; they change how hard it is to meet it. Three gaps open specifically because of agent-written code:
- No attribution. When Copilot, Cursor, or Claude Code writes a function that handles personal data, there's often no record of which agent wrote it or whether a human reviewed it. "Reasonable safeguards" is hard to demonstrate for code nobody can account for.
- Unreviewed changes to sensitive paths. Agents ship faster than reviewers can keep up. A change that touches a data-handling module or a cross-border transfer path can reach production without oversight, precisely the kind of change DPDP expects you to control.
- No evidence trail. "Demonstrable compliance" assumes you can produce records. If your AI activity lives only in ephemeral agent sessions and unlabeled commits, there's nothing to hand the Board or an auditor.
The exposure isn't that AI writes bad code. It's that AI writes unaccountable code by default, and DPDP's accountability principle assumes you can account for it.
What evidence and oversight does DPDP readiness require?
Because DPDP centers on demonstrable compliance, readiness is fundamentally about evidence. For teams using AI agents, that means being able to show:
- An audit trail of code actions that touch personal-data systems, who or what made each change, and when.
- Attribution distinguishing human-written from agent-written code, and identifying which agent.
- Human oversight of risky changes, proof that a direct push to
main, a large diff, or a sensitive-path change was flagged and reviewed. - Tamper resistance, a log that can't be quietly altered after the fact, so the evidence is credible.
- Breach-relevant logging, enough signal to detect and reconstruct an incident for the mandated notification.
This is the same evidence layer good AI code governance produces. Pramana captures agent-attributed actions in a tamper-evident audit trail and exports evidence mapped to controls, including a DPDP view, so "demonstrable compliance" is a report you generate, not a spreadsheet you assemble.
Your DPDP 2027 readiness checklist
Use the runway to 13 May 2027 deliberately. Work through this checklist:
- Map where personal data flows through your systems and which code paths touch it.
- Attribute AI-written code, know which changes came from an agent and which agent.
- Log code actions on personal-data systems in a durable, timestamped record.
- Make the log tamper-evident so it holds up as evidence to the Data Protection Board.
- Flag risky changes to sensitive paths for human review before they ship.
- Scan for secrets and vulnerabilities in AI-generated code and map findings to DPDP controls, Petika does this.
- Stand up breach detection and logging sufficient to meet notification duties.
- Be able to export evidence on demand for any system or date range.
- Assign ownership, name who (Head of Engineering, CISO, DPO) is accountable for AI-code governance.
Teams that complete this before the deadline won't just be compliant; they'll clear enterprise security reviews and adjacent certifications (SOC 2, ISO 42001) with the same evidence trail.
FAQ
Is the DPDP Act in force right now?
No. The DPDP Rules were notified on 13 November 2025, and the core obligations, notice, consent, data-principal rights, security safeguards, breach reporting, and cross-border rules, phase in to 13 May 2027. The runway is meant for preparation.
Does the DPDP Act mention AI-generated code specifically?
No. DPDP is technology-neutral. But its security-safeguard and accountability obligations apply to all code that processes personal data, including the growing share written by AI agents, so AI-written code falls under it by implication.
What DPDP obligations affect engineering teams most?
Reasonable security safeguards, breach detection and notification, and demonstrable accountability. In practice these translate to logging, human oversight of risky changes, and an audit trail you can produce on demand.
What is a DPDP audit trail?
A durable, tamper-evident record of how personal data is handled in your systems, including which code changes touched it and who or what made them. It's how a data fiduciary demonstrates compliance to the Data Protection Board.
How do I prepare for DPDP if my team uses AI coding agents?
Start now: attribute AI-written code, log actions on personal-data systems in a tamper-evident trail, flag sensitive-path changes for review, scan for vulnerabilities mapped to DPDP controls, and make evidence exportable before the May 2027 deadline.
Walk into the 2027 deadline with code-level evidence instead of a spreadsheet. See how Hunaru builds a DPDP-ready audit trail for AI-written code, explore the products or book a demo.