INDIA Trends and Developments Contributed by: Sandra Lisa Philip, Shri Gayathri and Prashanth Shivadass, Shivadass & Shivadass
sector are not negligible. Contributions this massive also come with their own risks such as data breaches, algorithm bias, and regarding understanding consent and the extent of its application. Data anonymity can be a starting step to train AI models, ensuring that its learning is not influenced by failing to feed it enough data but, at the same time, that raw patient data is not put at risk. Since most consumers are unaware of the extent to which their data is used, it is imperative that such extent be clearly delineated and explained to them so that they are in a position to give informed consent, and that businesses do not lack accountability when questioned. The AI-Privacy Gap in Business Operations The AI-privacy gap in business operations does not arise because organisations are unaware of privacy risks but because AI systems fundamentally change how data is collected, combined and reused within organisations. Unlike traditional IT systems, AI mod - els are rarely limited to a single dataset or a single purpose. Businesses routinely feed AI systems with data drawn from consumer interactions, transaction histories, third-party datasets and publicly available information to improve accuracy and performance. Over time, this creates complex data chains that are difficult to map, monitor and control. One of the most significant gaps appears at the point of data aggregation. Businesses often collect data for a refined operational purpose such as customer onboarding, service delivery or compliance, but later reuse the same data to train or fine-tune AI models for analytics, personalisation or prediction. While this may make commercial sense, it creates uncertainty around whether individuals are aware of, or expect, such secondary uses. A close second issue is the use of third-party and cloud-based AI tools. Many Indian businesses rely on external platforms for generative AI, analytics, facial recognition or customer engagement. While these tools offer speed and scalability, they often operate as “black boxes”. Businesses may have limited vis - ibility into how prompts, inputs or datasets are stored, whether they are retained for model improvement, or
how long they stay across systems. This lack of trans - parency increases the risk of unintended data expo - sure, especially when sensitive personal or commer - cial information is used in routine business workflows. The AI-privacy gap is further widened by the dynamic nature of AI systems. Unlike static software, AI models evolve as they are trained on new data or adapted data, for new use cases. Insights generated by AI, such as behavioural predictions or risk scores, may go beyond the data that was originally collected. In many cases, even development teams may not fully anticipate the types of inferences that AI systems can generate once deployed at scale. This creates chal - lenges for businesses trying to align AI outputs with governance standards. Importantly, this gap is not unique to India but is amplified by the speed of adoption. Industry reports (Deloitte Asia Pacific survey) consistently show that Indian businesses are among the fastest adopters of AI and generative AI globally, often outpacing the maturity of internal governance frameworks. In many cases, business value is realised faster than risk con - trols can be put in place. As a result, governance mechanisms tend to mature only after systems are already in use, increasing exposure to privacy and reputational risks. In India, this AI-privacy gap is in part shaped by the Digital Personal Data Protection Act, 2023 (DPDPA), which operates as an indirect but influential constraint on how businesses deploy AI. While the DPDPA does not regulate AI systems as such, it governs how per - sonal data used by organisations – including data processed through AI tools – is collected, processed, stored and shared. In practice, this means that busi - nesses remain responsible for the downstream effects of AI-driven data processing, regardless of whether AI systems are developed internally or sourced from third-party vendors. Alongside the DPDPA, India’s emerging AI governance approach relies heavily on policy principles rather than binding rules. The “India AI Governance” framework emphasises responsible use, transparency, fairness, safety and human oversight, signalling how regula - tors and courts are likely to evaluate AI deployment
153 CHAMBERS.COM
Powered by FlippingBook