AI security and DPDP compliance for Indian enterprises
India's enterprises adopted copilots and coding agents faster than almost anywhere. The DPDP Rules now put a date on proving that every one of them handles personal data as approved. Kapālins gives that proof from the AI estate itself.
What changes for India enterprises, and when.
The Digital Personal Data Protection Rules 2025 were notified on 13 November 2025. Consent Manager provisions arrive in November 2026, and the duties that matter for AI, notice, security safeguards and breach reporting, come into force in May 2027. Gartner expects India's information security spend to reach US$3.4 billion in 2026, growing 11.7 percent. The buyers are the IT services majors, banks, insurers and the global capability centres that run AI for the world's largest companies.
- In force
DPDP Rules 2025 notified; Data Protection Board provisions in force. Starts the 12- and 18-month clocks for the remaining rules. Source (secondary)
- In force · upcoming
DPDP Rule 4: Consent Manager registration and obligations. Consent flows that feed AI systems must be traceable to a registered Consent Manager. Source (secondary)
- In force · upcoming
DPDP Rules 3, 5–16, 22, 23: notice, security safeguards, breach reporting and most Data Fiduciary duties. The deadline that forces an inventory of every AI that processes personal data and proof of its safeguards. Penalties reach ₹250 crore per instance for failing security safeguards. Source (secondary)
Dates: each entry links to its source. A source marked secondary is a law firm, analyst or vendor summary; check the primary text before relying on the date. The full calendar is on the AI regulation tracker.
Mapped on the platform for India.
Every framework page says which controls are proved by a live signal from the gateway, probes or device sensor, and which by assessment evidence. Both are exported in the regulator evidence pack.
Hosting and residency.
Today the platform and its data are hosted in Australia. In-country data residency for Indian tenants is on the platform roadmap and is a stated prerequisite before Indian tenants are onboarded; ask for the current status.
Industries and cities.
Questions buyers in India ask.
Is Kapālins available in India?
Yes. Kapālins is delivered remotely from Melbourne, Australia, and through partners in the Authorised, Premier and Elite tiers. Organisations in Bengaluru, Mumbai, Hyderabad, Pune, Delhi NCR, Chennai are served in the same way: a briefing on your own estate, then onboarding.
Which India frameworks does the platform map?
DPDP Act 2023, ISO/IEC 42001, ISO/IEC 27001, SOC 2, OWASP LLM Top 10, NIST AI RMF, MITRE ATLAS. Each framework page lists the controls mapped and whether a control is proved by a live platform signal or by assessment evidence.
Where is our data hosted?
Today the platform and its data are hosted in Australia. In-country data residency for Indian tenants is on the platform roadmap and is a stated prerequisite before Indian tenants are onboarded; ask for the current status.
Can the platform help before the May 2027 DPDP deadline?
Yes. The DPDP Act 2023 framework page lists the controls the platform maps. Discovery of every AI that touches personal data is the first step, and the platform does it from identity grants, audit logs, the gateway and the device sensor rather than a survey.