Short answer: a small Indian company needs a one-page AI use policy that names the approved tools, lists the data that never goes into them, says who approves new tools, and tells staff what to do if something goes wrong. Write it now, because India's DPDP Act duties on consent, security and breach reporting apply from mid-May 2027, and your team is already using AI whether or not anyone has said yes.
Your team is already using AI
Most owners are past deciding whether to allow AI at work. The real decision is whether the AI use already happening sits on accounts the company controls.
Netskope's Threat Labs report on India for 2026 puts numbers on this. Across the organisations it monitors, the share of users on AI apps rose from 55% to 82% in a year. Use of personal AI accounts at work fell from 79% to 41%, as more companies moved staff onto company-managed accounts. That still leaves roughly four in ten people using personal accounts for work.
The same report found Indian organisations averaging over 3,000 AI-related data policy violations a month, more than ten times the global average. Almost half involved source code, followed by regulated data and intellectual property, and some were passwords and API keys. These figures come from large companies running security software. A 40-person firm with no such tool simply can't see what's going out.
What the DPDP Act changes, and when
The Digital Personal Data Protection Act became law in 2023. The rules that make it work were notified in November 2025, with a phased start. According to S.S. Rana & Co.'s summary, the Data Protection Board started straight away, and the main duties for businesses, including notice, consent, security safeguards and breach reporting, come in after 18 months, in May 2027.
Two things in it matter for AI use.
First, if you hold customers' or employees' personal data, you're responsible for reasonable security safeguards around it. The penalty in the Act's schedule for failing at that goes up to ₹250 crore. Small businesses are unlikely to see that number, but the duty is the same for everyone. A sales executive pasting a list of customer names and phone numbers into a personal chatbot account is exactly the kind of thing a policy should stop.
Second, if there's a breach, you have to tell the affected people and the Board. Under Rule 7, a detailed report to the Board is due within 72 hours of becoming aware of it. You can't do that if nobody knows which AI tools hold which data.
None of this means AI is risky to use. It means you should decide where your data goes, instead of each employee deciding.
What to put in the policy
Keep it to a page. Staff won't read more, and you won't keep a longer one up to date.
1. Approved tools. List the AI tools people may use for work, and say work happens on company accounts only. Personal accounts stay out. If the company hasn't paid for any, say which free tools are allowed and for what kind of task.
2. Data that never goes in. Be concrete. A useful list for most small firms:
- customer and employee personal data (names with phone numbers, addresses, Aadhaar or PAN, health details);
- passwords, API keys and login details of any kind;
- contracts, pricing sheets and anything under an NDA;
- source code, unless the tool is approved for code;
- unannounced financials.
3. Data that can go in, on approved tools only. Internal documents, drafts, meeting notes and anonymised data, where the tool is on a business plan. OpenAI, for example, says on its business data page that it doesn't train its models on data from ChatGPT Business, Enterprise or its API by default. Check the equivalent page for any tool you approve, and keep a copy.
4. A person checks before it goes out. Anything AI-drafted that reaches a customer, a regulator or the public gets read by a human first. The same goes for figures in reports.
5. New tools need a yes. Name the one person who approves new AI tools and browser extensions. Ask them three things before approving: where is the data stored, is it used for training, and can we delete it.
6. If something goes wrong. If someone pastes the wrong thing into the wrong tool, they tell the named person the same day, with no blame for reporting it. Fast reporting is what makes the 72-hour clock manageable.
7. Review date. Put a date six months out on the page. AI tools change their terms often.
Making it stick
A policy only works if the approved route is easier than the workaround. If people are on personal accounts because the company tool is slow to get, fix that first. Buying a handful of business seats is usually cheaper than cleaning up after one leaked customer list.
Walk the team through it in a 20-minute meeting, with real examples from their own work: "you can paste this meeting transcript, you can't paste this customer export". Then ask each team which tasks they actually use AI for. You'll learn more from that list than from any survey, and it's a good start on deciding where AI should be built into the work properly.
If you're mapping this alongside a wider look at where AI fits in the business, data privacy under the DPDP Act is one of the areas our AI readiness assessment covers.
Arthat AI
Working on something similar at your company?
Arthat AI builds these automations for Indian businesses every week. If you want to talk through whether this fits your situation, we'll give you a straight answer — even if the answer is "don't build it."
