AI and Automation

Privacy for AI features in Canada and India: PIPEDA, DPDP and what to put in your policy

15 min readBy Sandeep Mahajan

General information, not legal advice. This article summarises public regulatory and statutory sources as of October 2026 for business owners planning AI features. It is not legal advice and does not create a lawyer-client relationship. Laws and timelines change; confirm the current position for your organisation with a qualified lawyer.

If an AI assistant or agent in your business reads, stores or generates anything about an identifiable person, it is processing personal information, and the ordinary privacy law already applies to it. In Canada that is PIPEDA (or the substantially similar laws of Quebec, British Columbia and Alberta) read with the regulators' December 2023 generative-AI principles; in India it is the Digital Personal Data Protection Act 2023, whose Rules were notified on 13 November 2025 with most obligations taking effect eighteen months later. The practical work is the same in both countries: tell people they are dealing with AI and what is kept, collect only what the feature needs, keep logs for a defined period, choose vendors that do not train on your data, and be able to show all of this when asked.

Key takeaways

  • Canada's federal and provincial privacy regulators published nine principles for generative AI on 7 December 2023, covering legal authority and consent, appropriate purposes, necessity and proportionality, openness, accountability, individual access, limiting collection, accuracy and safeguards. They apply to organisations using generative AI, not only to the companies that build it.
  • The same regulators concluded in May 2026 that OpenAI's initial training of ChatGPT "was not compliant with their respective privacy laws"; the Commissioner's statement that "current privacy laws apply to AI" is the point for everyone else.
  • India's DPDP Rules (Gazette No. 760, G.S.R. 846(E), 13 November 2025) bring Rules 1, 2 and 17 to 21 into force immediately, Rule 4 (consent managers) one year later, and Rules 3, 5 to 16, 22 and 23 "eighteen months after the date of publication", which is May 2027.
  • Under the DPDP Act, consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action"; the Rules require breach intimation to the Board within 72 hours and set a one-year minimum retention of processing logs; penalties in the Schedule run up to 250 crore rupees for failing to take reasonable security safeguards.
  • Both regimes allow cross-border processing but keep the organisation accountable for it: the OPC's guidance makes the transferring organisation responsible for protection "comparable" to its own, and DPDP Rule 15 permits transfer subject to requirements the Central Government may specify.

Which law applies to you

Canada. PIPEDA applies to "private-sector organizations across Canada that collect, use, or disclose personal information" in the course of commercial activity. Alberta, British Columbia and Quebec have laws "deemed substantially similar to PIPEDA", so organisations there follow the provincial law for in-province activity, but PIPEDA still applies when personal information "crosses provincial or national borders". A Niagara Falls business with customers in the United States, or a Canadian store whose assistant runs on a US cloud, is in that position.

A reform bill, C-36 (the Protecting Privacy and Consumer Data Act), received first reading on 15 June 2026 and sits "at second reading in the House of Commons" with no further activity recorded as of October 2026. It would replace PIPEDA's privacy provisions and create a new regulator; law-firm summaries note transparency duties for automated decision-making but no standalone AI statute. Until it passes, PIPEDA and the OPC's guidance are the rules.

India. The DPDP Act applies to "the processing of digital personal data within the territory of India" and "also apply[s] to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India". It excludes personal data processed "for any personal or domestic purpose" and data made publicly available by the individual. A Mohali team processing Canadian customers' data for a Canadian client is largely a PIPEDA question; the same team offering services to Indian customers is a DPDP question.

Canada: PIPEDA and the generative-AI principles

PIPEDA's Schedule 1 sets ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. The regulators' 2023 document maps nine of these onto generative AI and adds specifics. For an assistant or agent, the ones that bite:

  • Legal authority and consent. Organisations must "know and document their legal authority for collection, use, disclosure and deletion of personal information". The OPC's consent guidelines require four elements to be emphasised up front: what personal information is collected, with whom it is shared, the purposes, and any risk of harm. Express consent is generally required when information is sensitive, when the use is "outside of the reasonable expectations of the individual", or when it "creates a meaningful residual risk of significant harm". Feeding support conversations to a model to improve it is not what a customer expects when asking about a return.
  • Openness. The principles say organisations should "be open and transparent about the collection, use and disclosure of personal information", and that users of public-facing tools should be "aware that they are interacting with a generative AI tool", with the privacy risks and mitigations explained.
  • Limiting collection, use and disclosure. "Limit the collection, use, and disclosure of personal information to only what is needed", avoid "function creep", and "use anonymized, synthetic, or de-identified data rather than personal information where the latter is not required". An assistant that answers shipping questions does not need the customer's full order history in its prompt.
  • Accuracy. Personal information "must be as accurate, complete, and up-to-date as is necessary", and the principles extend this to information entered into prompts and to model outputs about people. The ChatGPT investigation specifically cited "factual inaccuracies" about individuals.
  • Individual access. Procedures must exist for people "to access and correct any information collected about them", including information held in logs.
  • Safeguards and breaches. Safeguards must match sensitivity. Under PIPEDA's mandatory reporting, a breach posing a real risk of significant harm must be reported to the OPC and affected individuals notified "as soon as feasible", and records of every breach kept for two years.
  • Assessments. The principles call for Privacy Impact Assessments and Algorithmic Impact Assessments before deployment where impact on individuals may be significant.

The May 2026 ChatGPT findings are worth reading in full: the regulators found a "lack of valid consent and transparency", overcollection, inaccuracy, limited access and correction, and "a lack of accountability", and treated the complaint as "well-founded and conditionally resolved" after OpenAI limited the personal data used in training. A business using a model is not training one, but each finding maps to a question your own deployment will be asked.

India: the DPDP Act and the 2025 Rules

The Act (22 of 2023). Processing is lawful only with consent or for "certain legitimate uses" (section 4). A consent request must be preceded by a notice stating the personal data and purpose, how rights can be exercised, and how to complain to the Data Protection Board (section 5). Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" and "limited to such personal data as is necessary for such specified purpose" (section 6). A Data Fiduciary must take "reasonable security safeguards to prevent personal data breach", must "give the Board and each affected Data Principal, intimation of such breach", and must erase personal data "upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served", including data held by its processors (section 8). Processing a child's data needs "verifiable consent of the parent" (section 9). The Central Government may notify Significant Data Fiduciaries with extra duties (section 10) and may "restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified" (section 16). The Schedule caps penalties at 250 crore rupees for failing to take reasonable security safeguards, 200 crore for failing to notify a breach or for breaches of the children's provisions, 150 crore for Significant Data Fiduciary duties and 50 crore for any other breach.

The Rules (G.S.R. 846(E), 13 November 2025). The commencement clause is the only authoritative timeline:

  • Rules 1, 2 and 17 to 21 (title, definitions, the Board) came into force on publication.
  • Rule 4 (consent managers) comes into force "one year after the date of publication" (November 2026).
  • Rules 3, 5 to 16, 22 and 23 come into force "eighteen months after the date of publication" (May 2027).

What those rules require once in force, for an AI feature:

  • Rule 3, notice: "clear and plain language", "an itemised description of such personal data", the specified purposes, and a link for withdrawing consent "with the ease of doing so being comparable to that with which such consent was given".
  • Rule 6, security safeguards: at minimum encryption, obfuscation, masking or tokenisation; access control; "appropriate logs, monitoring and review" for detecting unauthorised access; backups; retention of those logs "for a period of one year"; and contractual safeguards with processors, which includes your model provider.
  • Rule 7, breach intimation: affected individuals told "without delay" with a description, likely consequences, mitigations and a contact; the Board told without delay, with detailed information "within seventy-two hours of becoming aware of the breach".
  • Rule 8, retention: personal data, "associated traffic data and other logs of the processing" retained "for a minimum period of one year from the date of such processing", then erased; e-commerce entities with at least two crore registered users in India must erase data three years after the user last engaged, with 48 hours' notice.
  • Rule 10, children: "appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained".
  • Rule 13, Significant Data Fiduciaries: an annual Data Protection Impact Assessment and audit, and due diligence that "technical measures including algorithmic software" do not pose a risk to rights.
  • Rule 15, cross-border: transfer is permitted subject to requirements the Central Government "may, by general or special order, specify".

The two regimes side by side

Obligation Canada (PIPEDA + OPC principles) India (DPDP Act + Rules, once in force)
Tell people it is AI Users should be "aware that they are interacting with a generative AI tool" Notice must itemise data and purpose in plain language (Rule 3)
Legal basis Meaningful consent; express where sensitive or unexpected Consent (s.6) or a listed legitimate use (s.7)
Minimise Collect "only what is needed"; prefer de-identified data Consent "limited to such personal data as is necessary" (s.6)
Accuracy Accurate "as is necessary"; applies to prompts and outputs about people Fiduciary must ensure completeness, accuracy and consistency (s.8)
Access and correction Procedures to access and correct, including model-held data Rights to access, correction and erasure (ss.11-12)
Security Safeguards proportional to sensitivity Rule 6 minimums incl. encryption, access logs, one-year log retention
Breach Report to OPC and notify individuals where real risk of significant harm; keep records two years Individuals without delay; Board within 72 hours (Rule 7)
Retention Limit retention to purpose Erase when purpose served (s.8); logs one year (Rule 8)
Cross-border Allowed; organisation stays accountable; tell individuals of foreign processing Allowed subject to government-specified requirements (s.16, Rule 15)
Assessments PIA and AIA recommended DPIA and audit mandatory for Significant Data Fiduciaries (Rule 13)
Children Greater safeguards; "particularly at high risk" Verifiable parental consent (s.9, Rule 10)

What to put in your privacy policy and your build

  1. Name the AI features and their purposes. "Our support assistant answers questions about orders and policies" is a purpose; "to improve our services" is not specific enough under either regime.
  2. List what is collected per feature and what is not. Conversation text, order number, email, timestamps, model outputs. Say explicitly if payment data and account passwords are excluded from the assistant's reach.
  3. Say it is AI, in the interface and the policy. A visible label at the start of the conversation, a route to a person, and the policy line that matches.
  4. State retention in days. Conversation logs kept N days for quality review; under DPDP Rule 8 processing logs are kept at least one year, so decide the two numbers deliberately and document why.
  5. Name the processors and their countries. The model provider, the cloud region, the help-desk tool. The OPC guidelines say organisations "need to make it plain to individuals that their information may be processed in a foreign country".
  6. Record the training position in writing. As of October 2026: OpenAI states that "data sent to the OpenAI API is not used to train or improve OpenAI models" unless you opt in, with abuse-monitoring logs "retained for up to 30 days" by default; Anthropic's Commercial Terms (effective 17 June 2025) state "Anthropic may not train models on Customer Content from Services"; AWS documents that Bedrock model providers "don't have access to Amazon Bedrock logs or to customer prompts and completions". Consumer plans differ from API and enterprise terms; cite the plan you actually use.
  7. Describe access, correction and deletion for AI data. Who to email, what happens to logs and to any index containing personal data, and how long it takes.
  8. Keep the evidence. A PIA or DPIA for the feature, the evaluation set, the breach playbook with the 72-hour and "as soon as feasible" clocks, and the processor contracts with security clauses (DPDP Rule 6(f)).

Two build decisions make the policy true: keep personal data out of prompts unless the feature needs it (an order-status assistant needs an order number, not a profile), and route anything the assistant cannot answer to a person rather than letting it guess about people, which is where the accuracy findings in the ChatGPT investigation came from. Our RAG buyer's guide covers the read-only pattern; AI agents vs automation covers approvals and audit logs when an agent takes actions.

FAQ

Does PIPEDA apply to an AI chatbot on my website?

Yes, if the chatbot collects, uses or discloses personal information in commercial activity. The OPC and provincial regulators' 2023 principles say organisations using generative AI are responsible for compliance, must tell users they are interacting with AI, limit collection to what is needed, and keep information accurate. The May 2026 ChatGPT findings confirmed that "current privacy laws apply to AI".

When do India's DPDP obligations actually start?

The DPDP Rules 2025 were published on 13 November 2025. Rules 1, 2 and 17 to 21 took effect that day; Rule 4 on consent managers applies one year later (November 2026); Rules 3, 5 to 16, 22 and 23, which carry the notice, security, breach, retention and cross-border duties, apply eighteen months later (May 2027). Check the gazette text for the exact wording.

Do I need consent to use customer conversations to improve the assistant?

In Canada, using conversations for a purpose beyond answering the question is a new purpose; the OPC guidelines require express consent where a use is outside reasonable expectations, and recommend de-identified data where personal information is not needed. In India, consent must be specific to a purpose and limited to necessary data. The safest default is not to use conversation data for improvement without a separate, clear opt-in.

Can my AI assistant run on servers outside Canada or India?

Generally yes. PIPEDA does not prohibit transfers; the organisation stays accountable and must tell individuals that information may be processed abroad. The DPDP Act lets the Central Government restrict transfers to notified countries, and Rule 15 allows transfers subject to any requirements the government specifies. Name the regions and processors in your policy.

What happens if the assistant leaks personal data?

In Canada, a breach that creates a real risk of significant harm must be reported to the OPC and affected people notified as soon as feasible, with records kept for two years. In India, once Rule 7 is in force, affected individuals must be told without delay and the Board given detailed information within 72 hours; the Act's Schedule allows penalties up to 200 crore rupees for failing to notify.

Impinge Solutions designs AI assistants and agents with privacy decisions documented from the first sprint, and its AI readiness audit includes a privacy and risk register. This article is general information; have your policy reviewed by a lawyer before publishing.

Sources

Are you ready to partner with us?

Our good-natured team is waiting to hear your business requirements.

Book a free project call

Stay informed with our newsletter