AI Governance · Module 09
DPDP made algorithmic accountability a statutory duty, not a policy aspiration. Sec. 10(2)(c)(iii) obliges a Significant Data Fiduciary to perform due diligence on algorithmic software that may risk the rights of Data Principals — which means knowing what models you run, on what data, with what oversight.
Primary DPDP sectionsSec. 10(2)(c)(iii)
9
Regimes assessed from one description
5
Reasoning layers exposed per decision
Figures illustrative.
How it works
Algorithmic due diligence becomes a standing record rather than a scramble — which models touch personal data, how each was assessed, and who signed off the residual risk.
01
Every model in production, with owner, purpose and training-data provenance
02
EU AI Act risk tier and DPDP Sec. 10 applicability
03
Bias and fairness testing, human-oversight design documented
04
Per-decision detection chain — which layers agreed, which dismissed
05
Residual risk signed off, findings tracked to closure
Sec. 10(2)(c)(iii) — due diligence of algorithmic software that may risk the rights of Data Principals.
Capability
A register of every model in production, the personal data it was trained on, the purpose it serves and the decisions it influences.
The same assessment engine that runs DPIAs covers the EU AI Act, so one description of a system produces the output each regulator expects.
Detection and classification decisions expose which layer produced them and which dismissed them, so a finding can be defended rather than merely reported.
Algorithmic due diligence becomes a standing record rather than a scramble — you can show which models touch personal data, how each was assessed, and who signed off the residual risk.
DPDP alignment
What the Digital Personal Data Protection Act, 2023 requires, and the control that satisfies it.
| Section | What the Act requires | How the product satisfies it |
|---|---|---|
| Sec. 10(2)(c)(iii) | Undertake such other measures as prescribed, including due diligence of algorithmic software that may risk the rights of Data Principals. | Algorithmic due diligence runs as a dedicated assessment type covering model purpose, training-data provenance, bias testing and human oversight, tracked per model rather than per programme. |
| Sec. 10(2)(c)(i) | A Significant Data Fiduciary must undertake periodic Data Protection Impact Assessments. | Models are assessed on the same cadence and in the same engine as processing activities, so an AI system is never assessed outside the privacy programme that governs its data. |
| Sec. 8(3) | Ensure completeness, accuracy and consistency of personal data where it is used to make a decision affecting the Principal. | Model lineage ties each decision back to the attributes and copies that fed it, so accuracy obligations reach the inputs of automated decisions rather than stopping at the system of record. |
| Sec. 11 | The Principal may obtain a summary of the processing activities performed on their personal data. | Automated processing is disclosed as a named activity with its purpose and its model, rather than being hidden inside a system description. |
Sec. 10 duties carry up to ₹150 Cr, and SDF status is notified by the Central Government by class — an enterprise can acquire algorithmic due-diligence obligations without changing a line of its own code.
Solutions by industry
The sectors carrying the most DPDP exposure for this control, each with its own threat model and regulators.
A DPDP readiness walkthrough maps your obligations to the controls that already exist, and names the gaps that do not.
