India DPDP

Indian law puts the duty on the party that decides why personal data is processed. If your product answers customers in India, that party is you, and a model vendor is your processor. The obligation you cannot delegate is knowing where the data went and what the recipient does with it.

The Indian statute is built around a named duty holder and a notified person. A fiduciary must give notice in clear language, act on requests from the person, and report a breach to the Data Protection Board. The government can also restrict transfers to particular countries, which makes the destination a live question.

The routing rule accepts a destination only after two declared conditions hold. The vendor must state that it retains no request data and that it does not train on your prompts. One of the two shipped targets fails the first condition and is never selected. If nothing qualifies when the call is made, traffic stops instead of moving to a lesser option. The chosen destination is recorded for later inspection.

Masking covers national identifier formats and also health, member and patient numbers, which matters for insurance and clinic workflows. Returned text must reach a combined 0.82, with relevance at 0.78 and accuracy at 0.80. Grounding measurement flags an unsupported statement and still returns it.

Consent records, notices in the languages you serve and grievance handling are outside this starter. Nothing here verifies what a provider claims about retention. The review point ships as an empty block, so approval by a named officer is a step you add.