Artificial Intelligence, Data Breaches and the Digital Personal Data Protection Act, 2023: Assessing the Adequacy of India's Legal Framework: A Comparative Study

Artificial intelligence has spread into almost every data-heavy sector in India, from banking to healthcare to public service delivery, and this has quietly changed what a data breach even looks like. India's Digital Personal Data Protection Act, 2023 was finally brought to life by the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, giving the country its first working data protection regime. But the Act was written without any real attention to how AI systems fail: model inversion, membership inference, training data memorised and later regurgitated by a chatbot, none of these appear anywhere in the statute. This paper looks at whether the DPDP framework, as it now stands, is actually equipped to handle breaches that originate from AI systems rather than from a simple hacked database. To test this, the paper compares India's approach with the European Union's General Data Protection Regulation, the United States' sectoral and state-level model built around the California Consumer Privacy Act and its 2020 amendment the California Privacy Rights Act, and Singapore's Personal Data Protection Act. The comparison shows that the DPDP Act gets some genuinely useful things right, particularly its Consent Manager system and its heavy penalties, but it is thin on algorithmic transparency, does not require impact assessments for most AI deployments, gives no one a right to contest a purely automated decision, and leaves the breach notification deadline undefined. The paper ends with concrete suggestions for the Data Protection Board, the Ministry of Electronics and Information Technology, and future rule making, aimed at closing these gaps before the Act's phased rollout finishes in May 2027.