DPDPA & The Future Of AI Governance:
Securing India's Digital Trust

There is a moment in Chapter 1 of this book that stopped me mid-read. A small farmer named Ramesh walks into a branch after being rejected for a Rs 50,000 loan — the kind of loan that would buy seeds and fertilizer to keep his livelihood going. His credit history is clean. He has never defaulted. He has good references. And yet an AI system flagged him as “high-risk” in thirty seconds flat. When he asks why, the loan officer is genuinely unable to tell him. Nobody can. The data scientist who built the model never heard of Ramesh. The CEO hasn’t either. The algorithm, of course, answers to no one.

Dr. Lalit Gupta uses Ramesh’s story not as a cautionary tale designed to frighten readers away from AI, but as a precise diagnosis of the central disease this book sets out to treat: the accountability gap. It is one of the most effective opening moves I have seen in a book of this kind, and it tells you something important about the author’s instincts. He is not interested in speaking to policy experts from a safe theoretical distance. He wants the reader to feel the governance problem before he explains it.

What This Book Is Actually About

The title might suggest a dry legal commentary on India’s Digital Personal Data Protection Act. It is anything but that. What Gupta has actually written is a governance blueprint — a practical, structured guide for organisations that deploy AI and are now trying to figure out what responsible deployment looks like in the Indian context.

The DPDPA arrived in 2023, came into force quietly, and most Indians outside legal and policy circles barely noticed. Yet by the time it became law, AI had already been making consequential decisions about those very citizens for years: credit scores generated by models nobody could interrogate, insurance premiums shaped by data that policyholders never knowingly shared, government benefits routed or withheld by systems operating faster than any human reviewer could follow.

The gap Gupta keeps returning to is this: DPDPA governs data, but the actual problem India faces is about decisions. Autonomous, algorithmic, largely invisible decisions made at a scale no previous legal framework was designed to handle. A system can tick every DPDPA compliance box and still make discriminatory decisions. It can have all the right consent notices and still have no idea why its credit model rejects applicants from certain postal codes. Compliance and accountability, Gupta insists, are not the same thing.

The A-T-E-S Framework

At the heart of the book is what the author calls the A-T-E-S Model — four governance pillars every AI-deploying organisation in India needs to take seriously:

Accountability — Who actually owns AI decisions, and who answers when those decisions cause harm?

Transparency — What information gets disclosed to users and regulators, and how?

Explainability — Can affected people genuinely understand why an AI made the decision it did, in language they can actually follow?

Security — How are AI systems protected against the threats already targeting them, including model poisoning, adversarial inputs, and deepfake fraud?

These are not abstract principles dressed up in acronym form. Gupta grounds each pillar in the Indian reality: Indian organisational structures, Indian regulatory architecture, and India’s specific position as a country rolling out AI across a billion-person population while the governance norms are still being written. He is very clear that he has not tried to transplant the EU AI Act into an Indian context. He makes a case for something genuinely fit for Indian scale and Indian complexity.

Structure and Readability

The book is organised into five sections, moving from foundation to implementation. The first section establishes where India currently stands — the governance gap, DPDPA’s structure, its strengths, and its limits. The second digs into the specific friction points between AI and privacy: how AI uses personal data in ways that challenge the Act’s consent and purpose-limitation architecture, and what the law’s rights actually mean when applied to algorithmic decisions in practice.

Sections three and four are operational. This is where the book earns its keep. You get AI risk management, cybersecurity for AI systems, privacy-by-design in AI products, a step-by-step DPDPA compliance guide for AI deployments, and practical guidance on conducting Data Protection Impact Assessments. Each chapter includes worked examples, template snapshots, and case studies drawn from Indian organisations in banking, insurance, healthcare, and education.

The fifth section looks at industry-specific implications and closes with a considered argument about what India’s AI governance architecture needs to look like over the next five years.

One design choice that distinguishes this book from others in the genre: each chapter includes separate “Professional” and “User” sections. The professional track speaks directly to compliance teams, cybersecurity practitioners, and business leaders. The user track addresses citizens — what rights they actually hold under DPDPA and what it looks like to exercise those rights when a loan gets denied or a government benefit does not arrive. It is an unusually democratic decision for a governance book, and it works.

Strengths

The writing is clear without being simplistic. Gupta has the ability — not common in this space — to move between technical precision and human-scale storytelling without losing either. The Ramesh story is one example. A UPI fraud detection scenario at a pharmacy at 11 PM is another. These vignettes do real intellectual work; they are not decoration.

The book is also commendably honest about the state of the law. DPDPA is new. The DPDP Rules 2025 are still being operationalised. The Data Protection Board is being constituted. Gupta is careful to distinguish between what is settled and what is still in motion, and he flags open questions rather than papering over them.

The note on AI assistance at the beginning of the book is worth mentioning. Gupta discloses that AI tools were used selectively in the editing and refinement of the manuscript, but that all analyses, arguments, frameworks, and conclusions are his own. Given that the book’s central subject is accountability and the responsible use of AI, this transparency feels not just appropriate but necessary. It models exactly the kind of disclosure culture the book advocates.

A Few Honest Observations

This is a first edition, and in places it reads that way. Some chapters carry more analytical weight than others, and a handful of section transitions feel slightly abrupt. The case studies are explicitly noted as illustrative — names and identifying details changed where necessary — which is ethically correct but occasionally means the reader is left wanting more granular specificity about what actually happened in a given organisation.

The book also takes on a very wide audience simultaneously: lawyers, compliance teams, cybersecurity professionals, business leaders, and ordinary citizens. This is admirable in intent, but it means that specialists in any one discipline may occasionally find certain sections pitched slightly too broad. That said, the dual “Professional/User” chapter structure goes some way toward addressing this, and the breadth is arguably a feature rather than a flaw: the argument Gupta is making is precisely that AI governance cannot be siloed into any single profession.

Who Should Read This

Anyone working in compliance, legal, cybersecurity, or technology leadership within an Indian organisation that uses AI — which, increasingly, means almost every organisation of any size. Business leaders who have been treating AI governance as a technical or legal problem rather than a strategic one will find the book particularly clarifying. Policymakers and regulators will find a considered perspective on where the current legislative framework falls short and what the next generation of governance norms needs to address.

Citizens who want to understand what rights they actually hold in an AI-mediated world — and what it looks like to exercise those rights — will find the user-facing sections genuinely useful, which is rarer than it should be.

Final Verdict

DPDPA and the Future of AI Governance is the kind of book that arrives at exactly the right moment. India is deploying AI at extraordinary scale. The governance frameworks being built — or not built — right now will shape what Indian citizens can trust, challenge, and hold accountable for a generation. Gupta makes a compelling case that the question Indian organisations need to be asking is not merely “Are we DPDPA compliant?” but “Are our AI systems actually accountable?”

That is a harder question. It does not have a checklist answer. This book gets closer to providing one than anything else currently available in the Indian context.

Every “Tech-Literate” Person Should Read This:

This book is a call to action for “governance literacy.” It empowers users to understand their digital rights in an era where algorithms often operate without transparency or human oversight. It is an indispensable resource for anyone wanting to protect their digital dignity and understand the future of India’s digital ecosystem.

The book also dispels the comfort of “anonymized” data, explaining that AI can re-identify individuals using just a few behavioral data points. Even two or three behavioral patterns in India’s dense urban settings can be enough to uncover a person’s identity.

Twenty-five years in this industry and I’ve watched compliance arrive the same way every time: late, panicked, and as a spreadsheet someone fills the night before the audit. Gupta’s book is an argument – a persuasive one – for never doing that with AI.

This lands differently for me than most tech books because I straddle both its audiences. As an IT professional, I’ve lived through the era when “governance” meant an ISO checklist nobody read. As a Mutual Fund Distributor for the past five years, I’m now on the other side of the glass – a Data Fiduciary in DPDPA’s language, holding KYC documents, PANs, bank details, and financial histories of families who trust me with them. Reading the chapter on how AI converts personal data into predictions, I wasn’t thinking about abstract citizens; I was thinking about my own client folder.

The book’s strongest asset is its storytelling-first structure. The boardroom scene where a bank’s algorithm rejects flood victims’ loans and the CEO’s question – “Who owns this?” – is met with silence, is worth the price of the book. So is the deepfake CFO fraud, executed in four hours with off-the-shelf software. Gupta’s A-T-E-S framework (Accountability, Transparency, Explainability, Security) is simple enough to remember and concrete enough to implement, and the DPIA chapter is genuinely usable, not decorative.

Weaknesses? It’s repetitive in stretches, as framework books tend to be, and some passages read like polished consulting decks. The law itself is still evolving, so parts will date quickly. But the author is refreshingly honest about the Act’s limits rather than cheerleading it, and his disclosure about AI’s role in editing the book is a small act of the very transparency he preaches.

For anyone in Indian IT, fintech, or financial distribution who touches client data – which is to say, all of us – this is less a reading choice than a professional precaution.

DPDPA & the Future of AI Governance is a timely and insightful book that clearly explains the intersection of AI governance, data privacy, and India’s Digital Personal Data Protection Act. The author presents complex legal and technological concepts in a practical and accessible manner, supported by relevant examples and governance frameworks. This book is a valuable resource for professionals, researchers, policymakers, and anyone interested in understanding responsible AI and data protection in the Indian context. Highly recommended.

This book is a timely reminder that technology should serve people, not replace their judgment. It highlights why fairness, transparency, and accountability matter just as much as innovation. I appreciated how it balances the potential of AI with the need for human oversight, making it a thought-provoking read for anyone interested in the future of technology.

DPDPA & The Future of AI Governance: Securing India’s Digital Trust by Dr. Lalit Gupta is a timely and insightful guide to India’s evolving data privacy and AI governance landscape. The book explains the Digital Personal Data Protection Act (DPDPA) in a clear and practical manner while highlighting the importance of ethical AI, responsible data usage, and digital trust. It effectively bridges the gap between technology, law, and governance, making complex concepts accessible to professionals, students, business leaders, and policymakers alike. A valuable read for anyone seeking to understand how India can balance innovation with privacy, accountability, and responsible AI development.