What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India's law on processing digital personal data. Rules under the Act have been notified with phased timelines for different obligations. Check the current status with your legal adviser. This page is a practical introduction, not legal advice.
In the Act's language, your business is usually the Data Fiduciary (deciding why and how data is processed), your customers are Data Principals, and vendors processing data for you (WhatsApp providers, AI model providers, hosting) are Data Processors.
Why do AI chatbots need extra care?
Chatbots and agents collect personal data by default: names, phone numbers, addresses, order histories, and sometimes health or financial details customers type in unprompted. AI agents may also send that text to a model provider for processing. That makes it important to know what you collect, why, where it goes and how long you keep it.
What practical principles should your chatbot follow?
- Notice and consent: tell people what you collect and why, in clear language, and get consent where required.
- Purpose limitation: use data only for the purpose you collected it for. Order support data shouldn't silently become marketing data.
- Data minimisation: don't ask for what you don't need. A booking bot rarely needs a date of birth.
- Retention: delete or anonymise data when it's no longer needed.
- Security: limit access, use secure integrations and keep logs.
- Rights: make it possible to respond to requests to access, correct or erase data.
- Breach readiness: know what you'd do and whom you'd notify if something went wrong.
How do we design for this in practice?
- Agents connect only to the systems they need, with least-privilege access.
- The stop rule includes data rules: what the agent must never ask for or repeat.
- Sensitive conversations (health, finances) are routed to people early.
- Where data control matters, plumbing can run on infrastructure you control, for example a self-hosted n8n (see our tool comparison).
- We document which vendors process which data, so you can review contracts and notices.
Which vendor questions should you ask?
- Where is data stored and processed?
- Does the AI provider use our data for training? Can we opt out?
- How long are conversation logs kept, and can we delete them?
- Who on the vendor side can access our data?
How do we apply this in client work?
Everything on this page feeds into how we run pilots. We start with a consultation to understand the process and the people involved, then write a one-page scope: the trigger, inputs, steps, outputs, a success measure and a stop rule that says what the agent may do alone, what needs approval and when it must hand over. We build inside the tools you already use, test on real or realistic cases including awkward ones, and review the results with your team before anyone talks about expanding.
We keep a few habits on every project: we never publish invented results, we label examples as illustrations, we list third-party costs separately, and we say so plainly when something isn't worth automating yet. If that sounds like the kind of partner you want, read the pilot process or message us on WhatsApp.
What should you prepare before talking to us?
You don't need a technical brief. A useful first conversation needs only a few things, and gathering them is valuable even if you never work with us:
- The process in plain words: what triggers it, who does what, and where it usually goes wrong.
- Rough volumes: how many messages, orders, tickets or invoices per week. A one-week tally is enough.
- Your tools: WhatsApp app or API, CRM, sheets, accounting or helpdesk software, including versions or plans where you know them.
- Three real examples: typical messages or cases, plus one awkward one, with personal details removed.
- What must never happen: the mistakes that would hurt most. These become the first lines of your stop rule.
- An owner: the person who will review the workflow once it runs.
Send these on WhatsApp or by email, or run the pilot scorecard first.
How does a pilot with us work?
Every engagement follows the same four steps. Consult: you walk us through the process, the tools and where it breaks. Pick the pilot: we choose one workflow and write down its inputs, outputs, tools, stop rule and success measure. Ship: we build it into the tools you already use and test it on real cases. Review: your team checks what the agent did and what it escalated, then decides whether to tune it, expand it or stop. Read the full pilot process.