1) I keep seeing AI teams shelve DPDP as a 2027 problem and treat that as breathing room. It is not.
India's Digital Personal Data Protection Rules make the substantive obligations, notice, consent, and data principal rights enforceable from May 2027 for anyone processing Indian personal data.
If your training data includes faces, voices, or medical images, this thread is for you.
2) Start with why an annotation team is even in scope.
Because much of the training data is personal data. Faces. Voices. Chat logs. Medical images. Support tickets.
The moment the law allows a person to withdraw consent for that data, the datasets you built from it are in scope, too.
3) Here is the part that catches people out.
Withdrawal does not just mean "stop collecting." It reaches backwards into datasets already built. If you cannot trace an annotated example back to its consent record, you cannot honour a withdrawal cleanly.
Provenance stops being a nice-to-have and becomes an operational requirement.
4) Worth being precise about who carries this.
Under the Act, the obligation sits with the data fiduciary, the entity that decides why the data is processed. For most annotation work, that is your client, not the labelling vendor.
But it flows down by contract. So,1 in 2027, clients will start asking their annotation vendors one hard question: can you prove where each example came from, and delete it on request?
5) The timeline, so you can plan:
Nov 2026: the Consent Manager registration framework becomes operational
13 May 2027: substantive obligations (notice, consent, data principal rights) become enforceable
The exact day has shifted between secondary sources, so confirm both against the official MeitY notification before you brief leadership.
6) What I would do now, in plain terms:
→ Tag every dataset with its consent basis at ingest
→ Keep a record that links each labelled example back to the source and consent
→ Make "withdraw" a workflow your pipeline can run, not a fire drill
None of this is exotic. It is just very hard to retrofit.
7) The teams that will struggle in 2027 are not the ones who missed the law.
They are the ones who built large annotated datasets with no way to answer "where did this example come from, and can we still use it?"
Start the record now. Make provenance the default, because you cannot backfill it.
#DPDP #DataAnnotation #AI #DataLabelling #Predusk #PreduskAI
NOTE: Sources (checked 4 July 2026): DPDP Act 2023 and DPDP Rules 2025. Consent Manager framework operational Nov 2026; substantive obligations enforceable 13 May 2027. Confirm exact dates on the MeitY notification before posting. Not legal advice.
