Lok Sabha Question No. 556 (UNSTARRED), answered on 2025-12-03
Subject: Accountability and Audit Mechanisms for Artificial Intelligence
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Shri Vishnu Dayal Ram

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 556

TO BE ANSWERED ON: 03.12.2025

## ACCOUNTABILITY AND AUDIT MECHANISMS FOR ARTIFICIAL INTELLIGENCE

## 556.   SHRI VISHNU DAYAL RAM:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a) whether the Government has instituted any accountability and audit mechanisms for Artificial Intelligence (AI) systems that process or collect users' personal data;
- (b)  the  existing  or  proposed  regulations  to  ensure  that  personal  information  is  not  misused  or stripped from users without consent;
- (c) whether any independent audit bodies have been set up to monitor AI-based data processing and ensure compliance with data protection norms; and
- (d) the steps taken by the Government to enhance transparency and ethical governance in the use of AI technologies?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI JITIN PRASADA)

(a)  to  (d):  The  policies  of  the  Government  of  India  aim  to  ensure  an  open,  safe,  trusted  and accountable cyberspace for users.

This is particularly important in the context of the rapid growth of Artificial Intelligence (AI) adoption and data-driven technologies.

## Accountability & Audit Mechanisms

The Digital Personal Data Protection Act, 2023 ('Act'), and the Digital Personal Data Protection Rules, 2025 ('Rules'), were notified on 13 November 2025

- Personal  data  to  be  processed  for  a  lawful  purpose  with  a  free,  specific,  informed, unconditional and unambiguous consent from the individual
- Consent to be preceded or accompanied by a notice describing the personal data to be collected and the specific purpose for its processing
- Rules  require  Data  Fiduciaries  to  implement  appropriate  security  safeguards,  such  as encryption or masking, to protect data and prevent breaches

Moreover, users retain the right to withdraw their consent at any time. Upon such withdrawal, the Data Fiduciary is obliged to erase the personal data, unless its retention is required by law.

The Act requires every Significant Data Fiduciary to appoint an independent data auditor to assess compliance with its provisions.

## SPDI Rules

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, (SPDI Rules) are issued under Section 43A of the IT Act, 2000,

These currently govern protection of sensitive personal data and will remain in force until the obligations under the DPDP Act come into effect

- Personal data must be collected and used only for the stated purpose and kept secure
- Organisations handling sensitive personal data must publish a privacy policy detailing how data will be used
- Prior consent of the data provider is required for disclosure to any third party
- Sensitive personal data must not be published and must not be further disclosed by third parties
- Reasonable security practices and procedures must be implemented to prevent misuse

The Government approved the IndiaAI Mission in March 2024 as a national-level initiative to build a comprehensive, inclusive, and sustainable AI ecosystem.

One of its key pillars, Safe & Trusted AI, seeks to balance innovation with robust governance frameworks to ensure responsible AI adoption.

## Safe and Trusted AI

This  pillar  under  IndiaAI  mission  enables  the  implementation  of  Responsible  AI  projects.  It includes  the  development  of  indigenous  tools  and  frameworks,  self-assessment  checklists  for innovators, and other guidelines and governance frameworks.

Eight Responsible AI Projects have been selected to address the need for robust guardrails to ensure the responsible development, deployment, and adoption of AI technologies.

The  projects  cover  a  range  of  critical  themes,  including  Machine  Unlearning,  Synthetic  Data Generation, AI Bias Mitigation, Ethical AI Frameworks, Privacy-Enhancing Tools, Explainable AI, AI Governance Testing, and Algorithm Auditing Tools.

******