India's Digital Personal Data Protection Act, 2023 sets the rules for handling digital personal data. It does not mention AI specifically, but it applies to AI tools in exactly the same way as to email, spreadsheets or a project database: if personal data goes in, the Act applies.
Which AEC data counts as personal data?
Personal data is any data about an identifiable individual. In a typical architecture, engineering or construction firm that includes:
- Clients and their families: names, phone numbers, addresses, and details in briefs for homes, such as household members and their needs
- Staff and job applicants: CVs, salary and attendance records, appraisals
- Site workers: identity documents, attendance, wage and safety records, photos and CCTV footage
- Consultants and vendors: named contacts and correspondence
- Occupants and visitors: access-control logs and sensor data linked to people in buildings you manage
Drawings and models are usually not personal data on their own, but they can become personal data when they carry an owner's name, a flat number linked to a resident, or photos of people.
When does using AI tools involve personal data?
More often than teams expect. Common examples:
- pasting a client email thread into an AI assistant to draft a reply
- uploading a site progress report that names workers or includes photos of them
- summarising CVs or staff feedback
- running AI search over a document folder that includes contracts with named individuals
Each of these sends personal data to the AI service, which then processes it on your behalf. Under the Act, your firm remains responsible for that data.
What should you check before using an AI service?
- Purpose and lawful basis. Is there consent, or another legitimate use the Act allows, for this processing? Use personal data only for the purpose it was collected for.
- Data minimisation. Can the task be done without names and contact details? Often it can: remove them before you paste or upload.
- The provider's terms. Does the service use your inputs to train its models? Business plans of major AI services often exclude this by default, while personal plans may need an opt-out. Read the current terms.
- Security safeguards. The Act requires reasonable security safeguards to prevent personal data breaches, and its schedule sets penalties of up to ₹250 crore for failing to take them. Check access controls, encryption and who in your firm can use the tool.
- Retention. Personal data should be erased once its purpose is served. Check how long the AI service keeps chats and files, and whether you can delete them.
- Breach response. Know how you would detect a breach involving an AI tool, and how you would notify the Data Protection Board of India and the affected people.
How should your AI usage policy cover the DPDP Act?
Your AI usage policy should turn these checks into simple rules people can follow:
- which AI tools are approved for which kinds of data
- what must never be entered: for example, identity documents, salary data or client personal details in personal accounts
- who approves a new tool, and on what basis
- how people can exercise their rights: to a summary of their data, and to correction, erasure and grievance redressal
Keep it short and specific. A rule like "no client names or phone numbers in unapproved AI tools" is easier to follow than a paragraph about data protection principles. AI governance is about making these decisions once, in writing, so that every project team doesn't have to make them again.
When should you take legal advice?
Take advice from a lawyer when you:
- build a custom AI system that processes personal data at scale, such as worker attendance or occupant data
- process children's data, for example in school or residential projects
- transfer personal data to providers outside India under contracts you haven't reviewed
- receive a complaint, a rights request you're unsure about, or suspect a breach
The DPDP Rules, 2025 bring the Act's obligations into force in phases, so check the current requirements before you finalise your policy. Our training and AI governance service helps AEC firms write a practical AI usage policy that covers data protection, and our AI strategy work includes a data review before any pilot.
Sources
Frequently asked questions
Does the DPDP Act apply to architecture and construction firms?
- Yes, whenever a firm processes digital personal data, such as client contacts, staff records or site-worker details. The Act applies to organisations of every size; the obligations depend on what data you process and why.
Can we use ChatGPT or other AI tools with client data under the DPDP Act?
- Only with care. Check that you have a lawful basis for the processing, that the AI service's terms and security are acceptable, and whether the provider uses your data for training. Leave personal data out whenever the task doesn't need it.
Is this guide legal advice?
- No. It is a practical checklist for AEC firms. Take advice from a lawyer on your specific processing, contracts and the current DPDP Rules.