"Anonymisation is no longer a sufficient safeguard in the age of large AI models." Discuss with reference to India's DPDP framework.

Anonymisation means removing identifiers so that data cannot be linked to a person, and it has long been the main safeguard of data protection. Large AI models undermine it. Personal data can become embedded, or "memorised", in model weights during training and later be reproduced [1]. India's DPDP framework was built for databases, so it only partly addresses this risk.

Why anonymisation fails against large AI models

• Regurgitation: deleting data from the training database does not undo what the model has learnt. Memorised data can still be pulled out of its outputs [1].
• Inference attacks: membership and property inference attacks can reveal personal details about the people whose data was used in training [1].
• Aggregation through scraping: scraped public data is combined during fine-tuning, so scattered harmless fragments can add up to a profile of a person [1].
• Open-source spread: models are fine-tuned and passed on, so a deletion at the source does not reach every copy [1].

Where the DPDP framework helps

• Constitutional anchor: the Puttaswamy judgment (2017) requires any intrusion on privacy to pass the tests of legality, necessity and proportionality [2].
• Rights of the Data Principal: under the DPDP Rules, 2025, erasure and correction requests must be handled within 90 days, with compliance phased in over 18 months [3].
• Significant Data Fiduciaries must carry out independent audits and Data Protection Impact Assessments [4].

Where it falls short

• Erasure versus model weights: full removal may not be possible without destroying the model, and machine unlearning is still developing [1].
• Public-data exclusion: the Act does not cover personal data the user has made public, which is exactly the data that gets scraped [5].
• State exemptions: the government can exempt its agencies on grounds such as security and public order [6].
• No leakage testing: the law places no explicit duty on anyone to test trained models for personal-data leaks.

Way forward

• Narrow the public-data exclusion for AI training through targeted amendments, the approach favoured by the India AI Governance Guidelines [7].
• The Data Protection Board should issue guidance on what counts as valid erasure from a trained model.
• Make regurgitation testing part of the impact assessments that Significant Data Fiduciaries must do [4], and promote privacy-enhancing technologies such as differential privacy and federated learning [1].

Anonymisation is still necessary, but it no longer works as a stand-alone shield once data lives inside model weights. India can make the DPDP framework ready for AI through targeted amendments, technical safeguards and cooperation between regulators and industry [1]. This would protect the Article 21 right to privacy and meet the Puttaswamy proportionality standard without holding back AI-led innovation.