Discuss whether the DPDP Act, 2023 and the IT Act, 2000 together adequately address breaches caused by autonomous AI systems. Suggest reforms.

Autonomous ("agentic") AI systems plan and carry out multi-step tasks with little human oversight. They can cause breaches by going beyond their authorised limits, or attackers can use them to automate reconnaissance and exploitation. In 2025 CERT-In handled over 29.44 lakh cyber incidents [2]. India's two main laws give a sound base for dealing with these breaches, but they leave important AI-specific gaps.

Where the existing framework is adequate

• Cause-neutral duty: Data Fiduciaries must maintain reasonable security safeguards, whoever or whatever causes the breach. Failure can draw a penalty of up to ₹250 crore [1].
• Breach notification: Every personal data breach must be reported to the Data Protection Board and to each affected Data Principal [1].
• Incident response: Section 70B of the IT Act empowers CERT-In to monitor threats, coordinate responses and issue binding directions [2].
• Constitutional anchor: Puttaswamy (2017) recognised privacy as part of Article 21.

Gaps with respect to autonomous AI

• Liability vacuum: IT Act offences (Sections 43 and 66) assume a human wrongdoer. When an agent exceeds its scope during testing, it is unclear who is liable: the developer, the deployer or the user.
• Narrow scope: DPDP covers only digital personal data. AI-driven intrusions into industrial or operational systems fall outside it.
• No victim compensation: The DPDP Act omitted Section 43A of the IT Act [3]. Penalties now go to the State, not to the people affected.
• Reactive design: Both laws act only after a breach is detected. Neither requires pre-deployment red-teaming (simulated attacks), sandboxing of agents or audit logs.
• Soft AI governance: The India AI Governance Guidelines (2025) are non-binding [4].

Reforms

• Use the proposed Digital India Act to define AI agents and set tiered liability for developers and deployers.
• Require sandboxing, kill-switches and action logs for agents tested on live infrastructure. Strengthen the AI Safety Institute proposed in the guidelines [4].
• Restore a compensation route for Data Principals.
• Make cyber hygiene mandatory, including credential management and multi-factor authentication, because agents mostly exploit known weaknesses.
• Set up single-window reporting that aligns CERT-In and Board timelines. CERT-In should also publish anonymised post-incident reviews so that lessons are shared.

Together, the DPDP Act and the IT Act deal well with the consequences of a breach, but not with the autonomous causes behind AI-driven ones. A risk-based law focused on prevention, with clear liability and audited AI deployment, can close this gap. It would protect the privacy guaranteed under Article 21 and India's trust-based digital economy.