The objective of AI Audit under DPDPA may be derived from
a) Reasonable Security obligations under Rule number 6
b) Additional responsibilities of a Significant Data Fiduciary under Rule number 13
The concern of DPDPA related to AI is to ensure that if it is used for processing personal data, then the risk of harm caused to the data principal by the use of AI should be recognized and mitigated.
In the case of Significant Data Fiduciaries (SDF), the SDF shall observe due diligence to verify that technical measures including algorithmic software adopted by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals [Rule number 13 (3)].
Under DGPSI as a compliance framework, AI Risk is considered an “Unknown Risk” and therefore is a “Significant Risk”. Hence the mere use of AI either by a data fiduciary or any of its data processors itself shall render it a SDF.
In view of the Rule 13(3), it is necessaryy for an SDF using AI to verify on its own the AI algorithm and ensure protection of Data Principal rights by exercising “Due Diligence”. Such due diligence includes
“Assessing that the AI Algorithm processes personal data for a lawful purpose and with either a specific consent or under legitimate use.”
“Ensuring that no cross border transfer of data is permitted without permission”
“Ensuring that any personal data breach which includes impermissible use of personal data is recognized and notified”
“Ensuring that the processing of data of minors is recognized and flagged for consent by the verified guardian and reversed after the minoir attains majority”.
“Ensuring that the processing of data of a mentally disabled person is recognized and flagged for consent by a legal guardian”
“Ensuring that the death of a data principal is recognized and action taken to give effect to the nmomination if any”
“Ensuring that withdrawal of consent or expirty of the purpose is recognized so that data retention is within the legally permitted time limits”
“Ensuring that whenever personal data is required to be archived or disclosed under any legal obligation, the need is recognized and given effect to.”
” Ensuring that if the use of personal data for AI learning is not permitted, it is not used for machine learning”
” Ensuring that the the processing of personal data by AI is without any discrimination and bias”
“Ensuring that the output of the processing results in accurate and reliable data output”
” Ensuring that evidence of processing as may be required under law is preserved”.
” Ensuring that there is adequate transparency and explainability in the processing of Personal data by the AI which gets reflected in the summary of processing provided when a data principal exercises his right to access”
The FDPPI approach in DGPSI-AI is to ensure the above assurances. Even the AIGSI which extends to the developer of the AI algorithm and the intermediaries involved in bringing the AI algorithm from the foundation model developer to the end user data fiduciary, the underlying objective is legal compliance under DPDPA 2023.
In comparison, CERT In AI audit guidelines focus on information security in general and recognizes Privacy and Data Security as one of the 9 different governance domains. AIGSI also focusses on guardrails, prevention of hallucination etc which need to be the basis of audits which is also recognized by the CERT In.
However the assessment of risk under AIGSI and CERT In may still differ like the objectives of an ISMS audit and DPDPA audit. The CERT In risk assessment is from the perspective of the organization while the DPDPA perspective is always from the perspective of the data principal.
Naavi
