What AI Companies Do With What You Type: An India Guide

This is also where deletion is widely misunderstood. Deleting a conversation removes it from your history and, after the retention window, from the vendor's live systems. It does not reach into a model that has already been trained and remove your contribution, because that is not technically available at any vendor. Deletion is forward-looking housekeeping, not a recall.

For Indian users there is a further and less comfortable point. The Digital Personal Data Protection Rules were notified on 13 November 2025, which was widely reported as India getting a data protection regime. What actually commenced on that date was institutional: the framework for the Data Protection Board. The provisions an individual would rely on - notice and consent, breach notification, and the machinery for making a rights request - are phased across an eighteen-month window, with Consent Manager provisions arriving on 13 November 2026 and substantive compliance required around 13 May 2027. So an Indian user in September 2026 has a law, an institution, and no enforceable individual remedy under it yet. Your protection is the vendor's settings page.

The practical consequence is that this is a period to build habits rather than to rely on rights. Open the data controls in each AI account you use and read what the current setting says, because vendor defaults have changed repeatedly and in both directions, including for existing users who were not asked again. If you use AI for work, move anything sensitive onto a business or API tier where training is off by default rather than relying on a consumer opt-out. And keep a short list of what does not go into any of these tools at all: customer personal data, identity numbers, financial account details, unpublished commercial terms, anything under an NDA. That list costs nothing to maintain and it is the only control that does not depend on a policy staying where you last read it.

For Indian businesses the same timeline reads as preparation time. The obligations are known and dated. Between now and May 2027 the useful work is finding out what staff are actually pasting into these tools, moving those workflows onto tiers that do not train by default, and being able to say on what basis customer data is being processed. That is considerably easier to do now than in the month the rules start to bite.