Private AI: using AI on sensitive data without sending it out

Why this matters now

When someone pastes a patient summary, a tender document or a plant's maintenance records into a public chatbot, that data leaves the organisation. It is processed, and may be stored, under the provider's terms rather than yours.

Indian authorities have flagged the risk. In early 2025, the Ministry of Finance advised its staff to avoid AI tools such as ChatGPT and DeepSeek on office computers and devices, citing the confidentiality of government data. In March 2025, CERT-In issued an advisory on using generative AI safely. It describes threats such as data poisoning, model inversion and prompt injection, and advises users not to share sensitive information with AI tools.

None of this means avoiding AI. It means choosing where it runs.

What private AI means

In a private AI deployment, the language model, the documents it draws on and the record of every question and answer all stay on infrastructure the organisation controls. In practice, there are three options:

• On-premise servers in your own facility — including fully air-gapped systems with no internet connection, for the most sensitive environments.
• A private cloud environment dedicated to you, where you hold the keys and decide who has access.
• For government workloads, cloud services empanelled by MeitY, which are hosted in India and chosen under MeitY's cloud selection guidelines.

Capable open-weight language models can now run on a single well-equipped server. Licences differ from model to model, so check the terms of each one before using it commercially.

What the law says — and what it doesn't

The Digital Personal Data Protection Act, 2023 takes a negative-list approach to cross-border transfers. Under section 16, the government may restrict transfers of personal data to countries it notifies. As of September 2026, no such list has been notified. Section 16 also preserves any stricter rule in another law, such as the Reserve Bank of India's 2018 direction that payment system data be stored only in India.

The DPDP Rules, 2025 were notified in November 2025 with an 18-month phase-in, so most obligations on organisations apply from May 2027. Those obligations — reasonable security safeguards, breach notification, deleting data once its purpose is served — apply wherever the processing happens. Keeping AI workloads on your own infrastructure makes them far easier to meet and to prove.

MeitY's India AI Governance Guidelines, released in November 2025, are non-binding. They set out seven principles, beginning with "Trust is the Foundation" and "People First", and favour sector-specific rules over a single AI law. Hospitals, banks and government departments should expect their own regulators to shape what is required.

A practical way to start

1. 01

   Map the data

   List the data the AI would touch, who is allowed to see each part of it, and which data must never leave your premises.

2. 02

   Pick one useful task

   Choose something measurable: finding answers across policy documents and circulars, summarising case files, or sorting incoming requests. Avoid open-ended chat as a first project.

3. 03

   Use retrieval, not training

   Keep your documents in an index you control. The model answers from them and cites where each answer came from, and a user only ever retrieves documents they are already permitted to open.

4. 04

   Deploy where the data lives

   Run the model on an on-premise GPU server or in your private cloud. For development and non-sensitive experiments, the IndiaAI Mission offers subsidised GPU capacity through its compute portal.

5. 05

   Secure and monitor it

   Log every prompt and response, restrict what the system can do on a user's behalf, filter its outputs, and test it against known attacks before real users rely on it.

The risks to design for

AI systems fail in ways ordinary software does not. The OWASP Top 10 for LLM Applications, updated in August 2026, puts three risks at the top:

• Prompt injection — instructions hidden in a document or message that make the model ignore its rules.
• Sensitive information disclosure — the system revealing data a user should not see. The fix is to enforce permissions at retrieval, not to trust the model to keep secrets.
• Excessive agency — giving the AI more power to act, such as sending emails or changing records, than the task needs.

NIST's AI Risk Management Framework and its Generative AI Profile are useful checklists for governance, measurement and ongoing monitoring.

The DPDP timelines above reflect the Rules as notified in November 2025. A proposal to shorten parts of the timeline was reported in January 2026; check MeitY's latest notifications before planning around specific dates.

This article is general information, not legal advice. Rules change — check the official sources below before acting.