DPDPA Compliance for LLM and RAG

DPDPA in India is undergoing a phased roll out with full enforcement expected to be in May 2027. Organisations are evaluating their data estate, defining purpose for each of the personal data they are collecting, ensuring that the consent managers are in place to obtain consent. One of the critical components part of the evaluation will be the data stores that the organisations use to store data.

Vector databases for LLM workflows are a new addition to the data estate for most of the organisations. Organisations use vector databases to store the data which makes LLM workflows effective. This has now become a key component for most of the LLM based workflows.

Contrary to popular belief - most RAG databases store not just the vector but the plain text data along with it. So it's important to remove both the vector and plain text chunks from the database. Most of the vector databases support the ability to add metadata tags - which can be used to identify data subjects which can then be used for targeted delete requests. Without tagging - content search can fail at the edges and can't be proven complete. With the enforcement of DPDPA, it will be also be important to prove that the data is deleted.

If you are building LLM + RAG for Indian market, you need to pick a metadata-capable vector database, where every chunk can be tagged to a data principal. You should also review your data processor agreements with your cloud providers AWS/Azure/ other OEMs who are processing your data to ensure that data processor obligations are managed by the OEMs.