Using AI Tools at Work: Confidentiality, Data Leaks and Employer Liability in India

Somewhere in your company today, an employee is pasting a client contract into a chatbot and asking it to “summarise the key risks”. Another is uploading a spreadsheet of customer names to “clean up the formatting”. It’s faster, it works, and almost nobody stops to ask where that data goes next.

That question has stopped being theoretical. In January 2025, India’s Finance Ministry told its staff to avoid AI tools such as ChatGPT and DeepSeek on office computers and devices, saying they posed risks to the confidentiality of government data and documents (Reuters). Private companies face the same risks, plus legal liability to clients and customers. This guide explains the legal risks of using AI tools at work in India, who is liable when confidential data leaks, what a good AI usage policy looks like, and the remedies available when things go wrong.

Why AI tools at work create real legal risk

Generative AI tools aren’t dangerous because they’re malicious. They’re risky because of how data moves through them. Depending on the tool and the plan, prompts and uploaded files may be stored by the provider, reviewed by humans for safety, used to improve models, or kept in logs outside India. Consumer versions of AI tools often have very different data terms from enterprise versions.

The best-known cautionary tale came in 2023, when engineers at a major global electronics company reportedly pasted confidential source code into a public chatbot, prompting the company to restrict generative AI use. The lesson for Indian businesses is simple: once confidential information leaves your control, you may not be able to get it back, and “an employee did it” is not a defence to your client.

The legal exposure usually comes from four directions:

• Breach of confidentiality. NDAs, client contracts and engagement terms almost always restrict sharing confidential information with third parties. An AI provider is a third party.
• Data protection law. Personal data of customers or employees put into an AI tool engages the Digital Personal Data Protection Act, 2023 (DPDP Act). See our DPDP Act compliance checklist.
• Loss of trade secret protection. India protects trade secrets mainly through contract and the law of confidence. Courts expect you to have taken reasonable steps to keep information secret, and careless AI use undermines that. Our guide to patenting software in India explains when trade secrets are the better protection.
• Professional duties. Lawyers, chartered accountants, doctors and financial advisers owe professional confidentiality duties that sit on top of contract law.

Who is liable when confidential data leaks through an AI tool?

The employer, in most cases

Under the DPDP Act, the business that decides why and how personal data is processed (the Data Fiduciary) is responsible for compliance, including for processing carried out on its behalf. If an employee feeds customer data into an AI tool for work, the business is answerable. Once the Act’s substantive obligations take effect on 13 May 2027, failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore, and failure to report a personal data breach up to ₹200 crore.

Under the IT Act, until May 2027

Section 43A of the Information Technology Act, 2000 makes a company that negligently handles sensitive personal data liable to pay compensation. This remedy remains available until the DPDP Act’s provisions omitting it take effect in May 2027. Section 72A also criminalises disclosing personal information in breach of a lawful contract, with intent to cause wrongful loss or gain.

Towards clients, under contract

A client whose confidential information was exposed can claim damages for breach of the NDA or the services agreement, and may be able to terminate the contract. Many enterprise contracts now specifically prohibit putting client data into third-party AI tools without consent.

The employee, sometimes

An employee who breaches a clear AI policy can face disciplinary action and, in serious cases, termination and a claim for damages. But employees rarely have the means to pay, so the practical risk stays with the business.

What India’s AI framework says about responsible AI use

India has chosen not to pass a single AI law for now. On 5 November 2025, MeitY released the India AI Governance Guidelines, which set out seven principles, including accountability and “understandable by design”, and recommend a graded liability model in which obligations scale with each party’s role, the level of risk and whether due diligence was observed (Mondaq). The Guidelines don’t create new penalties themselves. Existing laws, such as the IT Act and the DPDP Act, and sectoral regulators continue to apply (Regulations.ai).

For a business, the practical message is that “we followed reasonable due diligence” will matter a great deal under a graded liability approach. A written AI usage policy, approved tools, training records and audit logs are exactly the evidence that shows due diligence. The same logic applies to AI systems that act on their own; see our guide to liability for AI agent mistakes. If you sell AI features into Europe, read whether the EU AI Act applies to your Indian SaaS company.

The AI usage policy every company needs

A good AI usage policy doesn’t ban AI. Bans usually push employees towards personal accounts on personal phones, which is worse. Instead, it channels AI use into safe tools and safe behaviour. At a minimum, your policy should:

• List approved AI tools and the plan or settings that must be used, for example enterprise versions with training on your data switched off.
• Classify data into what can be used freely, what needs approval, and what must never go into an AI tool, such as client confidential information, personal data, source code, passwords and unreleased financials.
• Require human review of AI outputs before they reach clients, courts, regulators or the public. Employees remain responsible for the work.
• Address IP. Clarify who owns AI-assisted work (the company, under the employment contract) and require checks so that AI outputs don’t copy third-party material. See who owns AI-generated content in India.
• Set rules for client work. Check client contracts for AI restrictions and get consent where needed.
• Include training, logging and reporting. Train staff, keep usage logs where possible, and tell employees how to report a suspected leak immediately.
• Spell out consequences for breaches, consistent with your employment contracts and standing orders.

Back the policy up with contracts. Review your AI vendors’ terms for data use, retention, location and security, and update your employment contracts, NDAs and client agreements to cover AI tools expressly. Founders should also make sure confidentiality and IP assignment are covered from the start; see our guide to founders’ agreements in India.

When data leaks: legal remedies and first steps

If you discover that confidential or personal data has been put into an AI tool without authorisation, act quickly.

• Contain it. Delete the data from the tool’s history where possible, ask the provider to delete it under its deletion or privacy request process, and revoke access for the account concerned.
• Assess reporting duties. A cyber security incident may need to be reported to CERT-In within six hours; see our CERT-In 6-hour rule guide. Once the DPDP Act’s breach rules apply, affected individuals and the Data Protection Board must be told without delay. Check your client contracts for notification clauses too.
• Remedies against the employee. Disciplinary action under your policy and contract, and, where there was deliberate misuse, a civil claim or an injunction to stop further disclosure.
• Remedies against third parties. If a competitor or other person obtained your confidential information, a suit for breach of confidence can secure an injunction and damages. Unauthorised access to systems may also amount to offences under Sections 43 and 66 of the IT Act.
• Remedies for affected clients and individuals. Contract claims, compensation under Section 43A of the IT Act until May 2027, and, from May 2027, complaints to the Data Protection Board.

Quick answers

Is it legal for employees to use ChatGPT at work in India?

Yes, there’s no general ban, but using it with confidential or personal data can breach contracts, the IT Act and the DPDP Act. A clear AI usage policy is essential.

Who is liable if an employee leaks client data into an AI tool?

Usually the employer, towards clients and under data protection law, though the employee may face disciplinary action.

Does India have an AI law?

Not a single dedicated statute. MeitY’s AI Governance Guidelines (November 2025) rely on existing laws such as the IT Act and the DPDP Act, plus sectoral regulators.

Related reading: the DPIIT AI copyright working paper and labelling AI-generated content; also AI in hiring and employee monitoring and ransomware and cyber insurance; also Indian AI teams and US client data; also trade secrets in India: protecting source code and algorithms and open-source licence audits for US startups; also NDA enforceability in India and drafting confidentiality agreements.

Final word

At Halverton & Co., we advise startups, SaaS companies and technology-driven businesses on AI usage policies, data protection, confidentiality and technology contracts. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and act as fractional legal counsel for companies that need senior legal support without a full in-house team. Halverton & Co.: Where tech needs law!

Write to us at office@halvertonandco.com, or get in touch, to discuss your situation.

This article reflects the law and developments reported up to early October 2026. Technology regulation changes quickly; please take advice on your specific facts before acting.