Using Indian AI Teams on US Client Data: Confidentiality, DPDP and Contract Safeguards

India is where much of the world’s AI work actually gets done: data labeling, model fine-tuning, evaluation, MLOps and the engineering that turns models into products. For US companies, Indian AI teams offer deep talent at scale. But AI work runs on data, and when that data belongs to US clients, every privacy and confidentiality obligation travels with it.

This guide explains offshore AI team data privacy for US companies working with Indian AI teams: which Indian laws apply to US client data processed in India, which US rules follow the data, the contract safeguards that matter, and practical security steps.

Which Indian laws apply to US client data processed in India

The first question US companies ask is whether India’s Digital Personal Data Protection Act, 2023 applies to their US customers’ data once it’s processed in India. The answer is reassuring but specific. Section 17(1)(d) of the DPDP Act exempts the processing of personal data of individuals who are not in India, where it’s carried out in India under a contract with a person outside India. This exemption was designed precisely for India’s outsourcing and services industry. See also our guide to India’s DPDP Act for US SaaS companies.

The exemption isn’t total. It switches off most of the Act’s obligations, such as notice, consent and data principal rights, but the duty on the Indian processor to protect personal data with reasonable security safeguards continues to apply. Confirm the exact list of provisions that remain under Section 17(1)(d) for your facts. In practice, that means an Indian AI team working on US client data must still keep it secure, and a breach is still a serious legal matter in India.

Other Indian laws also apply. CERT-In’s 2022 directions require organizations in India to report specified cyber incidents within six hours and to keep ICT logs for 180 days; see our guide to the CERT-In 6-hour rule. The IT Act, 2000 penalizes unauthorized access, data theft and breach of confidentiality. And Indian contract law will enforce the confidentiality obligations you agree with your Indian team or vendor.

Which US rules follow the data offshore

Sending data to India doesn’t change who is responsible under US law. If the data is protected health information, HIPAA requires a business associate agreement with the Indian vendor and with any subcontractors, and the security rule’s safeguards apply wherever the data is processed. Financial institutions subject to the Gramm-Leach-Bliley Act must oversee service providers handling customer information.

State privacy laws such as California’s require written contracts with service providers that restrict their use of personal information, and the FTC treats failures to protect consumer data, including by vendors, as potential unfair or deceptive practices. Sector regulators and many enterprise customers also impose their own vendor-risk requirements, which often include data location restrictions or prior approval for offshore processing. These US points are general; have US counsel review them for your facts.

There’s also the question of what your clients have agreed to. Many enterprise contracts restrict where data can be processed, require approval of subprocessors, or prohibit using client data to train models. Before sending client data to an Indian AI team, check those contracts. A breach of contract may be the most immediate legal risk.

Confidentiality and AI-specific risks

AI work creates confidentiality risks that ordinary outsourcing doesn’t. Data used for fine-tuning can become embedded in model weights. Labeling and evaluation work exposes raw data to many people. And AI teams often use third-party tools, APIs and model providers, each of which is another place the data goes. Our guide to AI tools at work and confidentiality covers the internal side of this problem.

Good offshore AI team data privacy addresses these risks directly. Decide whether client data may be used to train or fine-tune models at all, and if so, under what conditions. Minimize and pseudonymize data before it leaves the US where possible. Restrict which third-party AI tools the team may use and require that tools are configured not to retain or train on your data. Keep model artifacts trained on a client’s data separate from those used for other clients.

Good offshore AI team data privacy also means planning for the end of a project: how training datasets, intermediate files and fine-tuned models will be deleted or handed back, and how you’ll verify that it’s been done. Human factors matter too. Data labelers and engineers should sign individual confidentiality undertakings, receive training on handling client data, and work in environments where downloading or copying data is technically restricted.

Contract safeguards and security measures

The contract with your Indian AI team or vendor is the backbone of offshore AI team data privacy. It should define the data in scope and the permitted purposes; prohibit any other use, including model training unless expressly allowed; require security controls such as encryption, access control, logging and secure development practices; set breach notification timelines short enough for you to meet your own US obligations; and require deletion or return of data at the end of the project.

Include subcontracting controls, audit and inspection rights, and cooperation with incident investigations. For regulated data, attach the required business associate agreement or regulatory clauses. Choose a governing law and dispute forum you can actually use, and consider arbitration with a seat such as Singapore or New York, because awards from New York Convention countries are enforceable in India. The same discipline applies to law firm outsourcing; see our ABA 08-451 checklist and our guide to choosing an offshore legal support partner.

Many US companies also prefer to keep data in their own cloud environment and give the Indian team controlled access to it, rather than transferring data to the vendor’s systems. That approach simplifies offshore AI team data privacy, because the data never leaves infrastructure you control. Security certifications such as ISO 27001 or a SOC 2 report give useful assurance, but they’re not a substitute for checking how your specific project is set up. Ask how access is granted and revoked, where data is stored, and how logs are monitored.

When things go wrong: remedies and quick answers

If a breach or misuse occurs, act on two tracks. In India, the vendor must report qualifying cyber incidents to CERT-In within six hours, unauthorized access and data theft can be prosecuted under the IT Act, and you can seek urgent injunctions in Indian courts to stop further use or disclosure of the data. Under the contract, you can claim damages, invoke indemnities and terminate. In the US, you’ll need to assess your own breach notification obligations under state laws, HIPAA or other rules, and notify clients as your contracts require. Because timelines are short on both sides, decide in advance who does what. Our guide to ransomware and cyber insurance covers incident response in more depth, and for Indian data subjects’ rights see our DPDP Act compliance checklist.

Quick answers

Does India’s DPDP Act apply to US customer data processed in India?

Mostly not. Section 17(1)(d) exempts processing of non-Indian individuals’ data under a contract with a foreign party, but the duty to keep the data secure still applies.

Can Indian AI teams train models on US client data?

Only if your client contracts and US obligations allow it, and your contract with the Indian team expressly permits it.

What contract terms matter most?

Purpose limits, a training prohibition or conditions, security controls, short breach notification, subcontracting limits, audit rights and deletion at the end of the project.

Related reading: UK GDPR transfers to India; also offshore data processing for UK client data; also AI training data licensing with Indian publishers and who owns the AI model: IP for UK startups building in India; also structuring AI training data licences after Ross; also trade secret remedies when former employees take code.

Final word

Halverton & Co. is an Indian law firm that advises on Indian law, including data processing contracts, DPDP and IT Act compliance, and confidentiality for offshore AI and technology teams. We practice in Jharkhand, Maharashtra and before the Supreme Court of India, and we work alongside US counsel, who advise on US law. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.

This article reflects developments reported up to early October 2026. It is for general information only, is not legal advice, and does not create an attorney-client relationship. Halverton & Co. is an Indian law firm and does not advise on US law.