For every successful long running business, the client’s trust is one of the most valuable intangible assets for them. Among the various influential factors, how responsibly a company safeguards the client’s personal information is instrumental in maintaining their trust, and in an increasingly AI-driven workplace, protecting that trust requires as much as securing databases and controlling access to files. Mishandling the client’s sensitive data is a direct threat to that trust which later reflects negatively on companies’ reputation and financial reports.
The world has seen a rapid digitalization across sectors since the 2019 pandemic, leaving behind a trail of hundred millions of TeraBytes of sensitive data everyday and with the onset of the AI era, the shift has been remarkable. Employees now use AI to analyse financial reports, summarise contracts, review customer conversations, write code, prepare meeting notes and process information that was never originally intended to leave the company’s premises.
Data being the new currency in this era has made matters of data privacy even more concerning for the businesses. The question for a CEO is no longer simply whether the employees are using AI for better efficiency. It is whether the data involved in the workflows remains visible and responsibly governed.
In 2023, Samsung disclosed that their engineers had uploaded sensitive internal material including semiconductor-related source code and internal meeting notes into ChatGPT while using it for everyday tasks. Within 20 days of allowing the use of GenAI in the company, the 3 separate data-sharing incidents occurred due to employees trying to speed up the routine tasks. The productivity gains for the company were real, so the governance problem.
The incident demonstrated how an employee, performing an ordinary task, could create an external information flow and how easily an external AI service could enter an established companies’ dataflow system. It was a consequence of flawed data governance, where the company didn’t know what data could leave the organisation in the first place.
A different aspect of the issue surfaced in January 2025 when Wiz researchers found a publicly accessible, unauthenticated DeepSeek database exposing sensitive data. The exposure introduced a severe systemic risk to DeepSeek’s proprietary infrastructure and user security as unencrypted conversation records, local files and private system logs could easily be compromised by the cybercriminals.
The DeepSeek incident illustrates that the governance challenge does not end when data reaches an AI system. Businesses must also be able to see where the data is stored, who can access it, and what controls protect it.
The two scenarios highlight the same fundamental governance gap at various stages of the data lifecycle. Data remains vulnerable when businesses lose control over what data is shared, where it is stored and how it is protected. Every business adopting AI must determine whether it is possible to track, audit, and manage data once it enters an AI ecosystem.
Addressing these gaps in data governance is becoming particularly important in India as businesses prepare for the compliance framework established by the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it. The framework places responsibility on businesses processing digital personal data, including processing carried out on their behalf by Data Processors, to understand and govern how that data is collected, used, protected and handled.
Presently, the major challenge for the businesses in implementing the DPDPA compliance framework is the data visibility. They cannot govern the data they cannot see. The lesson from the Samsung and DeepSeek case is not simply to restrict the use of AI. It is to build visibility around data before, during and after AI processing. This is why data mapping is often the starting point of effective data governance which creates visibility into the lifecycle of personal data and provides the foundation for implementing privacy controls, demonstrating accountability and meeting regulatory obligations.
For CEOs, that visibility can be established through the following 5 practical questions that maps how data moves through new workflows:
1 What data enters the AI systems?
A comprehensive data mapping exercise should identify the categories of personal data entering AI systems. One department may use an enterprise AI platform. Another may use a public chatbot. Employees may use AI features embedded into software the company already subscribes to and that makes it difficult to identify what information is actually being processed by AI across the organisation?
Under the DPDP framework, this matters because an organisation cannot meaningfully govern personal data that it cannot identify.
2 Is the purpose of AI-enabled data processing clearly defined?
The fact that an AI tool can process the information does not by itself answer whether the organization should process it for that purpose. Convenience is not the same as purpose.
The DPDP framework under section 4 mandates businesses to establish why personal data is being processed and whether that purpose is specified, which is defined under section 2(za). Every significant AI use case involving personal data should therefore be connected to a defined processing purpose.
The CEO must be able to answer why an AI system needs this data, and can the company demonstrate that the processing is permitted? That question turns AI adoption from an informal productivity experiment into a governed business process.
3 What happens to data after it reaches AI vendors, processors, and systems?
An AI application can introduce an external vendor into a business’s data flow without changing the way the employee experiences the workflow. This makes vendor and processor visibility an essential component of data governance as the DPDP Act places responsibility on the businesses, the data fiduciaries, for processing undertaken on its behalf by a Data Processor.
The governance solution is to know which AI vendors receive personal data, what they do with it and what contractual controls apply, whether any other processors are involved, and can the organisation exercise applicable rights over the data?
These are not merely procurement questions. They are data-governance questions.
4 Are privacy risks assessed before significant AI processing is implemented?
All AI applications do not create the same level of risk. A business may discover a privacy problem associated with an AI system only after an AI-enabled process has already been integrated into its operations.
The governance objective is to identify relevant privacy risks before the AI system is integrated in the business’s operations, and to establish the safeguards required for the processing.
For Significant Data Fiduciaries, the DPDP Rules, 2025 specifically provide for Data Protection Impact Assessments and comprehensive audits.
5 What happens to data after it reaches AI vendors, processors, and systems?
Data governance is ultimately tested when something goes wrong. If personal data enters an unauthorised AI application, is exposed through a vendor or is otherwise compromised, the business needs to establish what data was affected, where it went, which systems and processors were involved, and what response is required.
Section 8(6) of the DPDP Act establishes the foundational statutory obligation for the business that they must notify the DPBI (Data Protection Board of India) and every affected individual within 72 hours of experiencing the data breach.
A credible data map provides the visibility that is required to connect an incident to the underlying data, systems and third parties, making breach response an extension of data governance rather than a separate exercise.
Addressing these questions elevates data mapping from a routine documentation exercise into a dynamic governance mechanism. It serves as the foundational architecture upon which a business’s entire privacy compliance infrastructure is constructed. The successful implementation of these privacy frameworks align the businesses with DPDP Act 2023 and also strengthen their reputation, streamline business operations, and solidify client trust, transforming statutory compliance into a sustainable competitive advantage.
