Short answer
India's Digital Personal Data Protection (DPDP) Act brings consent, notice and data-principal rights duties that apply from May 2027. For a center on ServiceNow, plan three things now: map where personal data sits, decide what AI features may read, and run privacy requests through one workflow. Have Indian counsel confirm how the duties apply to you.
Last reviewed Nov 2, 2026
This page isn't legal advice.
Map the data
HR cases, employee records, access requests and attachments all hold personal data. List the tables, who can see them, and which AI skills or agents read them.
AI features
Ask ServiceNow to confirm AI inference location in writing for your instance; India inference is unconfirmed as of Nov 2, 2026. Configure masking either way. ServiceNow's India index (Sep 8, 2026) says only 22% of Indian enterprises have AI testing, auditing and risk-assessment processes in place.
One workflow for requests
Access, correction and erasure requests under DPDP look a lot like GDPR requests. Run both through one ServiceNow workflow with clocks, owners and an audit record.
Timeline
| By | Step |
|---|---|
| Now | Data map and counsel review |
| Q1 2027 | Notices and consent records |
| Before May 2027 | Request workflow live and tested |
See the DPDP Privacy Workflow and Trust and security.
GCC Now™ is the ServiceNow Accelerator by ANSR × inMorphis, a joint venture for global capability centers (GCCs) and GBS organizations.