Whalesbook
AI Data Leaks: A Growing Blind Spot for Indian Firms
Indian enterprises are set to invest $3.4 billion in information security by 2026, an 11.7% increase fueled by AI threats and regulations. While this spending targets external defenses like firewalls and intrusion detection, a major internal risk goes largely unaddressed: employees unknowingly leaking sensitive data and intellectual property through public AI tools. This "shadow data transfer" bypasses traditional security, immediately exposing companies to regulatory action under India's Digital Personal Data Protection Act, 2023 (DPDPA). Unlike ransomware, this internal leak is often invisible but carries significant regulatory and IP consequences.
DPDPA Fines and IP Loss Loom Large
The Digital Personal Data Protection Act, 2023 (DPDPA) requires companies to implement reasonable security measures to prevent personal data breaches. Failure to do so can result in penalties up to ₹250 crore. Additionally, companies must promptly notify the Data Protection Board of India and affected individuals of any breach, with non-compliance penalties reaching ₹200 crore. When employees paste sensitive information into public AI tools, this data leaves the company's control, directly violating these provisions. Beyond fines, intellectual property like proprietary algorithms and trade secrets can be permanently compromised, potentially becoming accessible to competitors. Professional services firms also face a severe risk of breaching client confidentiality agreements through such disclosures.
Why Traditional Defenses Fail Against AI Leaks
India is a major hub for enterprise AI traffic, with a staggering 309.9% year-on-year growth in AI/ML transactions. Reports show public tools like ChatGPT have already caused millions of data loss prevention violations, and coding assistants are increasingly involved in data leakage incidents. Traditional Data Loss Prevention (DLP) tools, designed for emails and USB drives, are not equipped to monitor sophisticated AI chatbots and LLMs accessed via web browsers. Although most users (79%) prefer enterprise-approved AI tools, 15% still switch between personal and work accounts, creating persistent leakage points. Startups and small to medium-sized businesses (SMEs), often prioritizing rapid productivity, are particularly vulnerable. For large companies, even a small percentage of employees engaging in this behavior can lead to substantial data exfiltration.
The Hidden Risk: Data Embedded in AI Models
The most concerning aspect is that this employee AI usage operates largely unseen. Data uploaded to public AI models is virtually unrecoverable, becoming embedded in the provider's algorithms, often used for training. This poses a severe risk to intellectual property. Unlike data theft in past breaches, such as Air India in 2021 or BharatPe in 2022, this data is willingly, though unknowingly, shared and integrated into third-party systems. The DPDPA's penalty structure allows for fines up to ₹250 crore for security failures and ₹200 crore for notification lapses, potentially applied per leakage instance, making liabilities uncapped. Proving "reasonable security safeguards" is extremely difficult when the threat comes from routine employee activity rather than a sophisticated attack. Many organizations may not even know the extent of their exposure due to a lack of clear AI model usage inventory.
Steps to Secure Against AI Data Leaks
Addressing this vulnerability requires a combined approach of technical controls and cultural change. AI itself is becoming a tool to combat misuse, through enterprise-grade platforms with strict data handling, browser extensions that block sensitive data, and network monitoring of AI traffic. Equally important is educating employees on specific risks, providing approved AI alternatives, and setting up clear processes for new situations. Organizations must audit internal systems and create tailored guidelines that balance productivity with essential security and compliance. Successfully managing cybersecurity investments now hinges on closing this internal AI data leakage blind spot.