Robotic Training And Personal Data: Key Considerations Under The DPDP Act And EU Framework

Robotic systems are increasingly trained on human-generated data. Depending on the training method, this may include video and audio recordings, movement trajectories, tele-operation inputs, force measurements, gait, location and other sensor data. This raises an important data-protection question: when does training a robot amount to processing personal data, and how does the answer change depending on the way in which that training is undertaken?

The position is particularly interesting when India is compared with the European Union. In India, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) (here) principally regulates the processing of personal data used in the training exercise. In the EU, the General Data Protection Regulation (“GDPR”) (here) applies to the personal-data layer, while the EU Artificial Intelligence Act (“AI Act”) (here) and, in appropriate cases, the EU Machinery Regulation may separately regulate the resulting robotic system.