How to Make Google Gemini DPDP Compliant
Many employees already use ChatGPT at work, often with customer data in their prompts. India's Digital Personal Data Protection (DPDP) Act makes your organisation responsible for that data. With Mavs Secure Chat, you can get a governed way to let your teams keep using ChatGPT models with full DPDP compliance.
From the Founders' Desk
By Manjul Kubde, Co-founder & Abeer Sehrawat • Sep 25, 2026
Can you use Gemini and stay DPDP compliant?
Yes. The DPDP Act does not ban AI tools, but it does make your organisation responsible for any personal data your employees share with an AI tool like Gemini. If your organisation decides how customer data is used, the Act calls it a Data Fiduciary, and a Data Fiduciary is accountable for that data even when a vendor handles it (Section 8(1)).
So when an employee pastes a customer's details into Gemini, Google processes that data for you. If it leaks from Google's systems, it is still your breach. You have to inform the Data Protection Board and every affected customer (Section 8(6)), and you can be fined up to ₹250 crore if you did not take reasonable security safeguards (Section 8(5)).
These obligations apply from 13 May 2027, but data your employees paste into Gemini today may still be on Google's systems then. On personal Google accounts, Google has trained reviewers read a sample of chats and keeps those for up to three years, even after the user deletes them (Gemini Apps Privacy Hub).
That clashes with your customers' rights as Data Principals. If a customer asks you to erase their data or withdraws consent, you have to make sure it's erased, including by anyone processing it for you (Sections 8(7) and 12), and you can't guarantee that for chats Google keeps. You can only protect that data before it leaves your organisation, so the controls need to be in place now.
For more on the risks AI creates under the DPDP Rules, read what DPDP Rule 6 requires when you use AI.
How to make Gemini usage DPDP compliant with Mavs Secure Chat
Mavs Secure Chat is a secure AI portal where your teams can use Google's Gemini models without sending your actual data to Google. It works as a governed AI workspace: Mavs checks every prompt at runtime for sensitive data before sending it to Google, applies the policies you set and keeps a log of all AI interactions.
Here is what Mavs Secure Chat enables you to do:
- Compliant access to Gemini models. Assign the Gemini model you want, including Gemini 3.8 Flash, Gemini 3.1 Pro and Gemini 3.5 Flash-Lite, to each team or employee based on the team's needs and tasks. You only pay for the Gemini tokens you use.
- Set policy per team. Create separate workspaces for each team or task and choose how sensitive data is treated in each. The loans team and the marketing team, for example, can have different policies based on the data they handle.
- Audit log. Get audit logs of every prompt and every replacement, which you can export as evidence for auditors.
- Visibility on risk and productivity. See risk trends and the actions taken to safeguard AI usage across your organisation, along with AI adoption by team.
- Token management. Set limits and track token consumption to keep AI costs predictable.
- Prompt injection protection. Mavs detects and stops prompt injection and jailbreak attempts before they reach the model.
- Enable productivity without blocking prompts. Mavs identifies sensitive data in every prompt and file upload and replaces it with realistic stand-in values before anything is sent to Google, then puts the real values back in the response. Work doesn't have to stop, and the model still gets a realistic prompt to reason over. This gives you the kind of technical safeguard Rule 6 of the DPDP Rules asks for, without blocking productivity or lowering the quality of the answers.
Illustrative values. OpenAI receives and stores the stand-in name and ID. The real ones stay within the enterprise boundaries.
To learn more, read how we enabled DPDP compliance for a large Indian enterprise with Mavs Secure Chat, without blocking its employees' AI use.
What Indian data does Mavs identify and replace for making Gemini DPDP compliant?
Mavs identifies and replaces common Indian personal data, as well as confidential business information.
| Category | Examples |
|---|---|
| Government IDs | PAN, Aadhaar, voter ID, passport, driving licence |
| Financial data | Bank account and card numbers, UPI IDs, demat account numbers, loan and insurance policy numbers |
| Personal details | Names, addresses, phone numbers, email addresses |
| Health | Patient IDs, medical record numbers, health insurance claim numbers |
| Business information | Deal and project codenames, unannounced pricing, merger and acquisition terms, key accounts, unreleased roadmaps |
Business sensitive information isn't personal data, so the DPDP Act doesn't cover it. But sending it to a third-party model is a risk in itself, and some of it is regulated elsewhere, such as price-sensitive information under the Securities and Exchange Board of India (SEBI) insider trading rules, or client data covered by a non-disclosure agreement (NDA). Mavs Secure Chat also lets you secure your business sensitive data in addition to PII.
Frequently asked questions
Is Gemini DPDP compliant?
Under the DPDP Act, your organisation is responsible for the personal data it collects. If you share that data with Gemini, make sure you have guardrails in place to protect it before it reaches Google, and log every prompt as evidence of your compliance.
Does Gemini have guardrails for personal data?
Gemini's built-in guardrails are set by Google to handle harmful content. You don't control them, and they don't check prompts for customer personal data. Mavs Secure Chat adds guardrails you set for each team: it identifies and replaces personal data, stops prompt injection and logs every prompt.
Can employees use Gemini with customer data like Aadhaar or PAN?
Yes, if the data is protected before it reaches Google. Mavs Secure Chat replaces names, Aadhaar, PAN and account numbers with realistic stand-in values before the prompt is sent, so the real data never leaves your organisation. Your organisation stays accountable for any customer data that does reach Google, including for breaches.
Does Google use Gemini chats to train its models?
On personal Google accounts, it can. Google says it uses Gemini chats to develop and improve its services, including training its generative AI models, and chats are still kept for 72 hours even with Keep Activity turned off. Work accounts may come with different terms. With Mavs Secure Chat, the personal data Mavs identifies is replaced before the prompt reaches Google, so the real values are not in what Google receives.
How can we see what employees share on personal Gemini accounts?
You can't. There is no contract between your organisation and Google, and admins have no view of what is shared. Moving employees to a secure AI workspace such as Mavs Secure Chat fixes this. It logs every prompt, the data that was replaced and who sent it, and shows risk trends and AI adoption for each team.
How do I keep audit logs of Gemini usage for DPDP compliance?
Route Gemini usage through a workspace that logs every interaction. Rule 6 of the DPDP Rules asks you to keep logs that help detect and investigate unauthorised access to personal data, and to retain them for one year. Mavs Secure Chat logs every prompt, who sent it, what personal data was found and how it was replaced, so you can show an auditor how personal data was handled.
We already block Gemini. Do we still need this?
Blocking creates shadow AI. Employees move to personal Google accounts on their own phones and laptops, where you can't see or govern what they share. Mavs Secure Chat gives them Gemini models in a workspace you control.
