Privacy and Data Protection in AI: A Comparative Analysis of EU and Indian Regulatory Frameworks

The rapid proliferation of artificial intelligence (AI) technologies has fundamentally transformed how personal data is collected, processed, and utilized across global jurisdictions. As AI systems increasingly permeate critical sectors—from healthcare and finance to law enforcement and social services—the tension between technological innovation and fundamental privacy rights has intensified. This paper examines the regulatory approaches to privacy and data protection in AI, with particular emphasis on comparing the European Union's General Data Protection Regulation (GDPR) framework with India's evolving data protection regime, specifically the Digital Personal Data Protection Act (DPDP) of 2023. The comparative analysis focuses on three critical dimensions: (1) AI surveillance and the right to privacy, (2) consent and data ownership in machine learning systems, and (3) biometric data regulation and facial recognition technologies. These areas represent the frontier of regulatory challenges where the capabilities of AI systems most directly confront individual privacy rights and societal values. While the EU has established a comprehensive, rights-based framework through the GDPR, India's regulatory landscape reflects a hybrid approach that balances data protection principles with developmental priorities and state interests. Understanding these divergent yet converging regulatory philosophies is essential for multinational organizations, policymakers, and researchers navigating the complex terrain of AI governance. The adequacy of cross-border data flows, enforcement mechanisms, and practical implementation challenges all hinge on how these jurisdictions operationalize their respective frameworks in the context of rapidly evolving AI capabilities.