Your Embeddings Are Personal Data. Now What?

DPDP does not use the word embedding. That does not help you. Section 2 asks a factual question: is this data about an individual who is identifiable by or in relation to it. A 768-dimensional vector built from a student's disciplinary note is about that student if you can join it back, and sometimes even if a neighbour vector reveals them.

This is not an exotic academic point. Retrieval-augmented generation, the architecture almost every government RAG demo uses, stores exactly these vectors next to chunks of official records. If you treated only the PDF as personal data, you have already lost the index.

When a vector is personal data

You do not need a court to invent a new category. Apply the statutory test honestly.

• You stored a document id, user id or ticket id next to the vector.
• The embedded text contained names, identifiers or rare facts.
• You can invert or approximate the source with the same model and a probe set.
• Access to the index plus the chunk store re-identifies the person in one query.
• The index is scoped per officer or per citizen, so the namespace itself identifies someone.

In institutional RAG, at least the first and the fourth are almost always true. Treat the index as a personal-data store. Give it a lawful basis, a retention clock, an access log and an erasure method. If you cannot, do not build it on live records.

What now, operationally

Duty	What it means for embeddings	Failure mode
Purpose limitation	Index only what the notice described	Embedding entire file rooms because retrieval got better
Minimisation	Chunk and redact before embed	Passing raw Aadhaar letters into the encoder
Security	Same class as the source system	Open vector DB on a laptop in the SI war room
Transfer	Sending vectors abroad is still a transfer	Managed vector SaaS in another region
Erasure	Delete vectors, chunks, caches, replicas	Deleting the PDF and leaving the index
Access	Log who queried whose neighbourhood	A shared index any intern can search

Minimisation is the cheapest control and the least used. Redact identifiers before chunking. Do not embed annexures that the workflow never retrieves. Split indexes so a scholarship agent cannot search disciplinary files. Purpose is easier to enforce when the bytes are not in the same table.

Erasure that is not theatre

A rights request in 2027 will not accept we deleted the PDF. Write the method now.

1. Key every vector to a document id and a principal id you can look up.
2. On erasure, delete the source, the chunks, the vectors, the caches and the query logs that replayed the text.
3. Rebuild only what remains. Do not leave tombstones that still hold the vector.
4. If a fine-tune contains the same text, decide in advance whether you retrain or whether that text was never allowed in the train set.
5. Certificate the backup cycle that will drop the last copy.

What to write in the architecture note

One paragraph is enough if it is true: where the encoder runs, where the index lives, who can query it, how long vectors live, how a person is erased, and whether any vector ever leaves the perimeter. If that paragraph needs weasel words, the design is not ready.

Why floats feel anonymous — and why that feeling is wrong

A vector does not look like a name. That is why engineers, and some counsel who have not seen a join table, treat it as anonymous. Anonymity is a fact about identifiability, not a fact about file format. If you can get back to a person, or if the vector is stored next to a person key, the format is decoration.

Research on embedding inversion is not settled in Indian courts. You do not need it to be. The join key is enough. Design as if the vector is the document. You will almost never be too conservative. You will often be too casual.

Shared indexes are shared purpose

One large index for the whole secretariat is an attractive demo and a purpose violation waiting to happen. A welfare agent that can retrieve a vigilance file has left its notice. Split indexes by purpose. If retrieval quality suffers, that is a product problem. It is not a reason to merge lawful bases.

Vendor-hosted vector databases

Managed vector services are convenient. They are also often a transfer, a new processor, and a store you cannot erase on your own clock. If the source documents cannot leave, the vectors cannot leave. Run the index next to the documents. Convenience is not a lawful basis.

Treat the index as a system of record this month

Week 1: find every index. Include the ones on laptops and in managed cloud trials. If you cannot list them, you cannot erase them. Week 2: key every vector to a document id and a principal id, or rebuild the index so you can. An unkeyed index is an erasure failure waiting for 2027.

Week 3: split indexes by purpose. Welfare does not search vigilance. Admissions does not search disciplinary minutes. Quality may drop. Purpose does not care. Week 4: write the erasure method and run it on a test principal. If the vector remains, the method is theatre.

In parallel, move any index that sits abroad back next to the source, or stop embedding that source. There is no third option that survives a sentence in a PAC.

• No managed foreign vector DB for records that cannot travel.
• No all-department mega-index.
• No 'anonymised' label on a vector sitting next to a user id.
• No deletion of PDFs that leaves the index behind.

Objections you will hear — and what to do with them

A data scientist will say the vector cannot be inverted with current methods. Current methods are not the statutory test. Identifiable by or in relation to includes the join key sitting in the next column. Argue about inversion only if there is no key, no rare fact, and no chunk store. That case is rare in government RAG.

A vendor will say their index is anonymised because names were stripped before embed. If the chunk still says the sitting MLA's daughter in ward 14, you have a person. Stripping names is minimisation. Call it that.

Storage teams will want one cluster for every index because operations are easier. Operations are not a lawful basis. Split at least by purpose, even if the hardware is shared, with access control that the DPO can test.

Records officers will say erasure of vectors is not in the retention schedule. Add it. Schedules that only know files and emails are incomplete the day you turn on RAG. Incomplete schedules are how you fail a rights request.

Someone will propose hashing ids as a compromise. Hashed ids are still identifiers if you keep the hash. Treat them as keys. Do not treat them as anonymity.

How this shows up in the file

If you take nothing else, take this: add the vector index to the same inventory you use for databases. Give it an owner, a retention clock, an access log and an erasure drill. Features without inventory become forgotten stores. Forgotten stores become the answer to a rights request you cannot fulfil.

Run one erasure on a test principal this month. Watch whether the vector, the chunk, the cache and the query log all die. If any remain, you do not have erasure. You have a delete button on the PDF.

Write the architecture paragraph in language a DPO can read: where the encoder runs, where the index lives, who can query it, how a person disappears. If the paragraph needs weasel words, the design is not ready for live records.

What the next noting must contain

“Your Embeddings Are Personal Data. Now What?” belongs in a file, not only in a search result. A P6 Compliance/DPO should be able to point at one artefact that proves “embeddings personal data DPDP”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

A vector is not anonymous because it is a list of floats. If it can be related to a person, DPDP already has a name for it: personal data. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C1 Sovereignty & Data Residency: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “embeddings personal data DPDP”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.

Prcept AI keeps retrieval indexes inside your perimeter with the source systems. Score the index as a personal-data store, not as a search feature.