DeepSeek brings focus back on data security concerns over Chinese apps

Deepseek is claimed to have been developed at a fractional cost compared to its peers

The soaring popularity of low-cost artificial intelligence platform DeepSeek, which has taken the tech world by storm and roiled markets across the world, has brought into focus the potential fallout of sensitive data becoming accessible to Chinese AI and software companies.

According to senior officials who spoke to Moneycontrol on condition of anonymity, the government is keeping a close watch on the fast-evolving AI landscape and the disruptive impact that DeepSeek may have on existing AI platforms such as ChatGPT, many of which are hugely popular in India.

In the past, the government banned the popular social networking app TikTok and also restricted Chinese telecom equipment suppliers such as ZTE and Huawei from participating in infrastructure contracts, citing national security concerns.

“I am not sure why concerns on DeepSeek will be any different but given the increasing prominence of AI, this will require a more calibrated approach,” one of the senior officials cited above said.

According to DeepSeek’s privacy policy, the app collects various forms of user data, including profile information and data/files that have been provided as inputs to the platform, among others.

“The personal information we collect from you may be stored on a server located outside of the country where you live. We store the information we collect in secure servers located in the People's Republic of China,” the company’s privacy policy says.

Also read: Nvidia’s $465 billion DeepSeek rout is largest in market history

Experts point out that AI models sometimes produce outputs that are factually incorrect or misleading. For instance, in February last year, the government pulled up Google after its AI platform Gemini gave misleading answers to queries about Indian politics. Some Indian users have taken to social media platform X, alleging DeepSeek was giving misleading answers regarding Indian states.

Indian regulators and courts have little power to enforce any orders since the question of whether courts can issue orders against AI platforms is pending legal interpretation in the OpenAI vs ANI case in the Delhi High Court, say experts. In the past, the government had banned platforms such as PUBG for storing Indian data in China.

“The storage of information in China has deep implications for the data localisation mandate of the Indian government, and the question of allowing DeepSeek to serve users based in India while hosting the data in China hinges on the foundation of India's stance on data sovereignty,” said Saswati Soumya Sahu, expert counsel on data protection and AI. “The Indian government can provide an advisory note or other form of regulatory response, giving clarity on the treatment of cross-border data between India and countries that do not have an adequate level of data protection.”

DeepSeek's AI assistant was launched on app stores last week to a rapturous welcome, as the platform is claimed to have been developed at a marginal cost of $6 million compared to the billions of dollars being spent by other AI companies, including OpenAI. On January 27, DeepSeek faced a cyberattack, forcing the platform to limit users to mainland China for now.

“The government must be extremely cautious in establishing strict data localisation norms for the storage and processing of user data and protecting national sovereignty before allowing DeepSeek to serve Indian users,” said Nazneen Ichhaporia, Partner, ANB Legal.

While the platform is still in the initial stages of rollout, if DeepSeek launches end-user services in India, the government can force the AI platform to either comply with the data protection rules or face a ban.

“If DeepSeek offers end-user services in India, concerns about data protection and security would arise. In such scenarios, the Indian government has existing powers to impose restrictions, as seen with previous app bans, and the proposed Rule 14 of the draft Digital Personal Data Protection Rules, 2025, would further strengthen these powers,” said Lalu John Philip, founder, Boolean Legal.