Ninety-nine per cent of Indian organisations have a formal policy on what data AI tools can access, yet 84 per cent say an AI tool or agent accessed sensitive data beyond its intended scope in the past year, according to Delinea’s 2026 Identity Security Report released September 30.

The report finds Indian firms ahead of global peers on governance: 87 per cent say their policy is actively enforced, against 71 per cent globally. But they also grant AI wider reach. Seventy-six per cent allow AI tools to access employee data, versus 51 per cent globally, with similar gaps for customer data, financial records and source code.

Accountability trails behind confidence. Only 47 per cent could always trace a sensitive access event to the person who approved it, while 98 per cent were confident they could demonstrate compliant AI access to a regulator.

“A policy alone stops being enough,” said Cynthia Lee, Delinea’s vice president for Asia Pacific and Japan, noting that DPDP obligations will require firms to prove who authorised each access.