We write the rules
to safeguard your data.
Your recipes, code, contracts, prices, and footage are inside AI tools today. We find where, then set which tool may see what.
See a sample Business Data MapWithout rules, six things happen.
Your formulation joins the model.
Free and personal AI accounts can learn from what you type, unless you switch that off. Your competitor uses the same AI.
The vendor keeps your prompts.
Often thirty days or more. A support request or a legal notice can pull them.
Your claim gets weaker.
A secret stays a secret while you keep it inside. Typing it into an outside tool with no contract counts as letting it out.
You are the one in breach.
Your clients' contracts say you will not share their material with outsiders. The AI company is an outsider.
Rs 250 crore enters the picture.
If customer or staff details are in the file, the DPDP law applies too.
Silence costs you in the price.
When a buyer or investor checks your company, they ask for your AI rules. Having none costs you in the price.
Business data leaves three ways.
Through people
- A founder pastes the board sheet into ChatGPT.
- An intern drops the formulation into a prompt for label copy.
Through vendors
- The agency's Dropbox, the freelancer's laptop, the manufacturer's inbox.
- Each holds a copy on its own terms.
Through tools
- Notion AI, Meta AI, Copilot, Canva. Switched on by default.
- The AI company decides how long it keeps your data and whether it learns from it.
Four things, in this order.
- 1
The Business Data Map
- Every kind of information you own, where it sits, who has a copy, and which AI tool already reads it.
- Built in a few short meetings, alongside the map of your customers' information.
- 2
The ranking
- Crown, the one thing your company is. Then high, medium, low.
- Your industry decides what sits on top: footage for a studio, recipes for a brand, drawings for a factory.
- 3
The AI rules
- For each kind of information: allowed anywhere, allowed only in approved tools, or kept out of every tool.
- Who can say yes to an exception. What must be blacked out first.
- Written by Dayitva Legal, on your map.
- 4
Contracts and house rules
- A written promise from every outside company on the map: they will not learn from your data, they will delete it when asked, and only named people can see it.
- Approved tools and laptop rules for your own team.
- One training session.
Four ways to get AI rules.
A downloaded template
- Written for a company in general.
- Bans or allows without naming anything.
- Opened once, on the first day.
Blocking software
- Blocks uploads on office laptops.
- Personal phones, outside companies, and agencies slip past it.
- Leaves open which information may go where.
A blanket ban
- Staff keep using the tools on their own phones.
- Loses the productivity.
- Leaves the copies at outside companies untouched.
Rules built on your map
- Names your systems, your kinds of information, and your people.
- Dated proof for whoever asks.
AI governance, answered.
What happens when company information goes into AI tools without rules? +
Think of it as handing your files to a stranger who keeps a copy.
- The AI company can use what you typed to teach its model. Your competitor uses the same model.
- The AI company keeps a copy of what you typed, often for a month or more.
- A secret recipe is only a secret while you keep it in-house. Once it goes out, it is harder to sue whoever copies it.
- Your clients' contracts say you will not share their material with outsiders. The AI company is an outsider.
- Customer or staff details in the file bring the DPDP law in as well. The top fine is Rs 250 crore.
What is AI governance for a company? +
House rules for AI tools, written down.
- Which information can go into which tool.
- Who says yes when someone needs an exception.
- Proof that the rules are being followed, so you can show a client or an investor.
Does DPDP cover this? +
Only partly.
- DPDP covers information about people: your customers, your staff.
- Your recipes, code, prices, and contracts are yours to protect. DPDP says nothing about them.
- MBS handles both halves. Sanctum for the DPDP half, this work for the business half.
Should we ban AI tools? +
If you ban the tools, people will do the same work on their personal accounts, and you will have no idea where your data went. A ban loses.
- Rules beat a ban. Say which tools are fine for which kind of information.
- Everyday work stays free: drafting emails, summarising a public article.
- Your most valuable information, the recipe, the code, the footage, stays out of every tool.
How long does it take? +
Weeks, once the map exists.
- First we map what you hold and where it goes.
- Then the rules, the vendor contracts, and one training session for your team.
- The first call tells you how big the job is and how long it takes.
Map first.
Thirty minutes with Sushant Pasumarty. You leave knowing which of your data is already inside an AI tool, and what to do about it.
Book a mapping callAI governance, an AI usage policy, AI rules for staff, data security advisory, or protecting your secrets from AI tools: the names differ and the work is the same. Meridian Bridge Strategy builds it on the Business Data Map, with the policy and vendor terms drafted by Dayitva Legal, for Indian companies, led by Sushant Pasumarty.