Purchase invoice capture, matching, approvals and posting.
AI automation agency for Indian businesses
Scenox is an AI automation agency and AI development company for businesses in India. We design, build and run AI workflows and agents for finance, operations, customer service and sales. Indian builds are shaped by the DPDP Act 2023 and its 2025 Rules, GST e-invoicing through the IRP, Tally and Zoho Books ledgers, and customers who expect WhatsApp.
Most of the DPDP obligations start in 2027, and GST e-invoicing already applies above INR 5 crore turnover. Systems built now should meet both from the first release.
Indian rules that shape an AI buildChecked 15 October 2026
- Data protection law
- Digital Personal Data Protection Act, 2023, with the DPDP Rules, 2025
- Most DPDP Rules in force
- 18 months after 13 Nov 2025 publication (around May 2027)
- Breach report to the Board
- Detailed report within 72 hours of becoming aware
- Processing logs
- Kept for at least one year
- GST e-invoicing
- B2B, exports and SEZ supplies above INR 5 crore turnover, since 1 Aug 2023
- IRP reporting window
- 30 days for AATO of INR 10 crore and above, from 1 Apr 2025
DPDP Act and Rules: what applies when
The Act received assent on 11 August 2023. The Rules were published in the Gazette on 13 November 2025 and start in three stages.
| Stage | Rules | In force |
|---|---|---|
| Data Protection Board | Rules 1, 2 and 17 to 21 | On publication, 13 November 2025 |
| Consent Manager registration | Rule 4 | One year after publication |
| Main obligations | Rules 3, 5 to 16, 22 and 23: notice, security, breach, retention, children's data, Significant Data Fiduciaries, rights and transfers | Eighteen months after publication |
Scroll sideways to see every column.
The Government has established the Data Protection Board of India under Section 18 of the Act and invited applications for its Chairperson and Members in May 2026. Penalties under the Act go up to INR 250 crore for failing to take reasonable security safeguards.
What the DPDP Act means for an AI system
You are the Data Fiduciary. An automation partner that processes personal data for you is your Data Processor, and the Rules expect a contract between you.
What the Act and Rules require
- Consent that is free, specific, informed, unconditional and unambiguous, with a notice, unless a legitimate use applies
- Security safeguards including encryption, masking or tokens, access control, logs and monitoring, and backups
- Personal data, traffic data and processing logs kept for at least one year, then erased unless another law needs them
- Breach intimation to affected people without delay, and a detailed report to the Board within 72 hours
- For Significant Data Fiduciaries: an annual impact assessment and audit, and checks that algorithmic software does not put people's rights at risk
How we build for it
- Every agent action is logged with inputs, outputs and approver, and logs are kept for at least a year by default
- Names, phone numbers and IDs are masked before text goes to a model wherever the task allows
- Consent status is checked before any outbound WhatsApp, email or call
- A breach runbook with the 72-hour clock is part of the handover, not an afterthought
- We list every model and hosting provider that sees personal data, and the country it runs in
GST e-invoicing and the IRP: what finance automation has to respect
An e-invoice is a B2B invoice reported to an Invoice Registration Portal, which returns an IRN and a signed QR code. Without a valid IRN the invoice is not valid.
| Rule | What it says | What it means for automation |
|---|---|---|
| Who must e-invoice | Taxpayers whose aggregate turnover exceeded INR 5 crore in any financial year since 2017-18, from 1 August 2023 (Notification 10/2023-Central Tax) | The ERP or billing flow has to register every B2B invoice, credit note and debit note before it is sent |
| Exempt categories | Insurers, banks, financial institutions and NBFCs, goods transport agencies, passenger transport, multiplex admissions, SEZ units, and government departments and local authorities | Exempt entities still need clean invoice data, but no IRN step |
| Format and portals | JSON in the INV-01 schema, reported to one of six IRPs; the IRP returns the IRN and QR code and the data flows to GSTR-1 | We build and validate the JSON from your ledger data before submission, so IRP rejections are rare |
| 30-day reporting limit | From 1 April 2025, taxpayers with AATO of INR 10 crore and above cannot report e-invoices older than 30 days | A daily check lists invoices without an IRN and the days left before the window closes |
| E-way bills | The e-invoice data is used to create Part A of the e-way bill | Dispatch waits for the IRN, so the e-way bill can be generated from the same data |
| Invoice Management System | Since 1 October 2024, recipients accept, reject or keep pending each supplier invoice on the GST portal before filing GSTR-3B | Supplier invoices are matched against your purchase register and orders, with rejections proposed for a person to confirm |
Scroll sideways to see every column.
On 8 October 2026 the 57th GST Council recommended extending e-invoicing to supplies received from unregistered persons under reverse charge, and to import of services, for taxpayers with turnover of INR 5 crore and above. That is a recommendation, not yet notified.
The Indian finance stack we connect to
Indian finance teams often run Tally or Zoho Books alongside a GST tool, or a larger ERP in bigger groups. We work with what you have.
Tally
Vouchers, ledgers and masters synced through Tally's integration interface, with a connector running beside your Tally installation where it sits on a local machine.
Zoho Books
Bills, invoices, contacts and payments through the Zoho Books API, with your existing GST settings and approval rules kept.
SAP, Dynamics and NetSuite
For larger groups: SAP S/4HANA, Dynamics 365 Business Central and NetSuite, with tax codes and entities mapped per GSTIN.
GST and IRP tools
Your existing GST software or IRP connection stays. We prepare clean data for it and work the exceptions it raises.
Banks and payments
Bank statements and payment files reconciled against open invoices, with unmatched items queued for review.
CRM and helpdesk
Zoho CRM, HubSpot, Salesforce and Freshdesk-style helpdesks for sales and service workflows.
Where AI automation pays off for Indian teams
Workflows with high volume, clear rules and a few judgment calls. Each one keeps a person on the decisions that carry risk.
- Automated
Purchase invoices to Tally or Zoho Books
Invoices from email and WhatsApp are read, checked for supplier GSTIN, HSN or SAC codes and tax amounts, matched to the purchase order, and posted.
A person decides: approving mismatches and new suppliers.
- Automated
IMS reconciliation
Supplier invoices on the GST portal are matched to your purchase register each period, and the agent proposes accept, reject or pending for each one.
A person decides: confirming every rejection before it is filed.
- Automated
IRN and dispatch checks
Sales invoices are validated before IRP submission, and nothing is marked ready for dispatch until the IRN and QR code are back.
A person decides: fixing the invoices the IRP refuses.
- Automated
Collections on WhatsApp
Payment reminders go out on WhatsApp in English, Hindi or the customer's language, and replies such as 'paid yesterday' or 'send the invoice again' are handled automatically.
A person decides: disputes and payment plans.
- Automated
Customer service on WhatsApp
Order status, appointment booking and document collection answered from your systems, with voice notes transcribed and handled.
A person decides: complaints and anything outside policy.
- Automated
Document collection and KYC files
PAN, GST certificates, bank details and agreements collected, checked for completeness and legibility, and filed against the right record.
A person decides: the final verification decision.
For example, a distributor receiving 1,500 purchase invoices a month across email and WhatsApp might have three people keying them into Tally. If 60% of those invoices matched cleanly, that would be 900 a month posted without retyping, and the team would work only the exceptions. The real split depends on your suppliers, so we measure it on your own invoices during the audit.
AI governance in India
India regulates AI mostly through existing laws such as the DPDP Act, with national guidelines on top.
India AI Governance Guidelines
Released by MeitY in November 2025 under the IndiaAI Mission, with seven principles (sutras), six pillars and practical guidance for industry. The stated focus is to use existing legislation wherever possible.
What we hand over
A record of what each system does, the data it touches, where people approve, how accuracy is measured and who to call when it fails. That covers most questions a board, auditor or customer will ask.
Sources: [12]
Related pages
The solutions, blueprints and ERP guides this work connects to.
Field extraction for invoices, GST certificates and KYC documents.
WhatsApp, chat and email answered from your own systems.
Purchase order to payment, with three-way match and approvals.
Order, invoice, IRN, dispatch and collection, stage by stage.
Billing, vendors and tax codes in SAP for larger groups.
Subsidiaries, vendor bills and invoices in NetSuite.
What a workflow audit delivers, using a fictional AP example.
Questions from Indian teams
Does the DPDP Act apply to AI chatbots and agents?
Yes, whenever they process digital personal data. The business deploying the chatbot is the Data Fiduciary and needs a valid basis such as consent or a legitimate use, a notice, reasonable security safeguards and a way to handle rights requests. An automation partner processing that data on its behalf acts as a Data Processor.
When do the DPDP Rules come into force?
In stages. The Rules on the Data Protection Board applied when they were published on 13 November 2025. Consent Manager registration starts one year after publication. The main obligations, including notice, security safeguards, breach intimation, retention and cross-border rules, start eighteen months after publication, which is around May 2027.
Can we send personal data to AI models hosted outside India under DPDP?
Section 16 of the Act lets the Central Government restrict transfers to countries it notifies, and the Rules let it set requirements by order. We found no restricted-country notification as of October 2026. Significant Data Fiduciaries may also be required to keep specified data in India. We record where each provider processes data so you can decide.
Who needs GST e-invoicing in India?
Taxpayers whose aggregate turnover exceeded INR 5 crore in any financial year since 2017-18, for B2B supplies, supplies to SEZs, exports and deemed exports, from 1 August 2023. Some categories are exempt, including banks, insurers, NBFCs, goods transport agencies, passenger transport, SEZ units and government departments.
Can AI generate the IRN for our invoices?
No. Only an Invoice Registration Portal issues the IRN and signed QR code. Automation prepares and validates the INV-01 JSON from your ledger data, submits it through your ERP or GST tool, watches the 30-day window and handles the invoices that come back with errors.
Do you integrate with Tally and Zoho Books?
Yes. We read and write vouchers, ledgers, bills and invoices in Tally through its integration interface, and in Zoho Books through its API. Your chart of accounts, GST settings and approval rules stay as they are.
Official sources
Checked on 15 October 2026. Rules and dates change, so confirm the current text with the publisher or your adviser before you act on it.
- [1]The Digital Personal Data Protection Act, 2023
Ministry of Electronics and IT (meity.gov.in)
Assent on 11 August 2023, definitions, consent and notice, legitimate uses, Section 16 transfers and the penalty schedule.
- [2]Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))
Gazette of India, MeitY notification of 13 November 2025
Commencement stages (Rule 1), security safeguards (Rule 6), breach intimation and the 72-hour report (Rule 7), one-year log retention (Rule 8), SDF duties (Rule 13) and transfers (Rule 15).
- [3]Government notifies the Digital Personal Data Protection Rules, 2025
Press Information Bureau (pib.gov.in), 14 November 2025
The 18-month phased compliance timeline.
- [4]Notice inviting applications for the Data Protection Board of India
MeitY, May 2026
The Board has been established under Section 18 of the Act.
- [5]Notification 10/2023-Central Tax: e-invoicing above INR 5 crore
GST Council (gstcouncil.gov.in)
E-invoicing for aggregate turnover above INR 5 crore from 1 August 2023.
- [6]E-invoice overview
GSTN (tutorial.gst.gov.in)
Turnover test, covered documents, the six IRPs, the INV-01 JSON schema, IRN and QR code, and GSTR-1 auto-population.
- [7]Manual on e-invoice exemption
GSTN e-invoice portal (einvoice.gst.gov.in)
Exempt categories under Notifications 13/2020, 61/2020 and 23/2021-Central Tax.
- [8]Advisory: time limit for reporting e-invoices on the IRP (AATO INR 10 crore and above)
GSTN (einvoice1.gst.gov.in)
The 30-day reporting limit from 1 April 2025 for AATO of INR 10 crore and above.
- [9]E-invoice system: concept and FAQs
GSTN (tutorial.gst.gov.in)
E-invoice data used to create Part A of the e-way bill.
- [10]Revised advisory on the Invoice Management System (IMS)
GSTN (tutorial.gst.gov.in)
IMS from 1 October 2024: accept, reject or pending for inward invoices before GSTR-3B.
- [11]Recommendations of the 57th meeting of the GST Council
Press Information Bureau via gstcouncil.gov.in, 8 October 2026
The recommendation to extend e-invoicing to reverse-charge supplies from unregistered persons and to import of services.
- [12]MeitY unveils India AI Governance Guidelines
Press Information Bureau (pib.gov.in), 5 November 2025
The guidelines' seven sutras and six pillars, and the focus on existing legislation.
Tell us which workflow your team keys in by hand.
A 30-minute call with an engineer. Tell us your ledger, your volumes and your channels; we will tell you what a system could take off your team's desk.
What happens next
- 1
Strategy call
We learn how the workflow runs today and what a good outcome would be.
- 2
Workflow audit
We map the process and measure where a system would save the most time.
- 3
Proposal
A written scope, timeline and fixed price for your first system. No obligation to build.