Blogs and Articles

DPDP Rule 13(3): India’s Algorithmic Software Due Diligence Obligation

The DPDP Rules were not drafted as an AI law.

Does Processing Personal Data Through A Foreign Data Centre Constitute A Cross-Border Transfer Under The DPDP Act And The GDPR?

For ex- An Indian company uploads encrypted employee records to a foreign cloud server.

Does Mere Accessibility Of A Foreign Website In India Confer Jurisdiction Under Section 3(b) Of The Digital Personal Data Protection Act, 2023?

Section 3(b) of the Digital Personal Data Protection Act, 2023 provides that the Act shall: “also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India.” Section 3(b) is therefore the Act’s principal extraterritorial provision.

Generative AI In Litigation: Privilege Limits, Work Product Protection, And Platform Governance

This report explains the privilege and liability risks that arise when lawyers, clients, in-house teams, or litigants use generative AI tools like ChatGPT, Claude, Gemini, or similar platforms to develop litigation strategies.

Data Retention - Statutory Retention Schedule

Under the DPDPA, deletion is the default. But record-keeping laws require many business records to be kept for years. Keep each record for the longest period that applies, and only then erase.

When Artificial Intelligence Meets The Marketplace

Artificial Intelligence, or AI, refers to computer systems that can perform tasks that normally require human thinking.

ANI Media Pvt. Ltd. V. Openai Opco LLC

ANI is a news agency.

Can Employers Blacklist Employees Under The GDPR And The DPDP Act?

“Blacklisting” refers to the systematic recording, classification or communication of adverse information about an employee for the purpose or of restricting that individual’s access to employment.

CCTV Under The DPDPA 2023: A Complete Compliance Guide

India has over 15 million CCTV cameras deployed across homes, offices, malls, hospitals, banks, and public spaces.

CCTV Surveillance Under DPDPA: Understanding The Legal Obligation Exception

CCTV footage that captures identifiable individuals is personal data, and whoever decides why and how it is recorded is a Data Fiduciary, so the recording needs a lawful basis under the DPDPA.

Can Certification Replace Processor-Specific Safeguards?

The drafters could recognise ISO/IEC 27001 as strong evidence that a Data Processor maintains a baseline information security management system.

The Consumer Protection (E-Commerce) (Amendment) Rules, 2026: A Data Protection Reading

On 9 September 2026, the Ministry of Consumer Affairs, Food and Public Distribution notified the Consumer Protection (E-Commerce) (Amendment) Rules, 2026, amending the Consumer Protection (E-Commerce) Rules, 2020 made under the Consumer Protection Act, 2019.

Not Every Data Principal Has A Right Of Access, Correction And Erasure Under DPDPA

Ask most people what rights the DPDP Act gives them, and they would likely list access, correction, erasure, grievance redressal and nomination as one common set of rights available to every Data Principal against every Data Fiduciary.

Can An Indian Data Principal Obtain Compensation For A Privacy Breach Under The Digital Personal Data Protection Act, 2023?

The penalty mechanism of the DPDPA is contained in Chapter VIII of the Act, specifically Sections 33 and 34, and the accompanying Schedule.

Data Privacy And AI Regulation

This report examines the collision between artificial intelligence and data protection law.

Defining “Employment Purpose” Under Section 7(i) Of The DPDP Act, 2023

The GDPR allows an employer to rely on the employment contract only where the processing is objectively necessary for its performance.

The DPDPA's Accountability Model: Processor Autonomy, Essential And Non-Essential Means, And Data Fiduciary Liability Under The DPDPA

The DPDPA adopts a distinctive accountability model under which the Data Fiduciary remains responsible for compliance even when personal data is processed by a third-party Data Processor on its behalf.

Role Of External Legal Counsel In Personal Data Breach Response

A data breach is an evidentiary event, not just a technical incident.

Five Requirements For Valid Consent

A statutory analysis of Section 6(1) of the DPDPA 2023 read with the DPDP Rules, 2025.

HR Data Processing: Applicable Basis And When Consent Is Needed

HR and talent teams often treat “consent” and “legitimate use” as interchangeable, and often treat employees, interns and candidates as one class of workforce data.

Material And Territorial Scope Of The Digital Personal Data Protection Act, 2023 (DPDPA)

The Digital Personal Data Protection Act, 2023 (DPDPA) fundamentally differs from the European Union's GDPR in one critical aspect: it is technologically specific rather than technologically neutral.

Mistakes People Make While Drafting Data Protection Clauses And Data Processing Agreements

With the DPDPA compliance deadline approaching May 2027, organizations are moving quickly to amend existing agreements or execute data protection addendum.

RBI’s Draft Model Risk Framework: The Key AI Controls And Its Alignment With Meity Guidelines

I have been reading a lot of misleading posts claiming that the “RBI HAS BANNED AI”.

Regulating Artificial Intelligence At The Workplace

Walk into any office in India today and you will find employees using AI tools.

Understanding The Supreme Court Of India’s Draft Regulations For The Use Of Artificial Intelligence In Courts, 2026

The Supreme Court of India has released the draft Regulations for Use of Artificial Intelligence (AI) in Courts, 2026 for public consultation, inviting comments and suggestions until 20 June 2026.

Privacy Professionals Need To Unlearn Their GDPR Biases Before Interpreting The Provisions Of The DPDP Act.

Most privacy professionals in India learned data protection law through the GDPR.

When Does HR Need Consent?

Family members & nominees are separate Data Principals Their information does not ride on the employee's record.

The Right Balance: How To Fix European Union Artificial Intelligence Regulation

GDPR Vs DPDP: What's Actually Different

Side-by-side: lawful bases, rights, breach notification, cross-border transfers, and where the DPDP Act is intentionally narrower.

A Plain-English Guide To India's DPDP Act, 2023

What the DPDP Act actually requires — without the jargon. A practitioner's walkthrough for businesses, GCs and compliance teams.