India enacted DPDPA, while we are in transition phase which allows significant time for organisations to comply with the act, it seems every organisation is busy rewriting the privacy policies, integrating cookie banners, and cookie policies. While the front door looks secure back door is wide open. There is a massive privacy gap nobody is talking about: “Application Programming Interface”. API’s are ubiquitous serving as backbone of the modern wireless connectivity. They a

Consent managers are the entities, recognised under DPDPA to act on behalf of data principals, to give, review, manage and withdraw consent. They provide an interoperable platform where it would be easy for data principals to give, manage, review and withdraw consent instead of visiting dozens of websites. Under Schedule 1 of the DPDPA rules, it mandates having not less than two crore rupees of net worth to act as a consent manager. But still the chances of monetising are ve

Record of Processing Activities (RoPA) is one of those privacy concepts that the law does not necessarily name, but compliance quietly depends on. Under the DPDP framework, neither the Digital Personal Data Protection Act, 2023 nor the Rules expressly say: “Every organisation must maintain a Record of Processing Activities.” RoPA is traditionally associated with the GDPR, particularly Article 30, which expressly requires certain organisations to maintain records of processing

The DPDP Act and rules are coming into force from May 2027 as notified by the central government. The act is the first ever comprehensive law in India to protect digital personal data of an individual. However, the act and rules have triggered a major wave of high-stakes legal battles in India. One among them is with regard to section 44(3) of DPDPA, amending the section 8(1)(j) of RTI Act, and there by now it is prohibited for Public Information Officers to disclose any pers

The remote work and zoom boom era in the early 2020 led to the genesis of AI meeting bots. The true origin of AI meeting bots was directly out of pandemic-triggered remote work fatigue. They are capable of condensing hour-long conferences/meetings into concise executive summaries. The evolution of AI meeting bots occurred in various phases. Initially they were a backend tool rather than sitting in the meeting room, which required users to upload the audio file once the meeti

In law we have a well-known maxim called “ubi jus ibi remedium”, which means where there is a right, there is a remedy. If an act provides various rights but fails to provide right to compensation, if fails and exists only on paper. The DPDP act, which got its presidential assent on 11 August 2023, provides various rights to data principal such as right to access, correct, update, erase, and nominate. But it doesn’t have a standalone right to compensation. The act made headl

Transparency is one among the fundamental principles of India’s data protection framework, reflected in Digital Personal data protection act, 2023, which places obligation on data fiduciaries concerning notice, processing, and accountability. Yet, the treatment of publicly available data under section 3(c)(ii) raises an important question: Does public availability of individual’s personal data diminish her/his expectation of transparency regarding the subsequent use of their