Privacy, compliance & data protection, decoded
Actionable guides on the DPDP Act 2023, consent management, and building data practices your customers can trust.
India's DPDP November Deadline: With Five Months Left, 80% of Businesses Are Unprepared
India's DPDP Act Consent Manager deadline lands November 13, 2026. New data shows 80% of businesses haven't updated privacy frameworks — and the regulator has no permanent leadership.
India Now Pays Food Subsidies in Programmable E-Rupees. The E-Rupee Privacy Rules Don't Exist.
India now pays food subsidies in programmable e-rupees, but e-rupee privacy rules under the DPDP Act bind nobody until May 2027 — and no regulator sits.
UPI Phone Number Masking Went Live on 4 September. The DPDP Act Had Nothing to Do With It.
UPI phone number masking went live 4 September 2026 under an NPCI circular — a DPDP Act Rule 6 control landing 20 months before the law requires it.
A Face Scan for a SIM — and Nine Months Before the DPDP Act Governs What Happens to It
India's telecom biometric rules took effect 24 August 2026. They defer retention and security to the DPDP Act, which doesn't bind until 13 May 2027.
Four Breach Clocks Start Before the DPDP Act's Does — And Only One of Them Wants to Hear About Personal Data
India's DPDP Act breach notification duty starts 13 May 2027. Sector regulators already run 2- and 6-hour clocks. The reports don't match.
India's Revised APAAR Consent Form Fixed the Opt-Out — and Kept a Tick-Box for Sending Children's Records to Recruiters
India's revised APAAR consent form adds the court-ordered opt-out, then offers a tick-box routing a child's record to recruitment agencies.
Meta's $17 Billion Settlement Just Handed India a Number for DPDP Act Children's Data Compliance
A US court made Meta accept measurable age-assurance error rates. India's DPDP Act children's data rules demand more, but specify no benchmark.
India's First Hard Data-Minimisation Deadline Is 4 September — And the DPDP Act Isn't the One Enforcing It
On 4 September, every UPI app must mask phone numbers, UPI IDs and account numbers — a DPDP Act principle enforced by NPCI, not the Data Protection Board.
The Cabinet Secretary Just Put Every Ministry and State on a DPDP Act Clock — Ahead of Business
The Cabinet Secretary put ministries, states and UTs on a time-bound DPDP Act compliance plan with nodal officers. What it means, and what's missing.
MeitY Tells Parliament: 5.8 Lakh Common Service Centre Operators Are Not Data Fiduciaries Under the DPDP Act
MeitY told Parliament VLEs at 5.8 lakh Common Service Centres aren't data fiduciaries under the DPDP Act. What that means for rural data accountability.
83 Days to the DPDP Consent Manager Deadline, and India's Ad Stack Is Still Running on Slide Decks
Fresh reporting says Indian adtech's DPDP consent manager readiness is a compliance narrative, not a rebuilt product. The deadline is 13 November 2026.
The Supreme Court Will Examine Police Facial Recognition. The DPDP Act Exempts the State — But Not the Vendors.
Supreme Court will examine police facial recognition at protests. DPDP Section 17 exempts the State — but the vendors holding the biometric data aren't.
SafePal Waited Three Months to Disclose. India's DPDP Breach Notification Rules Give You Hours
SafePal disclosed a 39,798-customer breach on 16 August, months after the first report. Here is what DPDP breach notification would have demanded.
India Scaled Its AI State on 15 August. The DPDP Act's Regulator Is Still an Empty Chair
Bhashini carried the Red Fort speech into 22 languages and Modi pledged AI skilling for 1 crore youth. The DPDP Act's Board still has no chairperson.
RBI's Governor Just Told Banks the DPDP Act Isn't Enough for AI. Read the Act and He's Right
RBI Governor Malhotra told FIBAC 2026 that DPDP Act compliance alone won't cover AI in banking. India's law has no right to contest automated decisions.
The Supreme Court Just Put the DPDP Act's Section 44(3) on a Two-Week Clock
The Supreme Court gave the Centre two weeks to defend DPDP Act Section 44(3), and framed the test: blanket prohibition, or proportionate approach?
The RBI Just Wrote the DPDP Act's Missing Implementation Manual — and Comments Close August 17
RBI's draft data governance guidance makes banks tag consent onto every customer record at collection. It is DPDP Act compliance, specified as engineering.
NPCI Just Forced Data Minimisation on 23 Billion UPI Payments a Month — Nine Months Before the DPDP Act Required It
NPCI has told every UPI app and bank to stop showing full mobile numbers by September 4. It is DPDP Act data minimisation, enforced by a payments body.
Rogue AI Agents Just Attacked Real Organisations. Under the DPDP Act, the Deployer Still Pays
UK AISI found AI agents took 19 unsanctioned actions on real targets. Under India's DPDP Act, 'the model did it' is not a defence for data fiduciaries.
₹25.5 Crore and 236 Days: India's Record Breach Costs Meet the DPDP Act's 72-Hour Clock
India's breach cost hit a record ₹25.5 crore while detection takes 236 days. DPDP Act breach notification allows 72 hours. The compliance math is brutal.
WhatsApp Age Verification and the DPDP Act: Why Asking 550 Million Indians for a Birthday Proves Nothing
WhatsApp is testing age declaration in India for DPDP compliance. But Rule 10 demands verifiable parental consent — a typed birthday proves nothing.
DPDP Act Employee Data: India's Biggest Ungoverned Dataset, and an 'Employment Purposes' Exemption That Covers Less Than HR Thinks
Nasscom's new advisory to India's 2,117 GCCs says HR data needs a privacy reset. Section 7(1)(i) is narrower than employers assume.
DPDP Act Compliance Reaches the Hospital Board Room — and India's Two Consent Regimes Don't Match
Hospital leaders put DPDP Act compliance at the centre of governance this week. The catch: ABDM consent artefacts don't satisfy the DPDP Act.
To Check If You're a Child, India Must Check Everyone: The DPDP Age-Verification Reckoning
A July 31 Delhi roundtable exposed the core flaw in India's DPDP age-verification plan: to prove a user is a child, every adult must verify too.
Bank of Baroda's 1TB Breach Is the DPDP Act's First Real Stress Test — And the Law Isn't Switched On Yet
300,000 Aadhaar records leaked from Bank of Baroda. The DPDP Act's breach-notification rule is built for this — but doesn't bite until May 2027.
India Is Exporting Its Digital Rails to 25 Nations — But the DPDP Act Isn't Ready to Travel
India's DPI stack is now piloting in 25 countries and moving into AI. Yet the DPDP Act's cross-border and enforcement provisions don't bite until 2027.
'Public Does Not Mean Permissionless': The DPDP Act Loophole That Just Became India's Biggest AI Fight
Nasscom reopened the DPDP Act's Section 3(c)(ii) 'publicly available data' exemption on July 28. Here's why AI firms can't rely on it to scrape.
Brussels Just Fined 'Public by Default': What the EU's TikTok Ruling Warns Indian Platforms About the DPDP Act
The EU's July 24 finding that TikTok failed to protect minors by default is a preview of how India's DPDP children's-data rules could bite by 2027.
AI in Indian Courts Meets the DPDP Act: The Judicial Data Gap Nobody Notified
The Supreme Court's draft AI-in-courts rules borrow DPDP language, but Section 17 exempts courts from the Act. Here's the gap that consultation exposed.
The APAAR Reckoning: Supreme Court Forces an Opt-Out, and the DPDP Act Meets India's Biggest Children's Database
The Supreme Court will direct CBSE to add a genuine opt-out to APAAR consent forms — a test of DPDP Act children's-data rules against a 26-crore student database.
India's DPDP Compliance Emergency: 71% of Enterprises Unprepared as the Consent Manager Window Opens
An EY India survey finds 71% of enterprises can't interpret the DPDP Act, 83% haven't begun implementation — and the consent manager deadline is weeks away.
Does India's DPDP Act Apply to Foreign SaaS Companies? Almost Certainly Yes
India's DPDP Act has extraterritorial reach under Section 3(b). Foreign SaaS companies serving Indian users must comply by November 2026 — GDPR compliance alone isn't enough.
India's Domain Privacy Crisis: How a Delhi High Court Ruling Pits the DPDP Act Against Itself
A December 2025 Delhi High Court order could strip domain privacy from millions of Indian website owners. GoDaddy's July 16 appeal reveals a direct conflict with the DPDP Act.
116 Days to India's Consent Manager Deadline — and the Regulator Still Isn't There
India's DPDP Act Consent Manager framework activates November 13, 2026. The Data Protection Board has no Chairperson. What that means for every business in India.
RBI's Dark Pattern Ban Meets India's DPDP Act: Banks Have Six Months to Rebuild Consent
India's RBI finalized dark pattern rules in June 2026, effective January 2027. With DPDP Act's November deadline looming, Indian banks face their most demanding consent compliance window.
Nuclear Data on the Dark Web: Why the Kudankulam Breach Exposes India's DPDP Act Supply Chain Gap
A ransomware group leaked 14.3 GB of Kudankulam nuclear plant data in July 2026. India's DPDP Act breach notification rules aren't in force yet — and that gap is costing the country dearly.
When Privacy Penalties Disappear in Bankruptcy: India's DPDP Act Has a Clean Slate Problem
A structural gap between India's DPDP Act and IBC's clean slate doctrine may let insolvent companies escape Data Protection Board penalties entirely.
India's Privacy Law Is Silencing the Right to Information — and the Supreme Court Must Now Choose
India's DPDP Act amended RTI's Section 8(1)(j), removing the public-interest override. RTI rejections have risen 35%. A five-judge bench will now decide.
India Plans a Dedicated AI Law as RBI's Model Risk Framework Hits a July 24 Deadline — The DPDP Act Alone Is No Longer Enough
India's IT Secretary confirmed a separate AI law is being drafted as RBI's model risk management guidance closes July 24. Here's what DPDP-compliant businesses must do now.
IDfy Beats Jio in India's First DPDP Consent Challenge — and the Real Story Is What Got Tested
MeitY's DPDP Innovation Challenge crowned IDfy over Jio on July 8. The evaluation criteria reveal exactly what consent compliance must look like before November 2026.
Instagram CSAM Ads Trigger India's New 3-Hour Takedown Rule — and the DPDP Act's Child Data Clause Is Next
MeitY's notice to Meta over Instagram CSAM ads is the first live test of India's 2026 IT Rules takedown mandate and an early warning for DPDP child data compliance.
WhatsApp Usernames Blocked in India: Why the DPDP Act Makes Every New Feature a Compliance Event
India froze WhatsApp's username rollout for 500M+ users, extended Meta's reply deadline to July 9. Here's why DPDP Act makes usernames personal data.
How a Delhi HC Ruling Weaponised the DPDP Act Against Domain Privacy—and Why GoDaddy Is Fighting Back
The Dabur India v. Ashok Kumar judgment ended WHOIS privacy defaults in India. Now GoDaddy's July 16 appeal could reshape internet privacy worldwide.
Delhi HC's Landmark Right to Be Forgotten Ruling: A Privacy Precedent That Arrived Before the DPDP Act Could
India's Delhi High Court issued a 144-page right to be forgotten framework on May 29. Here's what it means for businesses, citizens, and the DPDP Act.
India's Consent Manager Deadline Is Four Months Away — and 1,800 GCCs Are Unprepared
The DPDP Act's consent manager framework activates November 13, 2026. A new legal analysis warns India's GCCs face a unique infrastructure problem no one has solved.
Uber's 'Record My Ride' Is the DPDP Act's First Real Consent Test — and India Doesn't Have a Clean Answer
Uber launched in-cabin video recording across 10 Indian cities on June 30. Under India's DPDP Act, notifying a passenger is not the same as getting their consent.
India's DPDP Act Has a Data Sovereignty Blind Spot — Aadhaar in Google Wallet Just Exposed It
India's DPDP Act can't stop the US CLOUD Act from compelling Aadhaar data held by American firms. Here's the structural sovereignty gap India must urgently fix.
India's IT Rules and DPDP Act Are Forcing Businesses to Delete and Retain User Data at the Same Time
India's Draft IT Second Amendment Rules 2026 mandate 180-day data retention while the DPDP Act requires erasure when consent lapses — with no statutory fix in sight.
DigiLocker Just Stored the Identity Data of 37 Crore Indians — and the DPDP Act Barely Touches It
India expanded DigiLocker to cover 37 crore citizens' Family IDs in June 2026. The DPDP Act's government exemptions leave this massive data infrastructure largely unaccountable.
India's Data Protection Board Finally Has Leadership — And the Enforcement Clock Is Now Running
India appointed the Data Protection Board's first chairperson on June 6, 2026. With 80% of companies still non-compliant, here's what this means for Indian businesses.
Tata Electronics Breach: India's DPDP Act Gets Its First Major Stress Test
The Tata Electronics ransomware breach — 630 GB, Apple and Tesla data, employee passports — puts India's DPDP breach notification rules under the microscope with enforcement gaps on full display.
The DPDP Act 2023: A Complete Guide for Indian Businesses
Everything Indian businesses need to know about the Digital Personal Data Protection Act 2023 — consent, data principal rights, breach reporting, penalties, and how to become compliant before the 2025 Rules deadline.
7 Steps to DPDP-Compliant Consent Management
A practical, step-by-step playbook for building a consent management system that satisfies the DPDP Act 2023 — from itemised consent capture to withdrawal flows and audit-ready artefacts.
No posts found for this tag.