Insights
Technology, data and product
Notes on Indian law filed under Technology, data and product. The practice itself is described on its own page.
A telemedicine product in India answers to three regulators at once, and only the doctor may prescribe
A telemedicine product in India answers to three regimes that do not share a regulator.
Location and driving data from a vehicle telematics device is personal data under the DPDP Act from 13 May 2027
From 13 May 2027, the location and driving records that a vehicle telematics device produces are personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act) whenever the vehicle can be tied to the person driving it.
The two-factor rule for a domestic digital payment now runs under one set of Directions, with one factor dynamic and the issuer bearing any loss on a payment that does not comply
The Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025, issued on 25 September 2025, required every payment system provider and participant, bank or non-bank, to comply by 1 April 2026.
A deepfake of your chief executive runs on a seven day clock, unless you hold a court order
The February 2026 amendment to the Information Technology Rules is reported as a three hour takedown rule.
An AI vendor's indemnity moves the money, not the responsibility: contracts, diligence and disclosure
Contracts for AI tools are usually drafted as if a warranty and an indemnity settle who answers for the tool.
AI and patents, trade secrets and training data in India
Where Indian law stands on patenting AI, naming an AI as inventor, protecting models as trade secrets, and using copyright works as training data.
There is no AI statute in India, and the one AI rule that binds you today is about labels
A business buying or building AI in India is usually told it faces a new compliance regime.
Online money games are prohibited in India from 1 May 2026, and the tax on the years before that survives the prohibition
The Promotion and Regulation of Online Gaming Act, 2025 came into force on 1 May 2026, and it does not regulate online money games.
The DPDP Rules are notified, and almost nothing in them binds until 13 May 2027
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 as G.S.R. 846(E).
The DPDP exemption for schools and universities covers tracking and behavioural monitoring, not every use of a student's data
From 13 May 2027, section 9 of the Digital Personal Data Protection Act, 2023 requires verifiable consent of a parent before any personal data of a child, anyone under eighteen, is processed, and bars tracking, behavioural monitoring and targeted advertising directed at children.
Digital lending is now one instrument, and a default loss guarantee cannot exceed five per cent of what the portfolio disbursed
The Reserve Bank of India (Digital Lending) Directions, 2025 took three circulars written over five years and replaced them with one, and in doing so moved the default loss guarantee out of a standalone 2023 circular and into a chapter of the regime it always belonged to.
By sector
By practice
By author