Notes on Indian law filed under Technology, data and product, published by Juris Eagle.https://juriseagle.com/insights/practice/technology-data-and-producten-inMon, 09 Nov 2026 12:40:42 GMThttps://juriseagle.com/disclaimerhttps://juriseagle.com/insights/telemedicine-product-india-four-regimeshttps://juriseagle.com/insights/telemedicine-product-india-four-regimesA telemedicine product in India answers to three regimes that do not share a regulator. The Telemedicine Practice Guidelines of 25 March 2020, Appendix 5 to the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, let only a registered medical practitioner counsel or prescribe, and bar a platform built on artificial intelligence from doing either. The National Medical Commission (NMC) put its own 2023 conduct regulations in abeyance and adopted those 2002 Regulations by a notification of 23 August 2023. Software that diagnoses, monitors or treats is a medical device under the Medical Devices Rules, 2017 (MDR) and falls into Class A, B, C or D by its intended use. Patient data comes under the Digital Personal Data Protection Act, 2023 (DPDP Act), whose main duties begin on 13 May 2027.Tue, 03 Nov 2026 00:00:00 GMTAdv. Harsha Swaroop PTechnology and datatechnology-data-and-producthttps://juriseagle.com/insights/vehicle-telematics-location-data-dpdp-dutieshttps://juriseagle.com/insights/vehicle-telematics-location-data-dpdp-dutiesFrom 13 May 2027, the location and driving records that a vehicle telematics device produces are personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act) whenever the vehicle can be tied to the person driving it. The fleet operator that decides why the data is collected is the data fiduciary, and the telematics provider that holds it for the fleet is a data processor, until the provider uses it for its own ends. Consent and notice (sections 5 and 6), the employment ground in section 7(i), erasure (section 8(7)) and breach notice within 72 hours (rule 7 of the DPDP Rules, 2025) then apply to each trip record.Tue, 03 Nov 2026 00:00:00 GMTAdv. Harsha Swaroop PTechnology and datatechnology-data-and-producthttps://juriseagle.com/insights/two-factor-authentication-directions-2026https://juriseagle.com/insights/two-factor-authentication-directions-2026The Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025, issued on 25 September 2025, required every payment system provider and participant, bank or non-bank, to comply by 1 April 2026. A domestic digital payment needs at least two distinct factors of authentication unless it is exempted, and at least one of them must be dynamic unless the card is physically used at the point of transaction. Card issuers had until 1 October 2026 to put in place a mechanism to validate non-recurring overseas card not present payments where the overseas merchant or acquirer asks for authentication, and a risk-based mechanism for all of them. Where a loss arises from a transaction effected without complying, the issuer compensates the customer in full.Mon, 12 Oct 2026 00:00:00 GMTAdv. Harsha Swaroop PFinancial technology and paymentstechnology-data-and-producthttps://juriseagle.com/insights/a-deepfake-of-your-chief-executivehttps://juriseagle.com/insights/a-deepfake-of-your-chief-executiveThe February 2026 amendment to the Information Technology Rules is reported as a three hour takedown rule. For a company whose chief executive has been deepfaked into endorsing a fake investment scheme, that is the wrong number. The three hour clock in rule 3(1)(d) starts only on actual knowledge, and since November 2025 actual knowledge arises in two ways alone: a court order, or a reasoned written intimation from an officer not below the rank of Joint Secretary. The two hour clock belongs to an individual complaining about his own impersonation or intimate imagery, not to a company complaining about its brand. What a company gets by right is the ordinary grievance route: acknowledgement in twenty four hours and resolution in seven days, with no remedy against the mirror copies. Which is why every order in this space in 2025 and 2026 is an injunction.Thu, 08 Oct 2026 00:00:00 GMTAdv. Harsha Swaroop PTechnology and datatechnology-data-and-productwhite-collar-and-cyber-defencecivil-disputeshttps://juriseagle.com/insights/ai-in-contracts-diligence-and-disclosurehttps://juriseagle.com/insights/ai-in-contracts-diligence-and-disclosureContracts for AI tools are usually drafted as if a warranty and an indemnity settle who answers for the tool. In India they settle who pays, and only up to the cap. Responsibility sits elsewhere. The Securities and Exchange Board of India has already notified a regulation, regulation 16C of the Intermediaries Regulations, 2008, under which a regulated person using AI or machine learning tools is solely responsible for investor data, for the output of the tools and for compliance, whether it built the tool or bought it. The Digital Personal Data Protection Act, 2023 will say the same about personal data from 13 May 2027, irrespective of any agreement to the contrary. The Reserve Bank's FREE-AI report is a committee report, and the SEBI guidelines on AI use are still a June 2025 consultation as far as we could trace. So the drafting task is to price and cap a loss the buyer cannot hand over, and the diligence task is to find out what a target actually owns.Mon, 07 Sep 2026 00:00:00 GMTAdv. Adithya Karthik KTechnology and dataai-and-emerging-technologycontracts-and-procurementboardroom-and-corporatetechnology-data-and-producthttps://juriseagle.com/insights/ai-patents-trade-secrets-and-training-datahttps://juriseagle.com/insights/ai-patents-trade-secrets-and-training-dataWhere Indian law stands on patenting AI, naming an AI as inventor, protecting models as trade secrets, and using copyright works as training data.Fri, 31 Jul 2026 00:00:00 GMTDr. Vijay MishraTechnology and dataai-and-emerging-technologyip-and-licensingtechnology-data-and-producthttps://juriseagle.com/insights/ai-law-in-india-what-binds-todayhttps://juriseagle.com/insights/ai-law-in-india-what-binds-todayA business buying or building AI in India is usually told it faces a new compliance regime. It does not, yet. There is no AI statute. The Digital Personal Data Protection Act, 2023 is the instrument that will govern most AI use of personal data, and its substantive provisions are not in force: the commencement notification of 13 November 2025 puts sections 3 to 17, the data principal rights and the penalty section at 13 May 2027. The Data Protection Board exists but was still advertising for a chairperson and four members in May 2026. One AI-specific obligation does bind now, and it is narrow: the synthetic media provisions inserted into the Information Technology Rules in February 2026, which bind intermediaries rather than every company that uses a model. So the honest answer for most businesses is that the obligation is a dated clock, not a present duty, and the eighteen months are for building.Mon, 08 Jun 2026 00:00:00 GMTAdv. Harsha Swaroop PTechnology and datatechnology-data-and-productcontracts-and-procurementboardroom-and-corporatehttps://juriseagle.com/insights/online-money-games-after-the-prohibitionhttps://juriseagle.com/insights/online-money-games-after-the-prohibitionThe Promotion and Regulation of Online Gaming Act, 2025 came into force on 1 May 2026, and it does not regulate online money games. It prohibits them, together with their advertising and the banking that pays for them, and it reaches a service operated from outside India for players inside it. The definition that carries the prohibition is drafted to make the old skill and chance argument irrelevant, so a rummy or fantasy platform is in the same position as a casino product. What the Act promotes is a narrower set: e-sports recognised under the National Sports Governance Act, 2025, and online social games played without stakes, both of which register with an authority rather than being left alone. The liability a closed platform leaves behind is the tax, and on 27 May 2026 the Supreme Court held the stake, not the commission, to be the measure of it.Wed, 03 Jun 2026 00:00:00 GMTDr. Vijay MishraGaming and online platformstechnology-data-and-producttaxation-and-fiscalwhite-collar-and-cyber-defencehttps://juriseagle.com/insights/dpdp-rules-in-force-may-2027https://juriseagle.com/insights/dpdp-rules-in-force-may-2027The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 as G.S.R. 846(E). Rules 1, 2 and 17 to 21 came into force that day, and they are the machinery of the Data Protection Board rather than anything a company must do. Rule 4, on consent managers, starts on 13 November 2026. Everything a data fiduciary has to build, the notice, the security measures, breach reporting, erasure and the rights machinery, starts on 13 May 2027, and sections 3 to 17 of the Act start on the same day. The regulator exists now. The duties do not.Fri, 21 Nov 2025 00:00:00 GMTAdv. Harsha Swaroop PTechnology and datatechnology-data-and-productcontracts-and-procurementhttps://juriseagle.com/insights/dpdp-children-data-educational-institutionshttps://juriseagle.com/insights/dpdp-children-data-educational-institutionsFrom 13 May 2027, section 9 of the Digital Personal Data Protection Act, 2023 requires verifiable consent of a parent before any personal data of a child, anyone under eighteen, is processed, and bars tracking, behavioural monitoring and targeted advertising directed at children. Rule 12 of the Digital Personal Data Protection Rules, 2025 lifts both duties for an educational institution, but only for tracking and behavioural monitoring for its educational activities or for the safety of children enrolled with it. Admission, fee and examination records sit outside that condition on any ordinary reading, and neither section 9(4) nor rule 12 lifts the bar on detrimental processing.Thu, 20 Nov 2025 00:00:00 GMTAdv. Harsha Swaroop PTechnology and datatechnology-data-and-producthttps://juriseagle.com/insights/digital-lending-and-the-five-per-cent-guaranteehttps://juriseagle.com/insights/digital-lending-and-the-five-per-cent-guaranteeThe Reserve Bank of India (Digital Lending) Directions, 2025 took three circulars written over five years and replaced them with one, and in doing so moved the default loss guarantee out of a standalone 2023 circular and into a chapter of the regime it always belonged to. The commercial terms are unchanged in substance: cover is capped at five per cent of what the portfolio disbursed, it is held in cash or in something a lender can realise like cash, and the lender invokes it within 120 days of a loan going overdue. What changed is the frame. A guarantee is now read against the same instrument that fixes the key fact statement, the cooling off right, the fee route and the directory filing, so an arrangement that is sound on the five per cent and wrong on the fees fails in one document rather than two.Tue, 11 Nov 2025 00:00:00 GMTAdv. Harsha Swaroop PFinancial technology and paymentsbanking-sarfaesi-drttechnology-data-and-productcontracts-and-procurement2024 Juris Eagle. This website is intended solely for informational purposes and does not constitute solicitation or advertisement under applicable Bar Council regulations. The transmission or receipt of information through this platform does not create an advocate-client relationship. Legal advice is rendered only upon formal written engagement with the firm.