Photo of Apoorva Sundar

Apoorva Sundar

Principal Associate in the General Corporate (Technology and Telecommunications) Practice at the Bengaluru office of Cyril Amarchand Mangaldas. Apoorva specialises in data privacy and other information technology matters. She can be reached at apoorva.sundar@cyrilshroff.com

Research Rejuvenated: ANI v. Open AI and the DPDPA

Summary: This article examines the Delhi High Court’s judgement in ANI v. Open AI as more than a copyright ruling, arguing that its reasoning on what constitutes “research” offers a persuasive analytical framework for one of the central uncertainties under the DPDPA: whether commercial AI model training can qualify for the Act’s research exemption. It contends that the Court’s purpose, fairness and public interest test, while developed under Section 52(1)(a) of the Copyright Act, translates naturally to Section 17(2)(b) of the DPDPA, and removes a significant conceptual obstacle to treating AI training as research under data protection law. It will be relevant to readers tracking the evolving Indian jurisprudence on AI and its intersection with copyright and data protection law.

Continue Reading Research Rejuvenated: ANI v. Open AI and the DPDPA

The increasing adoption and deployment of artificial intelligence (“AI”) enabled tools, platforms, and solutions by market participants in the financial sector, including the securities markets, is now widely recognised, both in India[1] and globally[2].

Continue Reading The Consultation Paper on AI Regulation : A Case for Nuance?
The Ghost in the Machine?: The Recent “Business Requirement Document” on Consent

Corporate India, eagerly awaiting the final version of the Draft Digital Personal Data Protection Rules, 2025[1] (“Draft Rules”), under the Digital Personal Data Protection Act, 2023[2] (“DPDPA”), was recently jolted by a Business Requirements Document for Consent Management under the DPDPA (“BRD”)[3] discreetly issued by the National e-Governance Division of the Ministry of Electronics and Technology (“MeitY”).

Continue Reading The Ghost in the Machine?: The Recent “Business Requirement Document” on Consent
“Voluntary Provision” under the DPA: Too Good to be True?

This article examines some pitfalls around the processing of “voluntarily provided” personal data under India’s Digital Personal Data Protection Act, 2023 (“DPA”), and it is the second of a three-part series. The first, focussing on “employment purposes” can be accessed here.

Continue Reading “Voluntary Provision” under the DPA: Too Good to be True?
Handle with CARE: Relying on “Purposes of Employment” for Processing Employee Data

India has been preparing for the Digital Personal Data Protection Act, 2023 (“DPA”), for almost a year now. During this time, companies have realised that relying on consent as a long-term basis for processing may be difficult, and instead, using ‘legitimate uses’[1], as the bases for processing may be a better alternative.

Continue Reading Handle with CARE: Relying on “Purposes of Employment” for Processing Employee Data