DPDPA

From Disclosure To Accountability: Decoding The 2026 E-Commerce Amendment Rules

Summary: India’s Consumer Protection (E-Commerce) (Amendment) Rules, 2026, effective January 1, 2027, tighten pricing transparency, ranking disclosures, and seller accountability on e-commerce platforms. Key changes include mandatory prior price disclosures, curbs on self-preferencing and bundled fees, stricter dark pattern compliance, mandatory National Consumer Helpline integration, and affirmative consent for promotional use of consumer data, signaling a shift toward accountability-based governance. This blog examines the key changes and likely impact for e-commerce platforms and sellers.

Continue Reading From Disclosure To Accountability: Decoding The 2026 E-Commerce Amendment Rules
The Classroom Is Not Exempt: DPDPA Compliance for Educational Institutions

Summary: The blog provides a summary of the Supreme Court’s recent judgment in Abhishek Baxi v. Union of India, where parents challenged the extensive and compulsory nature of collecting and retaining student information for the purpose of generation of Automated Permanent Academic Account Registry (“APAAR”) ID. Among other findings, the Supreme Court emphasised that consent must be meaningful and informed. It also acknowledged the need for data protection at the time of collection and processing data, in light of the Digital Personal Data Protection (“DPDP”) laws, reinforcing the need for educational institutions to ensure compliance.

Continue Reading The Classroom Is Not Exempt: DPDPA Compliance for Educational Institutions
Research Rejuvenated: ANI v. Open AI and the DPDPA

Summary: This article examines the Delhi High Court’s judgement in ANI v. Open AI as more than a copyright ruling, arguing that its reasoning on what constitutes “research” offers a persuasive analytical framework for one of the central uncertainties under the DPDPA: whether commercial AI model training can qualify for the Act’s research exemption. It contends that the Court’s purpose, fairness and public interest test, while developed under Section 52(1)(a) of the Copyright Act, translates naturally to Section 17(2)(b) of the DPDPA, and removes a significant conceptual obstacle to treating AI training as research under data protection law. It will be relevant to readers tracking the evolving Indian jurisprudence on AI and its intersection with copyright and data protection law.

Continue Reading Research Rejuvenated: ANI v. Open AI and the DPDPA

The increasing adoption and deployment of artificial intelligence (“AI”) enabled tools, platforms, and solutions by market participants in the financial sector, including the securities markets, is now widely recognised, both in India[1] and globally[2].

Continue Reading The Consultation Paper on AI Regulation : A Case for Nuance?
Fighting Cybercrime: Global UN Convention on the Anvil

Introduction

Member states of the United Nations approved the draft text of the United Nations Convention Against Cybercrime (‘Draft Convention’) by consensus, in August 2024, after five years of deliberations. It is the UN’s first consolidated attempt at regulating crimes on the internet. The move has attracted its fair share of controversy, with tech companies and human rights organisations protesting against the lack of safeguards.

Continue Reading Fighting Cybercrime: Global UN Convention on the Anvil
“Voluntary Provision” under the DPA: Too Good to be True?

This article examines some pitfalls around the processing of “voluntarily provided” personal data under India’s Digital Personal Data Protection Act, 2023 (“DPA”), and it is the second of a three-part series. The first, focussing on “employment purposes” can be accessed here.

Continue Reading “Voluntary Provision” under the DPA: Too Good to be True?
Need for Syncing Sectoral Regulations with Data Protection Law

Cutting across sectors and borders, the Digital Personal Data Protection Act, 2023 (DPDPA or Act), a lean, principles-based, horizontal legislation was enacted in August 2023 (yet to come into effect). Given the substantive procedural aspects under the Act being left for delegated legislation, the first set of rules is expected to be released for public consultation within 100 (hundred days) of the end of the ongoing General Elections,[1] if the incumbent government is re-elected.

Continue Reading Need for Syncing Sectoral Regulations with Data Protection Law
Comparing Global Privacy Regimes Under GDPR, DPDPA and US Data Protection Laws

Nearly five years after a landmark Supreme Court ruling, which reiterated that information privacy is a fundamental right enshrined in the Constitution, India finally enacted its Digital Personal Data Protection Act, 2023 (the “DPDPA” or “Act”), on August 11, 2023.

Continue Reading Comparing Global Privacy Regimes Under GDPR, DPDPA and US Data Protection Laws