Data Privacy & IT

The Information Technology Act, 2000, represents India's primary legislation addressing cybercrime, data protection, and digital transactions. As India's digital ecosystem expands and cyber threats become increasingly sophisticated, understanding the criminal offences, penalties, and available remedies under the IT Act becomes essential for digital users, businesses, law enforcement, and legal professionals. The Act establishes a comprehensive framework criminalizing unauthor

If you own a business in Dubai or anywhere in the UAE, you have more legal protection than you may realise — and more compliance obligations that have been triggered by the current conflict than most business owners are aware of. The India-UAE Bilateral Investment Treaty (2024) is in force. FEMA provides a legal mechanism for repatriation of your assets. The Companies Act governs your Indian parent entity's obligations. And the India-UAE Double Taxation Avoidance Agreement (D

The Indian Telecommunications Act 2023 replaces the outdated Indian Telegraph Act 1885 and repeals the Telecom Regulatory Authority of India Act 1997, establishing a modern regulatory framework for telecommunications services in India. This landmark legislation consolidates telecom regulation into a single unified statute and grants the telecom department direct regulatory authority. The Act imposes comprehensive obligations on telecom operators, internet service providers, a

India's Ministry of Electronics and Information Technology has introduced the AI Content Labelling Rules 2026, establishing mandatory disclosure requirements for artificially generated content across digital platforms and business applications. These rules represent India's regulatory response to challenges posed by deepfakes, synthetic media, and AI-generated content that could deceive users or spread misinformation. The regulations impose obligations on content creators, pl

In November 2025, the Government of India notified the Digital Personal Data Protection Rules, 2025, giving operational shape to the Digital Personal Data Protection Act, 2023. Together, the Act and the Rules create India's first comprehensive legal framework governing how personal data is collected, processed, stored, and transferred. With the full compliance deadline set for May 2027 and several interim milestones already active, businesses operating in India or handling da

For Indian businesses that use cloud services, employ overseas vendors, or serve international customers, the rules governing cross-border transfer of personal data under the Digital Personal Data Protection Act, 2023 (DPDPA) are among the most critical provisions to understand. As data flows across jurisdictions in the normal course of business operations, companies must know where their data is stored, processed, and transferred, and whether any restrictions apply. The DPDP

In today's globalised economy, personal data routinely crosses national borders through cloud services, international partnerships, and global supply chains. For Indian businesses, understanding how the Digital Personal Data Protection Act 2023 (DPDPA) regulates cross-border data transfers is critical, whether you are a startup using international cloud infrastructure, a multinational operating in India, or an Indian company with overseas clients. The DPDPA takes a notably di

The Digital Personal Data Protection Act 2023 (DPDPA) is India's first comprehensive data protection legislation, and it fundamentally changes how every business that collects or processes personal data must operate. If your organisation collects customer names, email addresses, phone numbers, payment details, or any other personal information, you are classified as a Data Fiduciary under the DPDPA and must comply with specific legal obligations. With the DPDP Rules 2025 noti

The Digital Personal Data Protection Act, 2023 (DPDPA) and the DPDP Rules notified on 13 November 2025 have fundamentally changed how Indian businesses must handle personal data. Every organisation that determines the purpose and means of processing digital personal data, termed a Data Fiduciary under the Act, now faces a comprehensive set of legal obligations with significant financial penalties for non-compliance. Whether you operate an e-commerce platform, a fintech applic

The intersection of artificial intelligence and copyright law has become one of the most debated legal questions in India as generative AI tools produce text, images, music, and code at unprecedented scale. For businesses, content creators, and technology companies, the central question is straightforward but legally complex: who owns the copyright in content generated by AI, and what are the legal risks of using copyrighted material to train AI models? Indian law currently p

When an AI-powered medical diagnosis system gives a wrong recommendation, or an autonomous trading algorithm causes financial losses, or a hiring algorithm discriminates against certain candidates, the critical legal question arises: who is liable? In India, this question has no straightforward answer yet, because Indian law does not recognize artificial intelligence as a legal entity capable of bearing responsibility. As AI systems become more autonomous and their decisions

Artificial intelligence is transforming every industry in India, from healthcare and finance to agriculture and e-commerce. But as AI adoption accelerates, businesses and individuals increasingly need to understand the legal rules that govern its development, deployment, and use. Unlike the European Union, which enacted a comprehensive AI Act, India has taken a different path, choosing a layered, innovation-first regulatory approach that combines existing laws with new volunt

India's approach to regulating generative artificial intelligence is one of the most consequential legal developments for technology companies operating in the country today. As generative AI tools become embedded in business operations, content creation, healthcare, and financial services, the question of legal compliance has moved from theoretical debate to practical urgency. India has chosen a pro-innovation path, relying on existing laws rather than enacting a standalone

Raising foreign investment is a defining milestone for any Indian startup — but the Foreign Exchange Management Act, 1999 (FEMA) and the Reserve Bank of India's (RBI) Foreign Exchange Management (Non-Debt Instruments) Rules, 2019 impose a strict compliance framework that startups must follow from the moment they receive foreign money. A FEMA violation is not merely a technical infraction: it can attract penalties of up to three times the contravention amount and create seriou

Deepfakes — AI-generated videos, images, and audio that convincingly impersonate real people — have become one of the most serious emerging threats to personal dignity, electoral integrity, and corporate reputation in India. India does not yet have standalone deepfake legislation, but the legal framework has evolved rapidly. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, notified by MeitY on 10 February 2026 and effective f