The India Data & AI Governance Desk

A weekly brief on Indian data-protection and AI-governance law — the DPDP Act and its Rules, the Data Protection Board, and India's AI regulation, read against what is moving globally. Short enough to finish. Every date sourced.

Get it in your inbox

Weekly. No charge, no paywall, and every issue stays permanently readable on the web whether you subscribe or not — so you can forward a link to a client or a colleague and it will simply open.

What happens to that address. It goes to Buttondown, the service that sends this newsletter, and it is used for one thing — sending you the issues. It is not sold, not shared, and not used to contact you about anything else. One-click unsubscribe is in every issue. This form is the only place on this entire website where anything is collected from you; see the Privacy Policy. Prefer to give nothing at all? Bookmark the archive and read it there.

The archive

• Issue No. 06 · 7 September 2026

  It predicts the next word. That is the whole machine.

  THE PRIMER starts here — a weekly strand that explains how these systems actually work, from zero, for lawyers who will have to advise on them. Part 1: what a language model is, why anyone built a next-word guesser in the first place, and why invented citations are a structural property rather than a bug. Plus a word-by-word audit of the DPDP Act showing the entire GDPR Article 22 vocabulary is absent from it, and the IT Amendment Rules 2026 that have been binding AI law in force since 20 February.

• Issue No. 05 · 31 August 2026

  No country is restricted. Your data still cannot leave.

  India did not build a transfer mechanism, and that is the point. Section 16 uses a blacklist — transfer is permitted unless the Central Government restricts a destination — rather than the GDPR's whitelist and adequacy model, and no country has been notified. What actually binds an Indian company's data exports today, ranked.

• Issue No. 04 · 24 August 2026

  81 days to register. Who exactly receives the application?

  Rule 4 of the DPDP Rules makes Consent-Manager registration the Data Protection Board's exclusive function, and the window opens on 13 November 2026 — but as at 1 August 2026 the Board had no appointed Chairperson and no appointed Members. Plus the RBI's draft data-governance guidance, which closed for comment on 17 August with no final instrument issued, and the EU AI Act Article 50 grace period that expires in 100 days.

• Issue No. 03 · 18 August 2026

  No EU office? Article 50 still applies from 2 August

  Article 50 of the EU AI Act became applicable on 2 August 2026, and the Commission's own guidance confirms it reaches providers outside the EU whenever their system's output is used inside it — no EU entity required. Plus why compliance with India's SGI labelling rules, live since 20 February 2026, is not compliance with Article 50, and the transitional carve-out that closes on 2 December 2026.

• Issue No. 02 · 5 August 2026

  DPDP Alert: the Consent-Manager deadline is real

  The Consent Manager registration regime goes live on 13 November 2026, and most data fiduciaries have not started. Plus the RBI's draft data-governance guidance (comments closed 17 August 2026) and where the Supreme Court's draft AI-in-Courts regulations actually stand.

• Issue No. 01 · 18 July 2026

  DPDP: the 2027 compliance clock is now running

  The full DPDP timeline in one place — the 13 November 2025 Rules notification, Consent Managers from 13 November 2026, core obligations from 13 May 2027, who counts as a Significant Data Fiduciary, and how section 3(1)(b) reaches companies with no Indian office. Plus EU AI Act Article 50 and Connecticut's CTDPA.

Issue No. 01 was published on Substack and stays there as a permanent record. Everything from Issue No. 02 onward is published on Buttondown.

What is in, and what is deliberately out

This is a specialist brief, not a general legal digest. The test applied to every candidate item is simple: is this data protection, or is this AI governance? If neither, it does not go in. A narrow brief that is genuinely authoritative is worth more than a broad one that is merely long.

• India Desk. The DPDP Act and Rules as they actually come into force — Consent Managers, the Data Protection Board, the phased compliance dates. MeitY advisories on AI and deepfakes. Indian privacy and AI judgments as they land.
• India AI governance. Including the Supreme Court's draft Regulations for the Use of AI in Courts, and what they would mean for a practitioner's disclosure obligations.
• Indian fintech where it meets data and AI — RBI data-governance rules, account aggregators, payment-data localisation. Not general fintech business news.
• Global, through the same lens only. The EU AI Act and GDPR, US state privacy and AI statutes, Singapore's PDPA and AI Verify, DIFC and Gulf data protection, and the governance standards — ISO/IEC 42001, NIST AI RMF.
• Deliberately out. General litigation, general sectoral-regulator news, legal-tech product announcements, and any practice area outside data and AI.

Written under my own name

Rushikesh R. Mahajan — Advocate, with right of audience before the courts of India. LL.M. in Law and Technology, Queen's University Belfast. Published under the wolfgang_rush masthead.

Every statute reference and every date in every issue is checked against at least two sources before it goes out. Where something is still a draft, the issue says so, and says when the consultation closes. Where a claim could not be verified, it does not appear.

This newsletter is informational and educational. It is not legal advice, and reading it creates no advocate–client relationship. Sources are linked so you can go to the primary material yourself.