01The brief
The India Data & AI Governance Desk
A weekly brief on Indian data-protection and AI-governance law — the DPDP Act and its Rules, the Data Protection Board, and India's AI regulation, read against what is moving globally. Short enough to finish. Every date sourced.
Every question is a new search.
THE PRIMER Part 5 — a product that answers from your documents searches them again for every question. This part follows one question around that loop in six stops: the question is rewritten, turned into numbers, filtered by permissions, matched to a shortlist of passages, pasted into the prompt, and answered with citations, on the vendors' own documentation. Why access control has to sit at the search, why a citation shows where the product looked and not that it read the passage correctly, and what changes when the index is a graph. Then the lawyer's question: is each search processing in its own right? The Court of Justice's Digi judgment on "further processing", how Europe, California and India each tie a use to its purpose, and the German regulators' practical answer: settle the purpose before the query.
02By email
Get it in your inbox
Weekly. No charge, no paywall, and every issue stays permanently readable on the web whether you subscribe or not — so you can forward a link to a client or a colleague and it will simply open.
What happens to that address. It goes to Buttondown, the service that sends this newsletter, and it is used for one thing — sending you the issues. It is not sold, not shared, and not used to contact you about anything else. One-click unsubscribe is in every issue. This form is the only place on this entire website where anything is collected from you; see the Privacy Policy. Prefer to give nothing at all? Bookmark the archive and read it there.
03Every issue
The archive
-
Every question is a new search.
THE PRIMER Part 5 — a product that answers from your documents searches them again for every question. This part follows one question around that loop in six stops: the question is rewritten, turned into numbers, filtered by permissions, matched to a shortlist of passages, pasted into the prompt, and answered with citations, on the vendors' own documentation. Why access control has to sit at the search, why a citation shows where the product looked and not that it read the passage correctly, and what changes when the index is a graph. Then the lawyer's question: is each search processing in its own right? The Court of Justice's Digi judgment on "further processing", how Europe, California and India each tie a use to its purpose, and the German regulators' practical answer: settle the purpose before the query.
-
Your document, as a list of numbers.
THE PRIMER Part 4 — when a product "reads" your documents, it cuts them into pieces, turns each piece into a list of numbers called an embedding, and keeps the pieces and the numbers together. What that index is, why search by meaning finds paraphrase but can miss a clause number, and why deleting the file is not the same as deleting what was built from it, on the vendors' own developer documentation. Then the lawyer's question: is a list of numbers still personal data? Research that rebuilt short text from its numbers, how Europe, California and India each phrase the test, why EDPB Opinion 28/2024 is about trained models and not search indexes, and the one German regulator text that addresses the index directly.
-
What "delete" actually deletes.
THE PRIMER Part 3 — you deleted the conversation, and the product still knows what was in it. The thing that remembers is a third record: a note the product wrote about you while you were talking, with its own delete button that deleting the chat does not press. What each control actually reaches at ChatGPT, Claude and Gemini, read first-hand on the day of publication — including the page one vendor rewrote overnight, and why a screenshot with a date on it beats a link. Why "delete my chat" and "delete my data" are different requests, how Europe, California and India each choose a different word for what erasure erases, and the one-year floor Rule 8(3) puts under deletion in India from May 2027.
-
Where your draft actually goes.
THE PRIMER Part 2 — you paste three paragraphs of your own draft into a chat box to tidy the language. This is what happens to them. Whether your text is used to train the model depends entirely on which account you were logged into, and both major vendors say so in their own words. Two holes in the opt-out that almost nobody knows about, including the thumbs-down button. Why a personal plan is not a processor arrangement at all. And what section 11(1)(b) of the DPDP Act lets a person demand from you about every company that has held their data.
-
It predicts the next word. That is the whole machine.
THE PRIMER starts here — a weekly strand that explains how these systems actually work, from zero, for lawyers who will have to advise on them. Part 1: what a language model is, why anyone built a next-word guesser in the first place, and why invented citations are a structural property rather than a bug. Plus a word-by-word audit of the DPDP Act showing the entire GDPR Article 22 vocabulary is absent from it, and the IT Amendment Rules 2026 that have been binding AI law in force since 20 February.
-
No country is restricted. Your data still cannot leave.
India did not build a transfer mechanism, and that is the point. Section 16 uses a blacklist — transfer is permitted unless the Central Government restricts a destination — rather than the GDPR's whitelist and adequacy model, and no country has been notified. What actually binds an Indian company's data exports today, ranked.
-
81 days to register. Who exactly receives the application?
Rule 4 of the DPDP Rules makes Consent-Manager registration the Data Protection Board's exclusive function, and the window opens on 13 November 2026 — but as at 1 August 2026 the Board had no appointed Chairperson and no appointed Members. Plus the RBI's draft data-governance guidance, which closed for comment on 17 August with no final instrument issued, and the EU AI Act Article 50 grace period that expires in 100 days.
-
No EU office? Article 50 still applies from 2 August
Article 50 of the EU AI Act became applicable on 2 August 2026, and the Commission's own guidance confirms it reaches providers outside the EU whenever their system's output is used inside it — no EU entity required. Plus why compliance with India's SGI labelling rules, live since 20 February 2026, is not compliance with Article 50, and the transitional carve-out that closes on 2 December 2026.
-
DPDP Alert: the Consent-Manager deadline is real
The Consent Manager registration regime goes live on 13 November 2026, and most data fiduciaries have not started. Plus the RBI's draft data-governance guidance (comments closed 17 August 2026) and where the Supreme Court's draft AI-in-Courts regulations actually stand.
-
DPDP: the 2027 compliance clock is now running
The full DPDP timeline in one place — the 13 November 2025 Rules notification, Consent Managers from 13 November 2026, core obligations from 13 May 2027, who counts as a Significant Data Fiduciary, and how section 3(1)(b) reaches companies with no Indian office. Plus EU AI Act Article 50 and Connecticut's CTDPA.
Issue No. 01 was published on Substack and stays there as a permanent record. Everything from Issue No. 02 onward is published on Buttondown.
04Scope
What is in, and what is deliberately out
This is a specialist brief, not a general legal digest. The test applied to every candidate item is simple: is this data protection, or is this AI governance? If neither, it does not go in. A narrow brief that is genuinely authoritative is worth more than a broad one that is merely long.
- India Desk. The DPDP Act and Rules as they actually come into force — Consent Managers, the Data Protection Board, the phased compliance dates. MeitY advisories on AI and deepfakes. Indian privacy and AI judgments as they land.
- India AI governance. Including the Supreme Court's draft Regulations for the Use of AI in Courts, and what they would mean for a practitioner's disclosure obligations.
- Indian fintech where it meets data and AI — RBI data-governance rules, account aggregators, payment-data localisation. Not general fintech business news.
- Global, through the same lens only. The EU AI Act and GDPR, US state privacy and AI statutes, Singapore's PDPA and AI Verify, DIFC and Gulf data protection, and the governance standards — ISO/IEC 42001, NIST AI RMF.
- Deliberately out. General litigation, general sectoral-regulator news, legal-tech product announcements, and any practice area outside data and AI.
05Who writes it
Written under my own name
Rushikesh R. Mahajan — Advocate, with right of audience before the courts of India. LL.M. in Law and Technology, Queen's University Belfast. Published under the wolfgang_rush masthead.
Every statute reference and every date in every issue is checked against at least two sources before it goes out. Where something is still a draft, the issue says so, and says when the consultation closes. Where a claim could not be verified, it does not appear.
This newsletter is informational and educational. It is not legal advice, and reading it creates no advocate–client relationship. Sources are linked so you can go to the primary material yourself.