01What this is
Free documents for practitioners
Short, downloadable practitioner aids — checklists, reference sheets and the like. No email wall, no signup, no form, no tracking. Click, download, use. Nothing on this page collects anything from you.
02Read this first
These documents are general, illustrative and non-exhaustive information. They are not legal advice, not a compliance certification or determination, and do not create an advocate-client relationship. Not every item applies to every business. A real assessment needs the facts of your own processing. Confirm commencement, exemptions, designation notifications and sector rules for your own entity before acting.
03The documents
Nine documents, all free, all current
Newest first. Each one is a static PDF — open it in the browser, or save the file. No email required, and nothing on this page collects anything from you.
Training AI models under the DPDP Act
A two-page note, set out like a bare act. The Digital Personal Data Protection Act, 2023 and its Rules never use the words “artificial intelligence”, and the first page shows the search. The Act regulates processing, and training a model on digital personal data is processing. The same page quotes, from the Gazette, the definition of processing in section 2, the duty in section 6(6) when consent is withdrawn and the opening words of section 7. The second page notes what each means for a build: the purpose named in the notice, a withdrawal that has to reach every processor and every copy held for training, and section 7 as a list of nine uses with nothing to weigh. It ends with an illustration and with what the note does not deal with.
Section 44A and the United Arab Emirates
A two-page note, set out like a bare act, on the courts of the United Arab Emirates that India has notified for section 44A of the Code of Civil Procedure, 1908. Where the section applies, a certified copy of a money decree of a notified court, filed in a District Court in India, may be executed as if that District Court had passed it. The first page sets out the section in full and the notification of 17 January 2020, G.S.R. 38(E), with the courts as the Gazette prints them, the Courts of Dubai International Financial Center among them. The second page has short notes with an illustration, and section 13, to which sub-section (3) refers. Indian law only: nothing on the page states the law of the UAE or of the DIFC.
The Primer, Part 5 — Every question is a new search.
A product that answers from your documents searches them again for every question. This part follows one question around that loop in six stops: the question is rewritten, turned into numbers, filtered by permissions, matched to a shortlist of passages, pasted into the prompt, and answered with citations, on the vendors’ own documentation. It explains why access control has to sit at the search, why a citation shows where the product looked and not that it read the passage correctly, and what changes when the index is a graph. Then the question lawyers will be asked: is each search processing in its own right? It covers the Court of Justice’s Digi judgment on “further processing”, how Europe, California and India each tie a use to its purpose, and the German regulators’ practical answer: settle the purpose before the query. Every term is explained on the page.
The Primer, Part 4 — Your document, as a list of numbers.
When a product “reads” your documents, it cuts them into pieces, turns each piece into a list of numbers called an embedding, and keeps the pieces and the numbers together in a search index. This part explains that index in the order the machine uses it, why search by meaning is good at paraphrase and weak at a clause number, and why deleting the file is one control and deleting what was built from it is another, on the vendors’ own developer documentation. Then the question lawyers will be asked: is a list of numbers made from a client’s documents still personal data? It covers the research that rebuilt short text from its numbers, how Europe, California and India each phrase the test, why EDPB Opinion 28/2024 is about trained models and not search indexes, and the one German regulator text that addresses the index directly. Every term is explained on the page.
The Primer, Part 3 — What “delete” actually deletes.
You deleted the conversation, and the product still knows what was in it. The thing that remembers is neither the chat nor the model: it is a third record, a note the product wrote about you while you were talking, and it has its own delete button that deleting the chat does not press. This part sets out the four places a product keeps what you said, what each control actually reaches at ChatGPT, Claude and Gemini — read first-hand on the day of publication, including a page one vendor rewrote overnight and what that tells you about relying on a link instead of a dated screenshot — and why Europe, California and India each chose a different word for what an erasure request erases. It ends with the one-year floor that Rule 8(3) of the Digital Personal Data Protection Rules, 2025 puts under deletion in India from May 2027, even if the user closes the account. Every term is explained on the page.
The Primer, Part 2 — Where your draft actually goes.
The second part of the weekly strand. You paste three paragraphs of your own draft into a chat box to tidy the language — this is what happens to them, and the one setting that changes the answer. Why that is a different question from how the model was trained, the two holes in the opt-out that almost nobody knows about (including the thumbs-down button), why a personal subscription is not a processor arrangement, and what section 11(1)(b) of the Digital Personal Data Protection Act, 2023 entitles a person to ask about the Data Fiduciaries and Data Processors their data was shared with. Every term is explained on the page.
The Primer, Part 1 — It predicts the next word. That is the whole machine.
The first part of a weekly strand explaining how these systems actually work, from zero, for lawyers who will have to advise on them. What a language model is, why anyone built a next-word guesser in the first place, why a real citation and an invented one are indistinguishable to the mechanism, and what the Digital Personal Data Protection Act, 2023 has to say about any of it. Every term is defined on the page. Includes a word-by-word audit of the Act showing that the entire GDPR Article 22 vocabulary is absent from it.
Where can your data actually go? — a cross-border sheet for Indian companies
What the DPDP framework does on cross-border transfer, what it does not do, and what is actually constraining an Indian company's data exports today. The text of Section 16 and Rule 15, why Rule 15 is a foreign-State provision rather than a commercial transfer mechanism, the localisation power that does sit in Rule 12, a ranked hierarchy of what really binds you, and a one-page "what would have to move if a country were named" test to work through per destination.
DPDP-Readiness Checklist — an operational aid for Indian digital businesses
A non-exhaustive readiness checklist for India's Digital Personal Data Protection Act, 2023 and the Rules made under it. Core obligations plus eight sector overlays — healthtech, fintech, insurtech, HR-tech, adtech, edtech, consumer AI and mobility — with every item cited to the section it comes from.
Every download here is a static file. Opening this page sets no cookie; clicking a link sends one request to GitHub Pages for the file and nothing else. See the Privacy Policy for the full posture.