Notes on Indian technology law.

Written for the people who build or adopt technology: what a law requires of a product, what it leaves open, and what can wait. New pieces are published as they are written.

• WhatsApp's hidden chatbot notes told it not to recommend a regulator: WhatsApp's help pages carried hidden instructions for its AI support chatbot, one of which told it not to recommend contacting any data protection authority. We set out what was found, what remains unproven, and how the GDPR, India's DPDP Act and India's AI Governance Guidelines treat the same question. (Hirendhar Lakshmanan, 2026-10-22, 10 min read)
• Same Post, Different Countries: Who Protects Your Public Data After You Hit “Share”?: India's DPDP Act takes data you post about yourself outside the law altogether, while the EU, Canada, Australia and Brazil keep protecting it once it is public. We compare the approaches and ask whether India should follow them before May 2027. (Hirendhar Lakshmanan and Nikitha Vaitheeswaran, 2026-10-16, 10 min read)
• Kerala High Court directs early functioning of the Data Protection Board: On 7 October 2026 the Kerala High Court closed a public interest petition about passenger data at airports, and said it expects the Data Protection Board to be made functional within eight weeks. (Hirendhar Lakshmanan, 2026-10-16, 6 min read)
• The Consent Box That Cures Nothing: New Rule 5(6) of the E-Commerce Rules may bar marketplaces outright from using the data they collect to sell goods under their own brand, whatever consent they obtain. (Nikitha Vaitheeswaran, 2026-10-05, 8 min read)