karthikandsunil

DPDP & Internet of Things (IoT) Your fitness band knows your resting heart rate. Your office badge knows where you were at 9:14 am. Your smart fridge knows your grocery habits. Individually, harmless. Together, a detailed surveillance portrait — governed by the DPDP Act, 2023. Episode 4 of DPDP Meets Emerging Technologies. #DPDPAct #IoTCompliance #HealthDataPrivacy #WearableData

A new Income-tax Act often raises concerns about new taxes and additional compliance. In reality, the Income-tax Act, 2025 is primarily a simplification exercise. Here's a practical guide to understanding what has changed—and what hasn't—for individual taxpayers.

DPDP & Blockchain - Case Study 3 - Kaveri's Story Her personal data crossed a border. No one told her. No Indian law channel was used. Kaveri's KYC sat on a consortium blockchain with an overseas node. A foreign regulator accessed it during an investigation. Under Rule 15 of the DPDP Rules, 2025, this is a direct violation. Foreign government access to Indian personal data must pass through prescribed legal channels — not consortium node access. The Puttaswamy judgment (2018) called informational self-determination a fundamental right. Blockchain amplifies the risk the Supreme Court described. Cross-border nodes must be governed before deployment. The compliance deadline is 13 May 2027.

DPDP & Blockchain - Case Study 2 She withdrew consent. The nodes remembered anyway. Meera's hospital recorded her consent withdrawal correctly. However, six network nodes already held copies of her medical data — and none of them received a deletion instruction. Under Sections 6(4) and 8(2) of the DPDP Act, 2023, every node in a blockchain network may be a Data Processor. Each one needs a written contract. Each one must act on consent withdrawal. IS Audit 3.0 (ICAI) specifically identifies distributed data exposure as a blockchain risk. Governance must reach every node — not just the originating server. The compliance deadline is 13 May 2027.

DPDP Meets Emerging Technologies Episode 3: Blockchain and DPDP Compliance Case Study 1 — Arjun's Story Arjun works as a senior analyst at a financial services firm. His employer recently migrated its employee verification system to a permissioned blockchain. His name, PAN, date of birth, address, and employment history were recorded as transactions on this chain. Two years later, Arjun resigned and asked his former employer to erase his personal data. His HR department explained, politely, that the data was "on the blockchain" and therefore could not be deleted. Arjun filed a complaint. His employer had no answer. This article analyses in DPDP Act provisions and how the above situation can be avoided. #DPDPAct #BlockchainCompliance #DataPrivacyIndia #DataProtection #ISAudit

Follow our page to know more DPDP and Block Chain, a new Episode on DPDP and Emerging Technology

DPDP & Cloud Computing - Case Study 3 of 3 Suresh's customer invoked her right to erasure. The customer's data was spread across three cloud vendors. Suresh had no data map, no erasure API, and no cascade mechanism. He had 48 hours and no plan. Multi-cloud environments are the operating reality for most growing organisations — and the DPDP Act's erasure and Data Principal rights obligations must work across the entire stack, not just the primary database.

Thoughts on the recent Dutch–Microsoft data exposure issue from an Indian perspective. In an era where data is considered the new oil, the incident raises important questions on data sovereignty, foreign government access to cloud-held data, cross-border data transfers, and the responsibilities of Data Fiduciaries under India’s Digital Personal Data Protection Act, 2023. This is not just a technology issue. It is also a legal, economic, governance and national security issue. My article looks at what Indian businesses, policymakers and regulators should consider while relying on global cloud infrastructure, especially where personal data, strategic data and critical digital infrastructure are involved. Views are personal and intended for discussion.

Ananya's payroll platform stores employee data in Singapore. No one in the firm knew. Section 16 of the DPDP Act gives the Central Government the power to restrict cross-border data transfers by notification — when those notifications come, firms that have not mapped where their SaaS platforms store personal data will face sudden, unplanned infrastructure decisions. Our advisory practice at Karthik & Sunil includes exactly this: data mapping across the technology stack, Data Processor contract review, and cross-border compliance readiness. Ananya's story is the starting point for every organisation that has not yet had this conversation.

DPDP & Emerging Technology - Cloud Computing - A Case Study Vikram's Story A startup founder migrates all customer data to a global cloud platform without reading the data processing agreement. When a breach occurs at the cloud provider's end, Vikram assumes it is the cloud vendor's problem. The DPDP Act tells him otherwise — and the 72-hour clock has already started.

DPDP 3.1.3 - Artificial Intelligence and DPDP Meena's Story: She Consented to Track Her Health. She Did Not Consent to Losing Her Insurance. A health-conscious professional finds her wearable data has reached an insurance aggregator's AI model — and her premium has tripled as a result. We examine how purpose-specific consent under Section 6(1), the Puttaswamy judgment's informational privacy doctrine, and Data Processor obligations under Rule 6(1)(f) govern what AI can and cannot do with health data. #DPDP #ArtificialIntelligence #AICompliance #DataPrivacy #DPDPCompliance #AIGovernance #ResponsibleAI #DigitalIndia #KarthikAndSunil

DPDP & Emerging Technologies Series | Artificial Intelligence | Episodes 2 to 3 Rajan's Story: The Algorithm That Inherited Someone Else's Bias An entrepreneur from Bihar is systematically excluded by a hiring platform's AI — not because of his qualifications, but because of patterns the algorithm learned from historically biased data. We examine how algorithmic bias becomes a DPDP legal obligation under Rule 13(3) and what AI governance must look like to prevent it.

DPDP 3.1 - Artificial Intelligence and DPDP: When the Algorithm Decides

DPDP 2.9: DPIA & Compliance Audits for Significant Data Fiduciaries

DPDP 2.8: Data Principal Rights Portal — Building the Self-Service Compliance Layer

DPDP 2.7: Automated Data Erasure — 'Right to be Forgotten' meets your database

DPDP 2.6: Breach Detection & 72-Hour Notification — When Seconds Count