From Article 21 to ₹250 Crore: India's Privacy Law
Arshit Srivastava •
India's DPDP Act didn't appear overnight. Trace it from the Supreme Court's 2017 privacy ruling to a six-year drafting saga and a phased rollout landing in May 2027.
Our Research
Explore our latest publications on AI, privacy, and technology policy.
Two Fiduciaries, One Dataset, Zero Clarity
Arshit Srivastava •
The DPDP Act names joint control without defining it, leaving co-processors each fully liable. Why a real-time consent ledger is the closest thing to a joint agreement.
The Data Hot Potato: South Asia's Real Privacy Problem
Arshit Srivastava •
In South Asia, the real barrier to data protection isn't the law — it's a corporate game of hot potato over who actually owns the data, and who answers when it leaks.
Forty Years in the Making: The Long Road to GDPR
Arshit Srivastava •
While India's privacy law sprang from one 2017 verdict, GDPR rested on forty years of scaffolding — from the 1950 ECHR to the Charter — before it became enforceable.