What we have learned shipping AI systems, SaaS platforms and industry software — including the parts that went wrong. Written by Purushottam Kumar Suman.
What the Digital Personal Data Protection Act and the 2025 Rules require an app or software product to do: notices, consent, security, breach reporting, retention and user rights.
India has no single data localisation law. A sector-by-sector guide to what must be stored in India: payment data, lending, insurance, securities, logs, accounts and government data.
Training data, public data, model APIs hosted abroad, deletion requests and automated decisions. What the DPDP Act means for teams building AI products in India.
SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) for brokers, advisers and other regulated entities: categories, controls, testing, incident reporting and what it means for app development.
Verifiable parental consent, the ban on tracking and targeted ads, and the exemptions for educational institutions. What schools and edtech products must change.
What HIPAA requires from an Indian development team building for US healthcare clients: business associate agreements, the Security Rule safeguards, offshore access and breach duties.
The three phases of the DPDP Rules, 2025: what took effect in November 2025, what starts in November 2026 and what businesses must have in place by 13 May 2027.
RBI's Video-based Customer Identification Process explained as product requirements: live officials, geotagging, liveness, PAN and Aadhaar checks, recording, audit and infrastructure.
How the DPDP Act sits alongside RBI rules for lenders and fintechs: consent for bureau pulls and app permissions, KYC retention, vendors, breaches and Consent Managers.
When GDPR applies to an Indian company, what controllers and processors must do, how data transfers to India work and how GDPR differs from India's DPDP Act.
Key fact statements, direct fund flows, cooling-off, app permissions, data storage, multi-lender disclosure and app reporting. RBI's digital lending rules as product requirements.
How the DPDP Act and 2025 Rules apply to hospitals, clinics, labs and health apps: consent at registration, emergencies, children's records, vendors, breaches and retention.
How RERA's rules on registration, advertising, carpet area, the 70 per cent project account, quarterly updates and agents translate into requirements for real estate software.
Purchased lead lists, broker data sharing, site visit records, buyer KYC and society apps. How the DPDP Act applies to builders, brokers and proptech.
Electronic policies, customer information sheets, KYC, cashless claim timelines, data storage and cybersecurity. IRDAI requirements that shape insurance apps and claims software.
Employee data under the DPDP Act: the employment legitimate use, candidates and ex-employees, monitoring, background checks, payroll vendors and retention.
Who counts as a payment aggregator under RBI's 2025 directions, what authorisation requires, and how marketplaces and platforms can collect and split payments without a licence.
The RPwD Act, GIGW 3.0, IS 17802 and the Supreme Court's rulings on digital access. What accessibility law requires of websites and apps in India, and how to build for it.
If one of these describes a problem you have,
bring it to a call and we will talk it through.
