Fintales Edition 39: A Tale Of Two Laws: DPDP Rules And BULA

On June 3, 2026, the Supreme Court of India’s AI Committee released preliminary draft of the Regulations for Use of Artificial Intelligence (AI) in Courts, 2026 (“The Draft”). This marks a shift from scattered experiments with AI tools for translation, transcription, research and case management. With over 93,000 pending matters as of March 2026, the guidelines aim to ease processes for officials and citizens. AI could help reduce backlogs through automated cause-list preparation, transcription, research, and defect scrutiny, but its use also raises serious concerns.

India has formally moved to regulate deepfakes and AI generated content by notifying the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026.

India's fintech market is one of the fastest growing in the world, and it shows no sign of slowing down. Estimates put the market at about USD 145 billion at the end of 2025, growing at a compound annual rate of 30.55% to reach roughly USD 550 billion by 2030. India's fintech adoption rate is around 87%, reportedly the highest anywhere and well above the global average of roughly 64% to 67%. Add the world's second-largest digital population and the runway looks long.

The Supreme Court of India, through notice dated 03.06.2026, has published the draft Regulations for use of Artificial Intelligence in Courts, 2026 (“Draft AI Regulations”). Comments and suggestions from all stakeholders and the general public are invited on the Draft AI Regulations by 20.06.2026

In a seismic event that has rattled the foundations of India's cryptocurrency landscape, WazirX, the nation's largest cryptocurrency exchange, suffered a devastating cyberattack that resulted in the theft of over $240 million in investor funds.

Cybersecurity regulation in India has, until now, largely spoken to the entity that suffers the breach. The 2022 CERT-In Directions issued under Section 70B of the Information Technology Act, 2000 fixed a six-hour reporting clock on the organisation that detects an incident. The new Guidelines flip the lens onto the entity upstream of that breach, the OEM or technology provider that built the product in the first place. For the first time, vendors supplying software, firmware, cloud platforms, or APIs into India carry direct, time-bound, and independently verifiable obligations of their own and not obligations that are merely passed through a customer contract, but obligations CERT-In itself may enforce.

In a rare use of its extraordinary powers under Article 142 of the Constitution of India, the Supreme Court heard a curative petition filed by DMRC, challenging an earlier order that had upheld the arbitral award. The judgment brings finality to a decade-long contractual dispute that began in 2013 with arbitration proceedings.

For most technology vendors, cybersecurity has been a promise made to a customer, set out in a statement of work and enforced, if at all, through the contract. For vendors supplying India's power sector, that is changing. The Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, notified on 31 July 2026 under the Electricity Act, 2003, impose obligations directly on vendors, alongside a far more demanding set of requirements for the power-sector entities they serve. Most of these provisions come into force on 1 April 2027.

Between May and August 2026, AI regulation has continued to develop rapidly, with a focus on accountability, transparency, human oversight and protection against AI-related harms.

In contemporary times, we frequently encounter manipulated images, videos, and audio content that are explicitly inappropriate, contributing to misinformation and intentional deceit.

On 9 December 2025, UIDAI amended the Aadhaar Authentication and Offline Verification Rules. The changes are significant and will reshape how offline and remote Aadhaar verification...

It's been almost a year since the draft Rules were released, and the final text brings much-needed clarity to how India's data protection law will work in practice. We've unpacked what's changed, what's been tightened...

This article discusses the impact of and alternatives to the zero MDR policy in the context of the RBI discussion paper on payment charges.

Bangladesh is home to 87 million internet subscribers, accounting for approximately 53% of its entire population.

NPCI recently recommended interchange fees of up to 1.1% on UPI transactions through prepaid payment instruments (PPIs). The fees are applicable on transactions above INR 2000 from 1 April 2023.

The goal of every KYC regime is to strike a delicate balance: service providers must have enough information to mitigate fraud, but not so much that user privacy becomes collateral damage.

On 22 January 2026, Ikigai Law, in collaboration with the Deutsche Gesellschaft für Internationale Zusammenarbeit (GIZ)...

The trade of dual-use (civil and military) goods, services and technologies (SCOMET items) are closely scrutinized to ensure that they do not fall into the wrong hands.

The Indian government has passed Promotion and Regulation of Online Gaming Act 2025 (the Act).

February was anything but incremental for tech policy. India hosted the world during the India AI Impact Summit 2026, showcasing the country's growing AI ecosystem and announcing...