karthikandsunil

[karthikandsunil]

DPDP Meets Emerging Technologies Episode 3: Blockchain and DPDP Compliance Case Study 1 — Arjun's Story Arjun works as a senior analyst at a financial services firm. His employer recently migrated its employee verification system to a permissioned blockchain. His name, PAN, date of birth, address, and employment history were recorded as transactions on this chain. Two years later, Arjun resigned and asked his former employer to erase his personal data. His HR department explained, politely, that the data was "on the blockchain" and therefore could not be deleted. Arjun filed a complaint. His employer had no answer. This article analyses in DPDP Act provisions and how the above situation can be avoided. #DPDPAct #BlockchainCompliance #DataPrivacyIndia #DataProtection #ISAudit

DPDP 3.3.1 : DPDP and Blockchain - Case Study 1

[karthikandsunil]

Follow our page to know more DPDP and Block Chain, a new Episode on DPDP and Emerging Technology

DPDP Meets Emerging Technologies — Episode 3 - Introduction on Blockchain & DPDP

[karthikandsunil]

DPDP & Cloud Computing - Case Study 3 of 3 Suresh's customer invoked her right to erasure. The customer's data was spread across three cloud vendors. Suresh had no data map, no erasure API, and no cascade mechanism. He had 48 hours and no plan. Multi-cloud environments are the operating reality for most growing organisations — and the DPDP Act's erasure and Data Principal rights obligations must work across the entire stack, not just the primary database.

DPDP 3.3 : DPDP and Cloud – Case Study – The Erasure Request That Broke Three Clouds at Once

[karthikandsunil]

Thoughts on the recent Dutch–Microsoft data exposure issue from an Indian perspective. In an era where data is considered the new oil, the incident raises important questions on data sovereignty, foreign government access to cloud-held data, cross-border data transfers, and the responsibilities of Data Fiduciaries under India’s Digital Personal Data Protection Act, 2023. This is not just a technology issue. It is also a legal, economic, governance and national security issue. My article looks at what Indian businesses, policymakers and regulators should consider while relying on global cloud infrastructure, especially where personal data, strategic data and critical digital infrastructure are involved. Views are personal and intended for discussion.

Cloud Dependency is No Longer Only an IT Procurement Matter; It is a Sovereignty, Economic Policy and National Security Matter

[karthikandsunil]

Ananya's payroll platform stores employee data in Singapore. No one in the firm knew. Section 16 of the DPDP Act gives the Central Government the power to restrict cross-border data transfers by notification — when those notifications come, firms that have not mapped where their SaaS platforms store personal data will face sudden, unplanned infrastructure decisions. Our advisory practice at Karthik & Sunil includes exactly this: data mapping across the technology stack, Data Processor contract review, and cross-border compliance readiness. Ananya's story is the starting point for every organisation that has not yet had this conversation.

DPDP 3.2.2 : DPDP and Cloud – Case Study 2 – The Payroll Data That Left India Without Anyone Noticing

[karthikandsunil]

DPDP & Emerging Technology - Cloud Computing - A Case Study Vikram's Story A startup founder migrates all customer data to a global cloud platform without reading the data processing agreement. When a breach occurs at the cloud provider's end, Vikram assumes it is the cloud vendor's problem. The DPDP Act tells him otherwise — and the 72-hour clock has already started.

DPDP 3.2.1 : DPDP and Cloud - Case Study 1 - The Cloud Vendor's Breach. The Founder's Problem.

[karthikandsunil]

DPDP 3.1.3 - Artificial Intelligence and DPDP Meena's Story: She Consented to Track Her Health. She Did Not Consent to Losing Her Insurance. A health-conscious professional finds her wearable data has reached an insurance aggregator's AI model — and her premium has tripled as a result. We examine how purpose-specific consent under Section 6(1), the Puttaswamy judgment's informational privacy doctrine, and Data Processor obligations under Rule 6(1)(f) govern what AI can and cannot do with health data. #DPDP #ArtificialIntelligence #AICompliance #DataPrivacy #DPDPCompliance #AIGovernance #ResponsibleAI #DigitalIndia #KarthikAndSunil

DPDP 3.1.3 - Artificial Intelligence and DPDP

[karthikandsunil]

DPDP & Emerging Technologies Series | Artificial Intelligence | Episodes 2 to 3 Rajan's Story: The Algorithm That Inherited Someone Else's Bias An entrepreneur from Bihar is systematically excluded by a hiring platform's AI — not because of his qualifications, but because of patterns the algorithm learned from historically biased data. We examine how algorithmic bias becomes a DPDP legal obligation under Rule 13(3) and what AI governance must look like to prevent it.

DPDP 3.1.2 - Artificial Intelligence and DPDP - The Algorithm That Inherited Someone Else's Bias — and Gave It to Him

[karthikandsunil]

DPDP 3.1 - Artificial Intelligence and DPDP: When the Algorithm Decides

DPDP 3.1 - Artificial Intelligence and DPDP: When the Algorithm Decides

[karthikandsunil]

DPDP 2.9: DPIA & Compliance Audits for Significant Data Fiduciaries

If the Central Government notifies your organisation as a Significant Data Fiduciary, the DPDP compliance clock resets to a much higher standard. … DPDP & Tech 1.9: DPIA & Compliance Audits for Significant Data Fiduciaries

View On WordPress

[karthikandsunil]

DPDP 2.8: Data Principal Rights Portal — Building the Self-Service Compliance Layer

Every person whose data you hold has legal rights over it. Under the DPDP Act, 2023, you must build the technology that makes those rights … DPDP & Tech 1.8: Data Principal Rights Portal — Building the Self-Service Compliance Layer

View On WordPress

[karthikandsunil]

DPDP 2.7: Automated Data Erasure — 'Right to be Forgotten' meets your database

DPDP & Tech 1.7: Automated Data Erasure — ‘Right to be Forgotten’ meets your database

DPDP 2.7: Automated Data Erasure — 'Right to be Forgotten' meets your database

[karthikandsunil]

DPDP 2.6: Breach Detection & 72-Hour Notification — When Seconds Count

A personal data breach has just occurred in your organisation. The 72-hour clock has started. Do your systems know yet? Under Rule 7(2)(b) of the … dPDP & tech 1.6: Breach Detection & 72-Hour Notification — When Seconds Count

View On WordPress

[karthikandsunil]

DPDP 2.5: Most breach studies show the average time to detect a breach is over 200 days. Under DPDP, you have 72 hours to report one.

Most breach studies show the average time to detect a breach is over 200 days. Under DPDP, you have 72 hours to report one.

[karthikandsunil]

Perceptions

[karthikandsunil]

Access Control & Identity Management — Who Can See What?

[karthikandsunil]

Your database was just breached. What does the attacker actually see?

Your database was just breached. What does the attacker actually see? If the answer is “real names, phone numbers, and financial records” — your …Your database was just breached. What does the attacker actually see?

View On WordPress