Data, AI & Cyber Law 2026

Editor's Note

Technology law is no longer evolving only through legislation. It is evolving through adoption.

Artificial intelligence is now used in recruitment, contract review, software development, customer support, marketing, finance, cybersecurity and internal knowledge management. Personal data moves through more systems, vendors and jurisdictions than most businesses can map with confidence. A cyber incident can create legal, contractual, operational and reputational consequences at the same time.

The question is no longer: "Do we have a policy?" It is: "Can we show how this technology is governed in practice?"

• AI governance is becoming a business operating model, not an IT policy.
• India's DPDP Rules have moved privacy from a future concern to an implementation programme.
• Cyber incident response is now a legal and board-level capability.
• Vendor risk has become enterprise risk.

The purpose is not to make innovation slower. It is to help businesses adopt technology in a way that they can explain, defend and scale.

The strongest technology governance programmes do not slow innovation. They make innovation easier to trust.

Executive Summary: What Are the Most Important Data, AI and Cyber Law Developments in 2026?

How Should Businesses Govern AI Use in 2026?

The most common AI risk is not a futuristic autonomous system. It is ordinary work being done through an unapproved or poorly governed tool.

An employee uploads customer information into a public AI chatbot. A recruiter uses an AI-generated shortlist without understanding the criteria used. A developer deploys AI-generated code without checking security or licence implications. A marketing team publishes content that is inaccurate, misleading or too similar to protected material.

These are not merely technology questions. They can involve confidentiality, data protection, intellectual property, employment law, discrimination, consumer protection, professional responsibility, cybersecurity and contract liability.

A blanket ban on AI is rarely effective. It often drives use underground. A better approach is a clear operating model that enables lower-risk use, creates approval routes for higher-risk use, and makes accountability visible.

The four-tier AI use framework

If an AI tool can influence a person's employment, access, money, reputation or legal position, treat it as a governed decision system, not merely as software.

What does good AI governance look like?

Good AI governance is not a 30-page policy that employees never read. It is a practical system that answers five questions.

• Who can use which tools? Maintain a list of approved tools, approved business uses and prohibited uses, distinguishing public tools, enterprise tools and internally hosted tools.
• What data can enter the tool? Public information is generally permitted in approved tools; internal non-sensitive information only in enterprise-approved tools; personal data only after privacy review with appropriate safeguards; privileged or highly confidential information prohibited unless specifically approved.
• Who owns the output? The business using the tool must own the decision to rely on its output. AI can support work; it should not become an unaccountable decision-maker.
• What evidence exists? For material use cases, retain evidence of purpose, data involved, vendor and model, testing, approval, human oversight and escalation.
• What happens when something goes wrong? Every high-impact deployment needs a stop mechanism: suspend the tool, identify affected decisions, correct inaccurate output, notify those affected and investigate.

What Does the EU AI Act Mean for Indian Businesses?

The EU AI Act is often discussed as if it applies only to European technology companies. That is too narrow.

For providers of general-purpose AI models, the framework now includes obligations relating to technical documentation, information for downstream providers, copyright policy and public summaries of training content. For models presenting systemic risk, additional safety, security, evaluation and incident-related obligations apply.

The important issue for an Indian business is role. A company may be a provider, a deployer, a distributor, an importer, a downstream provider, a customer, a service provider, or a GCC supporting a global product team. Each role carries different responsibilities and commercial risks. A business that simply uses an established enterprise AI tool may not be a model provider. But it still needs to assess its contract, its data use, its customer commitments and the effect of the tool on people.

The AI contract checklist

• Can the vendor use our prompts, inputs or outputs to train its models?
• Where is our data processed and stored?
• Which sub-processors are involved?
• Can we turn off retention or training use?
• What security controls and audit logs are available?
• How quickly must the vendor notify us about an incident?
• Will the vendor provide evidence and cooperation during an investigation?
• Who is responsible for inaccurate, infringing or unlawful output?
• What happens if the vendor materially changes its model or terms?
• Can we export our data and exit the service?

What Must Businesses Do Before India's DPDP Rules Take Effect?

The Digital Personal Data Protection Rules, 2025 have changed the nature of the privacy conversation in India. The question is no longer whether India will have a comprehensive digital-personal-data framework. The question is whether organisations will be operationally ready. The Rules require organisations to move beyond generic privacy statements and build processes that work in practice.

What is the DPDP implementation timeline?

The Rules were notified on 13 November 2025. The phased commencement is significant: Rules 1, 2 and 17 to 21 took effect on notification; Rule 4, concerning Consent Managers, takes effect one year after notification; and Rules 3, 5 to 16, 22 and 23 take effect 18 months after notification, in May 2027.

For businesses, the practical deadline is May 2027. That may seem far away. It is not. A privacy implementation programme can require data discovery, system changes, redesign of digital journeys, contract remediation, vendor assessment, rights-management workflows, retention and deletion processes, security-control changes, breach-response testing and training across the organisation. For a large company or GCC, this work can involve multiple business units, jurisdictions and technology stacks.

What must a DPDP-compliant privacy notice include?

Rule 3 requires a notice to be understandable independently of other information and to give a clear and plain-language account of what the individual needs to provide specific and informed consent.

• An itemised description of the personal data being processed.
• The specified purpose or purposes for processing.
• The goods, services or uses enabled by the processing.
• Information on how rights can be exercised.
• Business contact details for relevant queries.

This has an important design implication. The privacy notice should be connected to the relevant moment in the customer, employee or user journey. A generic policy located in a website footer is not enough where the actual data collection experience is unclear.

How should businesses prepare for data-principal rights?

The Act provides rights relating to access, correction, completion, updating, erasure, grievance redressal and nomination. These rights require an operating model: how the requestor is authenticated, which team receives the request, which systems must be searched, who approves the response, the response timeline, how the response is recorded, how disputes are escalated, and whether the process can be completed across outsourced systems.

The Rules require Data Fiduciaries and Consent Managers to prominently publish the means by which individuals can make rights requests. The grievance-redressal system must respond within a reasonable period not exceeding 90 days. That means an email address alone is not enough. The business needs a workflow.

What are the breach-notification obligations under the DPDP Rules?

The Rules require a Data Fiduciary, upon becoming aware of a personal-data breach, to inform affected Data Principals without delay. The notification should include the nature, extent and timing of the breach; likely consequences relevant to the individual; mitigation measures taken or being taken; safety steps the individual can take; and contact information for queries.

The Data Protection Board must also be informed without delay. A more detailed report is due within 72 hours of becoming aware of the breach, unless the Board allows more time. That report includes updated breach information, broad facts, mitigation measures, findings on the person who caused the breach, remedial measures and a report on notifications to affected Data Principals.

This matters because businesses may face multiple reporting clocks after a single incident: CERT-In reporting, Data Protection Board notification, sector-regulator reporting, contractual notice obligations, insurer notification and customer communication obligations. The response process must bring these together.

What do the Rules say about retention?

Rule 8 includes specific retention and erasure requirements. For certain large e-commerce entities, online gaming intermediaries and social-media intermediaries, personal data must be erased after a specified period if the individual has not approached the entity for the relevant purpose or exercised rights, unless retention is required by law. The Rules also require Data Fiduciaries to retain personal data, associated traffic data and other processing logs for at least one year for specified purposes, subject to other applicable legal requirements.

The practical message is not simply "retain less." It is: retain intentionally.

Every organisation should be able to explain what data it holds, why it holds it, where it holds it, how long it holds it, what legal or operational reason supports that period, and how it deletes it securely.

What should companies do about children's data?

Businesses processing children's data should identify the relevant journeys now: education platforms, gaming, family accounts, children's content, parental controls, health services, travel and transport services, and targeted marketing. The Rules require appropriate technical and organisational measures to ensure verifiable parental consent before processing a child's personal data. This is not a task that can be left only to legal or compliance teams. It requires product, engineering, operations and customer-support input.

A 120-day DPDP readiness programme

The transition period is a build period, not a waiting period.

How Should a Business Respond to a Cyber Incident in India?

A cyber incident is not solely a technical event. It is a legal event from the first hour. CERT-In handled 29.44 lakh (approximately 2.94 million) cyber security incidents in 2025 alone. At that volume, the question for any business is not whether an incident will occur, but whether the organisation can execute its legal and regulatory obligations in the hours immediately after it does.

It can affect regulators, customers, employees, business partners, insurers, lenders, investors and the board. The first question should not be: "Who caused this?" The first question should be: "What must we do now to contain the incident, preserve evidence and meet our legal obligations?"

What should happen in the first six hours?

CERT-In directions require reporting of specified cyber incidents within six hours of noticing the incident or being brought to notice. The right response is not to wait until every fact is known. The right response is to establish a disciplined process.

What should every incident-response plan contain?

• Current contact details and clear authority levels.
• A legal escalation route and CERT-In reporting templates.
• Customer and vendor notification templates.
• Insurer contact details and outside forensic and legal support contacts.
• Evidence-preservation instructions and a decision-log format.
• A communications approval process and pre-planned tabletop exercises.

A plan says who should do what. A capability has current contact details, delegated authority, tested vendor access and a team that has practised together.

The incident contract checklist

For material vendors, contracts should address notification timing, cooperation obligations, evidence preservation, access to logs and relevant records, incident updates, sub-processor obligations, audit rights, recovery support, cost allocation, liability limits, and termination or exit rights after a serious incident. "Prompt notification" is often too vague. A contract should establish when the vendor must notify, what an initial notification must contain and how updates will be provided.

Why Is Third-Party Technology Risk Now a Board-Level Issue?

Modern organisations depend on vendors for critical functions: cloud infrastructure, AI tools, identity management, payroll, customer relationship management, payment systems, analytics, security monitoring, software development and data hosting. This means a vendor's failure can quickly become the company's failure.

The relevant question is not "Is this vendor secure?" It is "Is this vendor, service configuration and contract appropriate for the data, risk and business use involved?"

Five questions before onboarding an AI, cloud or data vendor

• What data will enter the service? Classify the data before the tool is adopted - public, internal, confidential, personal, sensitive, regulated, privileged or customer-owned - and let the answer determine the review level.
• What will the provider do with the data? Ask whether it may retain inputs, use inputs to train models, share information with sub-processors, process data outside India, use data for analytics or service improvement, or keep data after the contract ends.
• Can the business control access and deletion? Look for enterprise access controls, role-based permissions, audit logs, administrative controls, retention settings, deletion tools, deletion certification and export capability.
• What happens during an incident? The contract should cover notification, support, logs, evidence, remediation, customer communications and allocation of cost.
• Can the business exit? Understand how data will be returned and deleted, whether systems can be migrated, whether transition support is available, and what happens if the vendor changes terms or suffers a prolonged outage.

How Should GCCs Approach AI, Privacy and Cyber Governance?

India now hosts 2,117 GCCs across 3,728 units, generating $98.4 billion in revenue and employing 2.36 million professionals - up 32% since FY2021, according to the Zinnov-Nasscom India GCC Landscape Report 2026. India has also become the #1 AI hiring market globally, with over 506,000 AI/ML roles. But the same report flags an operating-model gap: AI hiring is outpacing the governance structures needed to manage it. That gap is precisely where legal exposure concentrates.

GCCs are increasingly strategic control centres. They may build products, process global data, operate security functions, develop AI solutions, support regulated group entities and manage vendors across jurisdictions. This creates an opportunity. A GCC that can provide reliable AI-use inventories, privacy operations, incident coordination and evidence-ready controls becomes a source of confidence for the global group.

The key is not centralisation for its own sake. It is clarity of responsibility.

Ten Questions Every Board Should Be Able to Answer

1. 01Do we have a current inventory of material AI uses and AI vendors?
2. 02Which AI-enabled decisions affect employees, customers or other individuals?
3. 03Do we know where personal data is stored, shared and retained?
4. 04Are our DPDP readiness milestones owned, funded and reported?
5. 05Have we tested a cyber incident involving personal-data compromise?
6. 06Can we meet the CERT-In reporting timeline in practice?
7. 07Are material vendor contracts aligned with our privacy and security risk?
8. 08Does management report meaningful AI, privacy and cyber metrics?
9. 09Are staff trained on approved AI use and data-handling boundaries?
10. 10If challenged by a regulator, customer or board member, can we show evidence of our decisions and controls?

Good governance is not a collection of policies. It is a record of informed choices, clear ownership, tested controls and timely escalation.

Frequently Asked Questions

Closing Note

The organisations that will lead in 2026 will not be those that adopt every new tool first. They will be the ones that can adopt the right tools with confidence.

They will know what data is involved, who is accountable, what controls apply, where the risk sits and how they will respond if something goes wrong.

That is the shift underway in data, AI and cyber law. Not compliance after innovation. Governance as part of innovation.

Official Sources

• Digital Personal Data Protection Rules, 2025 - Ministry of Electronics and Information Technology
• Digital Personal Data Protection Act, 2023 - India Code
• CERT-In Directions under section 70B of the Information Technology Act
• CERT-In FAQ on Cyber Security Directions
• European Commission guidance on obligations for general-purpose AI providers
• European Commission guidance on the GPAI compliance and enforcement timeline
• Zinnov-Nasscom India GCC Landscape Report 2026
• CERT-In / PIB - Cyber incidents handled in 2025

This newsletter is for general information only and does not constitute legal advice. Specific facts, sector rules, jurisdictions and contractual obligations can materially change the analysis.