INDIA

1. RBI released Draft Guidance on Data Governance^[1]

On July 15, 2026, the RBI released the draft Guidance on Regulatory Expectations for Data Governance (“Draft RBI Guidance”) for public comments. The consultation remains open until August 17, 2026. The Draft RBI Guidance is for banks, NBFCs and other regulated entities (“REs”) and expects each RE to establish a comprehensive data governance framework covering the manner in which data is identified, classified, accessed, maintained, shared and governed across its lifecycle. Oversight is expected at the highest level, with the Board of Directors responsible for approving the framework and Data Governance Committees operating at the board and executive levels.

The Draft RBI Guidance also places clear responsibility on identified personnel. Data Owners are expected to remain accountable for data within their business domain, Data Stewards for quality and appropriate use, and Data Custodians for technical storage, security and availability. The framework therefore moves data governance beyond the information technology function and requires business teams, risk, compliance and technology teams to work within a common ownership structure. Data quality, integrity and classification are particularly important because regulatory reports, risk models, customer decisions and management information all depend on reliable underlying data.

Third-party arrangements receive specific attention. Access to shared data should be limited to persons with a genuine need to know, and appropriate confidentiality obligations should be included in contracts. REs will therefore need visibility over what data is shared with service providers, who can access it, the purpose for which it is used and the controls applied throughout the arrangement.

The Draft RBI Guidance makes data governance a board and management responsibility rather than a policy exercise. REs should now assess whether their data inventory, ownership matrix, access controls, quality checks and vendor arrangements can be demonstrated through records and audit trails. The same work will support DPDP compliance, but the two frameworks should be implemented together rather than through separate and duplicative programmes.

2. CBDT issued Guidance Note on Crypto-asset Reporting Obligations^[2]

CBDT published Crypto-Asset Reporting Obligations under Section 509 of the Income-tax Act, 2025: Guidance Note (“Guidance Note”). The Guidance Note explains the reporting obligations under Section 509, Rules 241 to 244 and Form 167 of the Income-tax Rules, 2026, which have been in force since April 01, 2026. The Guidance Note is intended to support implementation of the OECD Crypto-Asset Reporting Framework (“CARF”) and increase tax transparency in relation to crypto-asset transactions.

The Guidance Note requires Reporting Crypto-Asset Service Providers (“RCASP”) to determine whether they fall within the reporting regime, identify reportable users and transactions, undertake prescribed due diligence and furnish the required information to the income-tax authorities. It also addresses the correction of inaccurate statements and enables the Government to prescribe requirements relating to registration, record maintenance and identification of crypto-asset users or owners. Non-compliance may result in daily penalties for delayed reporting and separate penalties for inaccurate information or failure to meet the due-diligence requirements.

The obligation is operationally significant because accurate reporting depends on information collected much earlier in the customer lifecycle. Customer onboarding, tax-residency information, account classification, transaction records and wallet or platform data must be capable of being connected and validated. Errors in source data may therefore flow directly into regulatory reporting and expose the RCASP to repeated corrections or penalties.

For crypto businesses, reporting under CARF is not merely a year-end tax filing exercise. It requires continuing data governance across onboarding, transaction monitoring, record retention and regulatory reporting. RCASPs should identify ownership between tax, compliance, operations and technology teams and ensure that the larger volume of reportable customer data is protected through appropriate access and security controls.

3. Delhi High Court refused Interim Injunction in Copyright Dispute involving AI Training^[3]

In ANI Media Pvt. Ltd. v. OpenAI OpCo LLC, the Delhi High Court dismissed ANI Media Private Limited’s (“Applicant”) application for an interim injunction against OpenAI Inc. (“Respondent”). Applicant had alleged infringement on two broad grounds: first, that its copyrighted news material had been copied and stored for training the large language models underlying ‘ChatGPT’, and second, that responses generated by ChatGPT reproduced or closely resembled Applicant’s protected content. The Applicant sought restraints on the use of its works and related interim relief while the suit remained pending.

The court first held, on a prima facie basis, that it had territorial jurisdiction. Although Respondent stated that model training and storage took place on servers outside India, the alleged responses were generated for users in India and formed part of the same chain of events as the training claim. The court therefore declined to treat the foreign location of the servers as sufficient to exclude the application of Indian copyright law at the interim stage.

On the merits, the court found that Applicant had not shown substantial reproduction of its articles, memorisation of its works or regurgitation of protected content through the examples placed on record. It also took a prima facie view that Respondent’s temporary storage and use of Applicant’s literary works for model training satisfied the purpose and fairness tests under the fair-dealing exception in the Copyright Act, 1957. The court noted, among other factors, that the material was obtained from freely accessible sources, the model was not designed to reproduce the training material, the outputs were not substitutes for Applicant’s news articles and no evidence of actual market loss had been produced.

The court further held that the balance of convenience and public interest did not support a blanket injunction. Applicant’s claim was capable of monetary assessment if it ultimately succeeded, while an injunction could materially affect Respondent’s functioning and users of the service. Importantly, the court expressly clarified that these findings were limited to the interim application and would not determine the final outcome of the suit.

The order is an important interim indication, not a final ruling that all AI training on publicly available content is lawful. Its reasoning is closely tied to the evidence placed before the court, the source and manner of collection, the nature of the generated outputs, evidence of memorisation and market harm. AI developers and content businesses should therefore continue to maintain records of training sources and opt-out controls, output safeguards, licensing positions and the commercial impact of model use.

4. Parliamentary Committee recommended Interim Framework for VDA^[4]

Parliamentary Standing Committee on Finance adopted the Thirty-Sixth Report on the Securities Markets Code, 2025 (“Report”), which was presented to the Lok Sabha and laid in the Rajya Sabha on 23 July 2026. In the Report, the Committee recommended that the Government establish a regulatory framework for VDAs. Recognising that a comprehensive framework may take time, it suggested that an interim mechanism be considered to address the current regulatory gap.

The Report proposed that the interim regime could operate through Self-Regulatory Organisations (“SROs”). Such bodies could prescribe standards relating to governance, transparency, disclosures and compliance with a code of conduct. The recommendation is intended to reduce the risks created by the absence of a single operating framework, even though VDA businesses are already subject to tax, anti-money-laundering and other legal requirements.

An SRO-led model could give the sector more immediate standards and a forum for supervision, but its effectiveness will depend on membership, oversight, enforcement powers and coordination with existing regulators. It also would not resolve all questions relating to investor protection, custody, market conduct or the legal treatment of different crypto-assets.

Exchanges, custodians and other VDA service providers should not treat the absence of a final statute as an absence of regulatory expectation. Governance, customer disclosures, asset segregation, complaint handling and transaction records are likely to remain central under either an interim or final regime. Businesses should therefore build controls that can be adapted rather than waiting for the final architecture to be announced.

5. CCPA penalised Airline for Dark Patterns in Online Booking^[5]

In its final order in the matter of SpiceJet Limited (“Company”), CCPA imposed a penalty of INR 1 Lakh after taking suo motu cognisance of practices on its online booking portal. CCPA found that consumers booking tickets were automatically enrolled in the ‘Spice Club’ loyalty programme through a pre-ticked checkbox. The design required a consumer to identify and remove the selection instead of making an active choice to join.

The CCPA classified the practice as involving forced action, interface interference and a trick question under the Guidelines for Prevention and Regulation of Dark Patterns, 2023. It also noted that after receiving notice, the Company replaced the loyalty-programme selection with another pre-ticked checkbox for promotional communication through SMS, WhatsApp and email. CCPA did not accept the explanation that the design resulted from a technical error and treated the conduct as a misleading advertisement, an unfair trade practice and an unfair contract under the Consumer Protection Act, 2019.

Airlines, e-commerce businesses and digital platforms should review the complete customer journey, including loyalty enrolment, marketing permissions, add-ons and ancillary services. Product acceptance and permission for promotional communication should be separate, equally visible and based on a clear affirmative action. This approach also aligns closely with the consent standard under the DPDP framework.

6. Government ordered Removal of Battery Management System Applications from App Stores^[6]

The Government took note of reports that certain Battery Management System (“BMS”) mobile applications allowed unauthorised remote control of e-rickshaw batteries. On July 03, 2026, it issued orders directing app stores to remove the identified applications (“Removal Orders”). The concern was not confined to misuse of software, remote interference with a battery could create a direct risk to vehicles, drivers, passengers and public safety.

In its response, the Government also referred to the national cybersecurity framework, including the National Cyber Security Coordinator, the CERT-In, the National Cyber Coordination Centre and the National Critical Information Infrastructure Protection Centre. The matter therefore illustrates how connected-device risks may involve product safety, cybersecurity, consumer protection and platform responsibility at the same time.

Where a vulnerability threatens public safety, regulators may move beyond directing remediation and require the application or service to be removed. Businesses operating connected products should therefore treat cybersecurity as part of product governance and safety approval, not merely as an information-technology control.

7. Madhya Pradesh High Court allowed Release of Account Frozen in Cyber-fraud Investigation^[7]

In a recent matter, the Madhya Pradesh High Court considered bank accounts frozen on the basis of communications received from different cybercrime cells. The petitioner stated that it had not been informed of any alleged involvement in cybercrime and that the freeze had been imposed without the investigating agency completing the process required before the competent Judicial Magistrate.

The court held that an account could not remain frozen indefinitely merely on the basis of communications from cybercrime authorities where the procedure under the BNSS had not been followed. It directed the bank to release the accounts while requiring the disputed amount to be placed in a fixed deposit for three months, subject to any further direction from the competent Magistrate after the investigation.

The order protected the disputed amount without allowing an open-ended restriction over the petitioner’s complete banking operations. It also reinforced the need for investigating agencies and banks to document the legal authority, procedural steps, amount under dispute and continued necessity of each freeze.

The decision forms part of a wider judicial concern with indefinite and account-wide restrictions arising from cyber-fraud complaints. Banks should periodically review freezes instead of treating an initial communication as a permanent direction. A targeted hold can preserve funds for an investigation without unnecessarily paralysing a legitimate business.

8. Andhra Pradesh High Court ordered Defreezing of Account frozen over INR 1,000 UPI Transaction^[8]

In a recent matter, Andhra Pradesh High Court directed the State Bank of India to defreeze the current account of a licensed wine retailer. The account had been frozen after it received INR 1,000 UPI payment from a person who was subsequently accused of cheating in Bihar. No prior notice or reason was given to the petitioner, and a communication explaining the freeze was issued only after the petitioner made enquiries.

The restriction affected the entire balance of INR 8,26,633 and prevented the petitioner from using its operating funds. The court observed that a small merchant accepting payments through services such as PhonePe or Google Pay cannot ordinarily verify the credentials or background of every customer. There was no material showing that the petitioner was involved in the alleged offence or had any connection with the accused beyond receiving the disputed payment.

Against this background, the court held that freezing the complete account without examining the petitioner’s role was unlawful and directed the bank to restore access. The case reflects the serious commercial consequences that may follow when a small disputed transaction results in an account-wide restriction.

Cyber-fraud response must be effective, but it should also be proportionate. Where the account holder is not implicated, banks and investigating agencies should consider ring-fencing the disputed amount rather than disabling the entire account. Businesses should retain transaction records and maintain escalation channels so that the basis, scope and duration of a freeze can be challenged promptly

9. CDSCO issued Final Guidance on Medical Device Software^[9]

CDSCO issued the final Guidance Document on Medical Device Software, Doc. No. SCO/MD/GD/MDSW/01/2026 (“Guidance”). The Guidance explains how the Medical Devices Rules, 2017 apply to software intended for medical purposes, including standalone software, embedded software, mobile applications, cloud-based platforms and AI or machine learning tools. It is clarificatory and does not create a separate regulatory regime.

Whether a product qualifies as Medical Device Software will depend mainly on its intended use and actual functionality. Software used for diagnosis, screening, monitoring, treatment, prediction or clinical decision-making may fall within the framework, while general wellness, administrative, billing, communication and data-storage tools may remain outside it unless they perform a medical function. The Guidance also addresses risk classification, licensing, clinical evidence, quality-management systems, cybersecurity, AI bias and drift, software updates and post-market monitoring.

The Guidance makes product design and positioning a regulatory issue. Health-tech businesses should assess early whether their software performs a medical function and ensure that licensing, validation, cybersecurity, data protection and post-market controls are built into the product lifecycle before launch.

10. BCI issued Circular on Social Media, AI Use and Digital Conduct for Advocates and Law Students^[10]

BCI issued a circular covering the use of social media, court-related content and generative AI by advocates, law students, interns, law firms and chambers. It cautions against recording inside court premises, sharing confidential client or chamber material, using legal content for indirect solicitation, making claims of influence or assured results, circulating fabricated judgments and publishing misleading AI-generated or deepfake content. Educational and public-awareness content remains permissible, provided it is accurate, restrained and non-promotional.

The circular also envisages affidavits at enrolment, undertakings from students and interns, Digital Ethics Committees, complaint portals and coordinated requests to online platforms. Depending on the nature of the breach, consequences may include removal or correction of content, disciplinary proceedings, reporting to courts, withdrawal of internships and other legal action. It operates immediately as an advisory and implementation framework while formal rule changes are considered.

This circular is significant as it treats online conduct as an extension of courtroom and client-facing duties. Law firms and advocates should therefore review approval processes for social-media content, protect confidential information and clearly identify AI-generated material before publication.