INDIA

1. Delhi High Court recognised Right to be Forgotten in Judicial Records^[1]

The Delhi High Court considered a batch of petitions filed by individuals whose names continued to appear in online judicial records after acquittals, quashed proceedings, settlements, matrimonial disputes and other private matters. The Court held that the right to be forgotten forms part of informational privacy protected under Article 21 of the Constitution. It also clarified that the absence of a specific statute does not prevent constitutional courts from granting appropriate relief where continued online accessibility causes disproportionate harm to a person’s privacy, dignity or reputation.

The court drew a careful distinction between preserving a judicial record and allowing that record to remain indefinitely discoverable through a person’s name. It explained that de-indexing does not erase a judgment. The record remains available through the case number, citation and other purposeful search terms, while the individual’s name is disabled as an unrestricted search key. The court also recognised masking, under which personal identifiers may be replaced with neutral references in publicly accessible versions. Google, Indian Kanoon and the concerned intermediaries were directed to implement the relief granted in the petitions before the court.

The ruling should not be read as creating an automatic right to remove every unfavourable court record. Relief will remain fact-specific and must be balanced against open justice, public interest and freedom of expression. However, search engines, legal databases and platforms hosting public records may now need a clear process to assess and implement de-indexing or masking orders without altering the underlying judicial record.

2. Consumer Protection Court penalised Edtech Platform for Dark Patterns^[2]

CCPA has imposed penalties imposed a penalty of INR 5 lakh on PhysicsWallah Limited (“Company”) for interface practices that interfered with genuine consumer choice. The CCPA found that INR 10 contribution to the PW Foundation was automatically added and pre-selected during checkout, requiring the consumer to notice and remove it. The Company also used messaging connected with children’s education and healthcare while presenting the contribution. Separately, users seeking access to content advertised as “free” were required to provide personal details such as their mobile number and email address, even though the content offered did not change based on the information collected.

The practices were examined under the Guidelines for Prevention and Regulation of Dark Patterns, 2023. Pre-selecting an additional payment was treated as basket sneaking, while attaching unnecessary data collection to a free service raised concerns of forced action. CCPA directed the Company to discontinue the practices and ensure that consumers are able to make an informed and unpressured choice.

The order shows that dark-pattern enforcement is moving beyond misleading advertisements to the design of checkout, consent and data-collection journeys. EdTech, e-commerce, SaaS and subscription businesses should review whether add-ons are pre-selected, whether a refusal option is equally visible and whether personal data is genuinely necessary for a free product or feature. A technically available opt-out may not be sufficient where the interface is designed to steer the consumer towards a particular outcome

3. Delhi High Court upheld Temporary Nationwide Block on Messaging Application ^[3]

MeitY temporarily blocked public access to Telegram across India from June 16 to June 22, 2026, ahead of the NEET-UG re-examination. The Government said organised cheating networks were using Telegram channels to offer purported leaked question papers and mislead candidates. The application was also removed from app stores during the restriction. Telegram argued that misuse by a limited set of users could not justify disabling the service for its wider user base.

Telegram challenged the service-wide restriction before the Delhi High Court and it declined to interfere, holding that the Government was empowered to block public access to Telegram and that the temporary measure was legal and reasonable in the circumstances. The decision is significant because the direction did not merely remove identified channels, accounts or messages; it suspended access to the application itself for users across India. Although the restriction has expired, the ruling demonstrates that the blocking power under Section 69A of the IT Act may extend to an entire computer resource where the Government establishes that narrower measures are inadequate.

The case shows that where a platform is used for organised misconduct affecting significant public interest, the Government may invoke Section 69A to restrict access to the entire application, rather than only specific accounts or content. Such action should remain exceptional, reasoned, proportionate and time-bound. Businesses operating digital platforms should therefore maintain effective misuse controls and rapid response mechanisms, as failure to contain serious misuse may invite service-wide restrictions.

4. Calcutta High Court dismissed Marketplace Company’s Application against AI Company^[4]

The Calcutta High Court delivered its judgment dismissing IndiaMART InterMesh Limited (“IndiaMART”) ’s application for relief against OpenAI’s ChatGPT. IndiaMART, a business-to-business portal operating since 1996, alleged that ChatGPT was deliberately excluding it from responses when users searched for suppliers. ChatGPT bypassed IndiaMART and directed queries straight to seller websites, while working links to rival platforms were provided. IndiaMART contended this amounted to dilution of its trademark, disparagement, and unfair trade practice. It emerged that OpenAI declined to feature IndiaMART content because the platform appears on the United States Trade Representative Notorious Markets List, 2024 – a foreign list that IndiaMART argued carries no statutory force in India.

The court dismissed the application on the foundational ground that there is no legal right to visibility on a private platform. No contract, no statute, and no constitutional provision creates an obligation for a private business to promote or feature another on its own service, and without a legally recognised injury there is no actionable cause. On the intellectual property grounds, the court found no falsity, deception, confusion, or publication that would sustain a claim. The court, however, made a significant observation on the more fundamental question: that ChatGPT, which curates, generates, and creates original output rather than merely passing on third-party content, prima facie resembles an originator more than a passive intermediary. However, the opposing view that no output appears without a user prompt also has force. The court held that this vexed question requires expert evidence at a full trial and noted that the IT Act was enacted well before generative AI and may require fresh legislation.

The judgment has significant implications for AI-adjacent litigation in India. The court’s observation that generative AI may be an originator, not an intermediary, directly challenges the liability shield that platforms have historically claimed under the safe harbour provisions of the IT Act. Businesses that operate or engage with AI platforms, whether as users, complainants, or developers, should note that this question is now formally live before Indian courts and that legislation may be required to resolve it definitively.

5. RBI amended Directions on Limiting Customer Liability in Digital Transactions^[5]

RBI issued final Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026 (“Amendment Directions”) revising the framework for customer liability in digital banking transactions, with effect from January 1, 2027. Amendment Directions are no longer limited to transactions carried out without the customer’s authorisation. It also covers fraudulent electronic banking transactions induced through deception, coercion or similar fraud, including card-present and card-not-present transactions. A customer will continue to have zero liability where the loss arises from negligence of the bank or a third-party breach, and the bank bears the burden of establishing that the customer is liable.

The Amendment Directions also introduce limited one-time relief for individual customers and sole proprietors who suffer bona fide losses of up to INR 50,000. Subject to the prescribed reporting conditions, the compensation is 85% of the net loss or INR 25,000, whichever is lower. The fraud must be reported to the bank and through the National Cyber Crime Reporting Portal or Helpline 1930 within 5 calendar days. Banks must maintain round-the-clock reporting channels, send transaction alerts and provide provisional credit within the prescribed period for specified transactions while the matter is investigated.

The most important change for banks and payment entities is the shift from relying on standard customer-negligence clauses to proving what occurred in the particular transaction. Institutions will need reliable alert records, fraud-monitoring logs, prompt complaint handling and clear coordination with payment aggregators, gateways and telecom service providers. The January 2027 commencement date should be used to test whether systems can support the evidentiary and response obligations, not only whether policies have been amended.

6. RBI proposed a Model Risk Framework for AI and Machine Learning^[6]

The RBI has released a draft of Guidance on Regulatory Principles for Model Risk Management, 2026 (“Draft Guidelines”) for public consultation till July 26, 2026, setting out for the first time comprehensive and explicit governance expectations for the use of models, including AI and machine learning models, by regulated entities. The Draft Guidelines require a Board-approved model risk management framework covering the complete lifecycle of every model, including selection, development, approval, independent validation, deployment, monitoring, modification and decommissioning. Models must be classified according to materiality and complexity and maintained in a complete inventory with supporting documentation.

Draft Guidelines expressly covers AI and machine learning models. Regulated entities would be expected to address explainability, bias and fairness, hallucination risk, data drift, overfitting, red-teaming, business continuity and automation bias. Models used for automated decisions must remain subject to meaningful human oversight. Customer-facing generative AI would require additional safeguards and a human alternative. Importantly, the regulated entity remains responsible for the outcome even where the model has been procured from a third-party vendor, and third-party models must also undergo independent validation.

Draft Guidelines treats model risk as an enterprise governance issue rather than a matter left to data science or technology teams. Financial entities using AI for credit, fraud detection, customer service, pricing or risk management should begin identifying every model and the decisions it supports. Vendor procurement will also need stronger due diligence, documentation, access and audit rights, because outsourcing the model will not outsource regulatory accountability.

7. MHA launched Money Restoration Module for Cybercrime Victims^[7]

MHA launched the Money Restoration Module under the National Cyber Crime Reporting Portal to simplify the return of money that has already been traced and frozen in a fraudster’s bank account. A victim who has registered the cybercrime complaint and received the acknowledgement number can use the online process instead of repeatedly approaching the police, bank and court for restoration. The mechanism does not create a fresh recovery source; it applies only where the disputed amount has been successfully placed on hold or frozen.

The process distinguishes cases by the amount frozen in each beneficiary account. Where no single account contains more than INR 50,000, restoration may be processed on the basis of the police report and prescribed documentation without a separate court order. Where more than INR 50,000 is frozen in a single account, registration of an FIR is required before the remaining process is completed through the portal. The police upload the necessary documents and the bank credits the approved amount directly to the victim’s nominated account.

The module addresses a practical gap between freezing stolen funds and returning them to the victim. Its usefulness will still depend on immediate reporting, since money can be restored only if it is intercepted in time. Banks, FinTechs and consumer-facing digital businesses should therefore make the 1930 Helpline and NCRP reporting process prominent in their fraud-response communications and ensure that internal teams promptly preserve transaction details needed by the police and banks.

8. RBI prohibited Compulsory Bundling and Dark Patterns in Financial Products^[8]

The RBI issued final amendments to its Responsible Business Conduct Directions (“Directions”) to curb mis-selling of financial products. Effective January 1, 2027, banks and their agents may not use dark patterns in websites, applications or other sales channels, or make an additional financial product a compulsory condition for obtaining the principal product. Mis-selling includes offering an unsuitable product, giving misleading or incomplete information, selling without explicit consent and bundling products in a manner that removes genuine customer choice.

Consent for each product must be clear, informed and recorded; it cannot be assumed through a pre-ticked box or a default selection. Key features, risks, fees and exit conditions must be disclosed upfront. Regulated entities must periodically audit their interfaces for manipulative design and provide simple mechanisms to decline add-ons and marketing communication. Where mis-selling is established, the bank must cancel the sale and refund the amount collected in accordance with the Directions.

The Directions will require banks, NBFCs, fintech distributors and their agents to review not only their contracts, but also their sales journeys, digital interfaces and consent mechanisms. The approach also aligns with the consent framework under the DPDP Regulations, which requires consent to be free, specific, informed and based on a clear affirmative action. Pre-ticked boxes, default selections and bundled consent for additional products, marketing or cross-selling may therefore raise concerns under both frameworks. Key players should ensure that acceptance of each product and any related use of personal data is obtained separately and without influencing the customer’s choice.

9. Cloud-Stored Data held to form Part of Deceased’s Estate^[9]

Court of the 3rd Additional Senior Civil Judge at Gandhinagar held that data stored in a deceased person’s iPhone and iCloud account, including photographs, videos, documents and contacts, forms part of the deceased person’s digital estate. The court observed that the right to privacy does not prevent legal heirs from lawfully accessing and administering such digital assets after death. Where no nominee has been appointed under the DPDP Regulations, legal heirs may seek access through succession proceedings under the Indian Succession Act, 1925. The court also held that technology platforms may be directed by courts to assist legal representatives in recovering and accessing the digital assets of a deceased user.

The judgment bridges an important gap between the DPDP Regulation and the Indian Succession law, and is the first Indian judicial recognition that digital assets are capable of inheritance and administration through established succession law principles. For businesses offering cloud storage, digital wallets, or data services, the ruling signals that court orders requiring platform assistance in succession-related access can be obtained by legal heirs. The absence of a comprehensive digital estate framework in India and the DPDP Regulations’ current silence on posthumous data governance means that this area of law is likely to develop further through litigation in the near term.

10. Supreme Court clarified Certification Safeguards for Electronic Evidence^[10]

The Supreme Court dismissed a challenge to Section 63(4) of BNS which required electronic records produced as secondary evidence to be accompanied by a certificate containing the record’s hash value and certification by a technical expert. The petitioner argued that these requirements imposed an unreasonable burden on litigants, particularly because only a limited number of experts were notified under Section 79A of the IT Act.

The court upheld the requirements, observing that a hash value functioned as a digital fingerprint and helped establish that an electronic record had not been altered after extraction. Expert certification provided an additional safeguard against manipulation, particularly given the growing use of AI and deepfake technologies. The court also clarified that certification was not limited to experts notified under Section 79A. A court could recognise any person with demonstrated expertise in computer science or cyber forensics as a qualified expert.

The ruling clarified the requirements for producing emails, messages, CCTV footage, recordings, system logs and digital documents in court. Businesses should ensure that electronic records are preserved in a forensically sound manner, hash values are recorded at the time of extraction and a clear chain of custody is maintained.

11. Draft AI Regulations released for Courts^[11]

The Supreme Court released the Regulations for Use of Artificial Intelligence in Courts, 2026 (“Proposed Framework”), inviting stakeholder feedback until June 20, 2026. The Proposed Framework applies across the Supreme Court, High Courts, subordinate courts, adjudicatory tribunals and statutory commissions. It is built around human primacy, judicial independence, fairness, transparency, accountability, data protection and cybersecurity. AI is permitted only as an assistive tool and must remain subordinate to human judgment.

Permitted uses include case management, scheduling, legal research, document summarisation, translation, transcription, accessibility tools, litigant-assistance chatbots and court analytics. The Proposed Framework absolutely prohibits AI-only judicial outcomes, the use of AI for adjudication or sentencing without human control, bail or recidivism risk scoring, predictive profiling of parties and surveillance of judges, lawyers or litigants. It also proposes an Apex Body at the Supreme Court level, AI Committees and Secretariats at the High Court level, technical and ethical impact assessments, an AI Register, periodic audits and an AI Incident Database.

This draws a clear line between using AI to improve court administration and allowing it to influence the exercise of judicial power. Legal technology providers will need to demonstrate accuracy, security, explainability, auditability and effective human oversight before their tools can be deployed in the court system. The framework is also relevant to law firms and litigants using AI-generated material: verification, confidentiality and disclosure cannot be treated as optional safeguards. Stakeholders with an interest in legal AI are advised to engage during the consultation period, as the final regulations will set the governance baseline for the entire court system.