Notes from the Asia-Pacific region: Key developments in India's digital policy landscape

It is that wonderful time of year in India when the calendar is full of festivals. The nine colorful and vibrant days of Navratri just went by, culminating in the Dussehra festival being celebrated yesterday. Dussehra marks the triumph of good over evil, symbolized differently in different parts of India. As this festive pace picks up, the digital policy world might be expected to slow down long enough for everyone to enjoy the season.

That is clearly not happening, though.

This past month has brought an interesting assortment of developments spanning India's Digital Personal Data Protection Act, artificial intelligence governance, AI-generated advertising, telecommunications, deepfakes, personality rights, automated decision-making and children's online safety.

DPDPA compliance deadline remains firm

Let's begin with the DPDPA, which remains at the heart of most privacy-related conversations in the country.

On 7 Oct., India's trade association Nasscom and the Ministry of Electronics and Information Technology kickstarted the first of a series of DPDPA readiness workshops in New Delhi. Aimed at bringing additional clarity on implementing the DPDPA, MeitY Secretary S. Krishnan provided the event's keynote address. 

I had the privilege of speaking at this inaugural event and had the opportunity to hear the secretary clearly and unequivocally state the May 2027 compliance deadline will not be postponed. In fact, he said stakeholders should be thankful the deadline is not being advanced. This emphatic reiteration should provide greater certainty to organizations preparing for compliance. 

AI governance consultation on the horizon 

Meanwhile, India's evolving approach to AI governance may soon undergo another round of public consultation. Union Minister for Electronics and Information Technology Ashwini Vaishnaw said 8 Oct. that the government planned to release a consultation paper on AI regulation within a month. 

The paper would focus on AI safety, its human impact and the risks arising from deepfakes. He emphasized a "techno-legal" approach combining technology, regulation and industry responsibility to address the challenges of governing AI.

ASCI takes risk-based approach to AI advertising

The Advertising Standards Council of India also stepped into the AI-governance arena. The ASCI released the Guidelines for Responsible Labelling of Synthetically Generated Content in Advertising 29 Sept. The guidelines are scheduled to take effect three months from publication.  

The guidelines define synthetically generated content as audio, visual or audiovisual advertising content that has been artificially or algorithmically originated, created, generated, modified or materially altered to appear real or authentic. Their focus is not simply on whether AI has been used, but on whether the synthetic content could affect consumer understanding or decision-making.  

Labeling is mandatory where synthetically generated content materially influences consumer decisions and the absence of a disclosure could mislead consumers. Examples include synthetically generated influencers and ambassadors; replication of a real person's likeness or voice, even where consent has been obtained, for personalized messaging; fabricated events or settings that could affect consumers' understanding of a product or service; demonstrations involving products that do not yet exist; synthetic sound effects highly relevant to a product's core features; and paid or sponsored AI-generated product suggestions.  

Routine editing that does not materially affect a consumer's ability to make an informed choice does not require disclosure. Fabricated endorsements, misleading representations of product performance, unauthorized use of copyrighted works and deepfakes or use of a person's likeness without consent remain prohibited regardless of whether an AI label is added.  

The guidelines are interesting because they frame AI disclosure in terms of consumer impact rather than treating every use of AI as equivalent. This risk-based approach may reduce unnecessary labeling, but it also places considerable responsibility on advertisers to decide when synthetic content might materially influence a consumer.

New telecom rules aim to curb spam calls, messages 

Another development addresses something every Indian mobile subscriber will recognize: the seemingly endless flow of spam calls and messages. The Telecom Regulatory Authority of India issued 18 Sept. the Telecom Commercial Communications Customer Preference (Third Amendment) Regulations, 2026. The amendments seek to strengthen the framework for controlling unsolicited commercial communications and preventing the misuse of telecommunications resources.

The framework incorporates AI- and machine learning-based detection of suspected unsolicited commercial communications. The TRAI's accompanying press note states that major telecommunications service providers had already deployed AI- and machine learning-based systems to detect suspected spam communications. The new Regulation 21A requires service providers to identify calling line identities with a high probability of being used for unsolicited commercial communications and share the information with other providers for further investigation.

Given the volume of spam calls and messages experienced by Indian consumers, this is an area where regulatory action will ultimately be judged not merely by the sophistication of its design, but by whether the average mobile user notices a difference.

Deepfake regulation reaches the Supreme Court

The Supreme Court of India's engagement with deepfakes is not limited to individual personality-rights disputes. In September, the Supreme Court reportedly stayed further proceedings in a public-interest matter before the Gujarat High Court involving deepfake and AI-generated content relating to the government's SAHYOG portal, a platform used to coordinate requests between law enforcement authorities and online intermediaries. 

The Union government had approached the Supreme Court seeking transfer of the proceeding, noting that similar matters had arisen before other High Courts. The Supreme Court reportedly issued notice on the transfer petition and stayed the Gujarat proceeding in the meantime.

The Gujarat High Court had sought information from intermediaries including Meta, Google, Reddit and X, and had issued an interim direction concerning their connection with the portal.  

The wider significance of the Supreme Court's intervention lies in the possibility that overlapping proceedings concerning AI-generated content and intermediary responsibilities may be considered nationally rather than developing independently across several High Courts. 

Since deepfake governance sits at the intersection of privacy, identity, fraud, personal dignity, freedom of expression and platform responsibility, this development is significant. While resolving questions through isolated cases may provide relief to individual litigants, it may not by itself produce a consistent national framework.

Automated decision-making faces judicial scrutiny

Automated decision-making is another issue slowly finding its way into Indian litigation. A petition before the Telangana High Court challenges the use of the Election Commission of India's ECINet and Electoral Registration Officers Network's automated data-matching platforms to identify discrepancies in electoral information and initiate proceedings involving voters.

The petitioner alleges that voters were being flagged over relatively minor discrepancies without adequate verification of underlying physical records or sufficient independent review by the relevant electoral registration officers. The petition also questions whether the methodology, parameters and functioning of the platforms have been sufficiently disclosed publicly. It seeks to prevent proceedings from being initiated solely based on automated matching without following the procedures prescribed under electoral law.

The case raises an important question: What rights should individuals have when a decision affecting them is made or materially influenced by an automated system?

India's DPDPA includes automated operations within the definition of personal data processing. However, it does not establish a dedicated, generally applicable right to an explanation of an automated decision or a specific right to demand human review. In a context as consequential as inclusion in an electoral roll, transparency, verification and an accessible avenue for correction are difficult to dismiss as merely technical matters.

Building AI for India's linguistic diversity

Another important component emerging in India's AI-governance debate is around addressing the unique challenges of a diverse set of languages used in the country — there are 22 officially recognized languages in India — and the cultural diversity across its geographical expanse, given the scale of digital technologies adopted.

In September, the National Association of Software and Service Companies published its Indic AI Leaderboards Survey Insights Report, based on a consultation involving 82 respondents and covering 23 languages. The study considered how automatic speech recognition and large language models designed for Indian languages should be assessed, governed and protected against manipulation.  

Among its findings: 76% of respondents preferred a hybrid evaluation approach combining LLMs and human assessment; 74% preferred quarterly submission windows; and 68% preferred disclosure or recusal, rather than exclusion, to manage conflicts of interest.

The findings demonstrate why evaluating AI systems for India cannot be reduced to a single benchmark or accuracy score. A model can perform well on a standard test while failing to capture cultural context, dialect variations, code-switching or domain-specific usage.

As India's digital journey continues to unfold, I am looking forward to the festive season ahead spending time with family and friends.