Notes from the Asia-Pacific region: Key developments in India's digital policy landscape - IAPP

India is updating rules across several connected digital-policy areas. The agenda includes the Digital Personal Data Protection Act, AI governance, AI-generated advertising, telecommunications, deepfakes, personality rights, automated decision-making and children’s online safety. These changes matter because they affect how organizations handle data, create content, advertise products and communicate with the public.

The article gives concrete examples. MeitY and Nasscom began DPDPA readiness workshops on 7 October. The government also planned an AI-regulation consultation paper covering AI safety, human impact and deepfakes. Separately, the Advertising Standards Council of India issued rules for labeling synthetic content when it could materially influence consumers.

The agenda is still developing, rather than settled. The DPDPA compliance deadline remains May 2027, while the AI consultation was expected within a month of 8 October. Telecom regulation is also responding to spam calls and messages. Organizations therefore face a moving policy landscape involving privacy, trust, consumer understanding and communications.

India’s Digital Personal Data Protection Act, or DPDPA, establishes rules for processing digital personal data and protecting people whose data is used. It matters because organizations must make their data practices more transparent, secure and accountable. The article places the Act at the heart of India’s privacy conversations and describes readiness as an immediate priority.

In practice, organizations should identify the personal data they hold, document why they process it, provide required notices, manage consent or other lawful grounds, secure information and support people’s rights. They should also review vendors, retention, breach response and children’s-data practices. These are general compliance steps; the article itself does not list every obligation.

The government has fixed May 2027 as the compliance deadline. On 7 October, MeitY Secretary S. Krishnan said it would not be postponed and suggested stakeholders should be thankful it was not advanced. Nasscom and MeitY launched readiness workshops to clarify implementation, giving organizations a firm planning date.

India’s digital-policy agenda is broad because it addresses both data practices and the consequences of digital technologies. The article names eight areas: the DPDPA, AI governance, AI-generated advertising, telecommunications, deepfakes, personality rights, automated decision-making and children’s online safety. Together, they show regulation moving across privacy, communications, consumer protection and human impact.

For example, the DPDPA has a firm May 2027 compliance deadline. AI policy may address safety, human impact and deepfakes. Advertising rules focus on synthetic content that can affect consumer decisions. Telecom developments respond to spam calls and messages. These are separate issues, but each concerns trust, harm or informed participation in digital life.

The agenda is not a single finished package. Workshops are clarifying DPDPA implementation, an AI consultation was planned, and advertising guidelines were scheduled to take effect three months after publication. The article provides no further detail on automated decision-making or children’s safety, but identifies both as active policy concerns.

India’s planned AI-governance consultation will examine AI safety, its effects on people and risks created by deepfakes. It matters because AI can influence what people see, believe and decide, while synthetic media can make false material appear authentic. The consultation signals that India is considering governance across both technical and social risks.

Union Minister for Electronics and Information Technology Ashwini Vaishnaw said on 8 October that the government planned to release a consultation paper within a month. He described a “techno-legal” approach. In practical terms, that means combining technical safeguards, formal regulation and responsibility from the industry that develops or deploys AI.

The proposal was still at the consultation stage in the article. It was not presented as a final law or complete regulatory framework. Public consultation could help test how safety measures, legal duties and industry practices should work together. The stated focus on human impact and deepfakes suggests future rules may address both system behavior and harmful outcomes.

The Advertising Standards Council of India requires disclosure when synthetically generated advertising content could materially influence consumer decisions and leaving it unlabeled could mislead consumers. This risk-based rule matters because it targets synthetic content that affects understanding, rather than requiring labels for every minor use of AI.

Examples include synthetic influencers, realistic replication of a person’s voice or likeness, fabricated product settings, demonstrations of products that do not yet exist, important synthetic sound effects and sponsored AI-generated product suggestions. Routine editing that does not affect informed choice does not require disclosure. The guidelines were issued 29 September and scheduled to begin three months later.

If disclosure is omitted in a situation covered by the rule, the advertisement may fail the responsible-labeling guidelines and mislead consumers. The article does not state a specific penalty. It does make clear that labels cannot cure fabricated endorsements, misleading performance claims, unauthorized copyrighted works or non-consensual deepfakes.

The excerpt does not explain how Indian telecom providers use artificial intelligence or machine learning to detect suspected spam. It ends during the sentence introducing new Telecom Regulatory Authority of India rules. Therefore, the article supports only the broader point that spam calls and messages are becoming a regulatory target.

A typical detection system uses machine-learning models to examine patterns such as unusually high call volumes, rapid message sending, repeated complaints or behavior associated with fraud. It can flag numbers or traffic for investigation, blocking or other controls. This describes a general industry mechanism, not a method confirmed by the supplied excerpt.

The article gives no provider names, model types, detection thresholds or enforcement details. It does establish that spam calls and messages are a recognizable problem for Indian mobile subscribers and that new rules aim to curb them. The missing continuation would be needed to answer the India-specific implementation question precisely.

A risk-based approach asks what a technology does and how seriously it may affect people. It avoids treating every use of a tool as equally risky. This matters because broad rules can burden harmless activity, while targeted rules can concentrate attention on deception, harm and decisions that deserve protection.

The ASCI guidelines provide a clear example. They do not require labels simply because AI was used. They require disclosure when synthetic audio, visual or audiovisual content materially influences consumer decisions and an absent disclosure could mislead consumers. Minor routine editing, by contrast, does not require a label when it does not affect informed choice.

This approach may reduce unnecessary labeling, as the article notes, but it shifts responsibility to advertisers. They must judge whether synthetic content could materially influence consumers. That creates flexibility, while also creating uncertainty about borderline cases. The guidelines therefore emphasize impact and consumer understanding rather than technology use alone.