Data Privacy, AI, And Technology Newsletter | June 2026

Welcome to this edition of the Technology, Media, Telecommunications and Fintech Newsletter, highlighting key legal, regulatory, and judicial developments across India's digital economy. This edition covers significant updates relating to artificial intelligence, cybersecurity, telecommunications, digital platforms, and financial services regulation.

The newsletter also examines important regulatory initiatives issued by CERT-In, SEBI, TRAI, RBI, and ASCI, alongside notable judicial developments shaping the evolving technology and digital governance landscape.

Updates: Industry Updates: India

Technology Updates

CERT-In published the “Blueprint for Reducing and Defending against AI-Assisted Vulnerability Exploitation in Digital Infrastructure.”

May 25, 2026: The Indian Computer Emergency Response Team (CERT-In) issued the “Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure.”

The objectives of this blueprint, inter alia, include:

• Enhancing organizational awareness of AI-driven cyber threats, phishing, impersonation, and social engineering, etc;
• Strengthening cybersecurity governance and AI-aware security operations;
• Enhancing technical and operational security controls;
• Promoting continuous security validation audits & assessments, adversarial testing, etc; and
• Encouraging timely sharing of threat intelligence, coordinated response, and cybersecurity collaboration among relevant stakeholders and authorities, including CERT-In.

The key recommendations of the blueprint, inter alia, are the following:

• Core Defensive Principles: Organizations should adopt AI-enabled adaptive and resilience-oriented cybersecurity practices and defensive principles including continuous monitoring, segmentation, telemetry, rapid incident response mechanisms, breach simulations;
• Technical Defensive Controls: Organizations should adopt layered, risk-based, and regularly updated technical controls to reduce AI-related cyber risks and strengthen software, AI-model, and digital supply-chain visibility. These controls should be continuously updated based on evolving threats, technological changes, and operational needs;
• Incident Response and Cyber Resilience: Organisations should develop incident response and cyber resilience to quickly detect, contain, investigate, respond to, and recover from cyber incidents. Organizations should conduct incident response exercises and participate in technical exercises, cyber drills, simulations, and table-top exercises conducted by CERT-In for strengthening cyber resilience. Entities should ensure timely reporting of cyber incidents within 6 hours, in accordance with directions issued by CERT-In; and
• Security Validation: Organizations should implement continuous, risk-based security validation mechanisms to assess the effectiveness of cybersecurity controls, monitoring capabilities, incident response readiness, and operational resilience against evolving AI-assisted cyber threats. This should include conducting cybersecurity audits, security assessments, adversarial simulations, and resilience validation exercises to evaluate control effectiveness and operational preparedness.

Link Here

ASCI released the Draft Guidelines for Responsible Labelling of Synthetically Generated Content in Advertising.

May 8, 2026: The Advertising Standards Council of India (ASCI) published the Draft Guidelines for Responsible Labelling of Synthetically Generated Content in Advertising (Draft ASCI Guidelines).

The Draft ASCI Guidelines observe that the obligation to label AI-generated content depends on the potential risk to consumers and outline a framework that categorizes risks accordingly. The highlights of the risk-based framework under the Draft ASCI Guidelines are, inter alia, the following:

• High Risk: High-risk advertisements are those that are illegal, infringe on rights, make misleading claims, or violate the ASCI Code, and are prohibited even with an AI label. Examples of high-risk advertisements include (a) fabricating endorsements or testimonials, (b) exaggerating product results or features through claims or visual representations to create a misleading impression, and (c) using deepfakes, copyrighted work, or a person's likeness without consent.
• Medium Risk: Advertisements with medium risk are those where AI significantly affects consumer choices, and not disclosing this could mislead consumers. AI-labelling is required in these situations to ensure consumers understand the nature of the representation. Examples of medium-risk advertisements include (a) using virtual or synthetically generated influencers; and (b) creating realistic events, settings, or situations entirely with AI, etc.
• Low Risk: Low-risk advertisements involve minor changes or utilize AI in a manner that does not significantly affect a consumer’s ability to make an informed decision. No label is required for such advertisements. Examples of low-risk advertisements include (a) minor enhancements like routine editing, color correction, and noise reduction that do not alter the core claims of the ads; (b) creating AI-generated background and ambient elements that are unrelated to the product’s actual capabilities.

Brands may use standard labels such as "Audio/Video created using AI" or "Audio/Video enhanced using AI".

Link Here

SEBI issued an “Advisory on Emerging Advanced Artificial Intelligence (AI) Tools for Vulnerability Detection.”

May 5, 2026: The Securities and Exchange Board of India (SEBI) observed that emerging technologies, particularly AI-driven vulnerability identification tools such as Claude Mythos, have introduced new risks for regulated entities and constituted a dedicated task force (cyber-suraksha.ai) for threat intelligence and the development of mitigation strategies.

In view of the above, SEBI published a circular for regulated entities titled “Advisory on Emerging Advanced Artificial Intelligence (AI) Tools for Vulnerability Detection.” Key recommendations of the advisory, inter alia, include the following:

• Immediately updating all operating systems and applications with the latest patches to mitigate vulnerabilities and implementing virtual patching if patches are unavailable;
• Conducting Vulnerability Assessment (using AI-based tools) and regular security audits in line with the Cyber Security and Cyber Resilience Framework of SEBI;
• Coordinating with respective third-party vendors to ensure timely patch releases and deployment; and
• Ensuring that all system changes include full documentation, thorough impact analysis, structured review, rigorous testing, and secure deployment.

Link Here

Telecommunication Updates

Telecom Regulatory Authority of India issued the draft Telecom Consumers Complaint Redressal (Fourth Amendment) Regulation, 2026 for public consultation:

May 7, 2026: The Telecom Regulatory Authority of India (TRAI) issued the draft Telecom Consumers Complaint Redressal (Fourth Amendment) Regulation, 2026, for public consultation until June 5, 2026, in order to improve the efficiency, efficacy and operational details of complaint handling mechanism and its accessibility to consumers. Key highlights of the draft regulations, inter alia, include:

• Alignment with the Telecommunications Act, 2023: the proposed amendments seek to align the existing regulatory framework with the provisions of the Telecommunications Act, 2023 and the rules and regulations introduced thereunder. Accordingly, several definitions, including “Access Service”, “Broadband Service”, “Authorization”, “Survey”, “Service Provider”, “Grievance Redressal Mechanism” and “Licence” have been modified or newly introduced. Furthermore, the mandatory compliance threshold for Internet Service Providers has been revised to remove the existing financial turnover criterion, retaining only the subscriber-base criteria, thus aligning it with the provision of the Standards of Quality of Service of Access (Wireline and Wireless) and Broadband (Wireline and Wireless) Service Regulations, 2024.
• Multi-channel complaint registration: Recognising that consumers today engage primarily through digital platforms, the draft regulations incorporate provisions for emerging customer centric solutions like Chatbots, AI Agents etc. through communication channels like web portals and mobile applications, in addition to the existing Interactive Voice Response System (IVRS). The IVRS architecture itself has been restructured to introduce a standardised three-level menu (i) first level provides for language selection (ii) second level offers the caller options to select the nature of their request from the broad categories of (a) Complaints (b) Appeals and (c) Service Request/Query (iii) third level provides a context specific sub menu under each of the aforesaid categories, with an option to connect with a human representative or avail a call-back facility.
• Accessibility for Persons with Disabilities: In line with the Supreme Court’s ruling dated April 30, 2025, recognising digital access as an intrinsic component of the right to life, and the Department of Telecommunications’ directions dated July 31, 2025 mandating that telecom services and KYC procedures be made accessible to Persons with Disabilities (PwDs), the proposed amendments introduce specific provisions requiring service providers to establish dedicated support desks at call centres manned by personnel competent to assist PwDs using assistive technologies. Service providers are further required to ensure that their mobile applications, websites and portals incorporate accessibility features in accordance with Government of India guidelines on PwDs.
• Streamlining of the appellate process: The draft regulation proposes significant reforms to the existing appeal mechanism, wherein the time limit for filing an appeal has been reduced from thirty (30) days to fifteen (15) days from the date of receipt of an unsatisfactory response, or from the expiry of the prescribed complaint resolution period in cases where the complaint remains unaddressed or no intimation of redressal has been received. The Advisory Committee which was required to examine and advise on every appeal prior to its disposal by the Appellate Authority, has been proposed to be abolished, on the ground that it contributed to procedural delays and diffusion of accountability without meaningfully improving the outcomes. Simultaneously, the draft regulation proposes to strengthen the Appellate Authority by mandating that it be constituted by a regular employee in the senior management of the service provider with at least 5 years of experience, and by requiring the Appellate Authority to place a quarterly report on redressal of complaints and appeals and online consumer survey results before the Board of Directors and Chief Executive Officer of the service provider, with a view to enhancing oversight, accountability, and effectiveness in grievance redressal.

Link Here

Link Here

Fintech Updates

Reserve Bank of India issues revised draft amendment directions on conduct of non-banking financial companies in recovery of loans and engagement of recovery agents:

May 20, 2026: The Reserve Bank of India (RBI) issued the revised draft amendment directions ‘Reserve Bank of India (Non-Banking Financial Companies - Responsible Business Conduct) ... Amendment Directions, 2026’. The draft directions aim to provide comprehensive instructions on conduct related matters in recovery of loan dues and engagement of recovery agencies to all NBFCs, excluding Mortgage Guarantee Companies, Core Investment Companies, NBFC-Account Aggregators, Standalone Primary Dealers, Non-Operating Financial Housing Companies and NBFCs without any customer interface. Key highlights of the draft directions inter alia include:

• NBFCs are required to put in place a policy on collection / recovery of loan dues (including taking possession of a security) by its own employee or recovery agent. The policy must cover aspects related to, trigger(s) for initiation of recovery process, graded actions as per an escalation matrix for loan recovery, code of conduct for employees and recovery agents, etc. Further, with regard to engagement of recovery agencies, the policy must cover the eligibility and due diligence criteria for engagement of recovery agencies, inspection / audit, and control mechanisms to ensure compliance with statutory / regulatory requirements, penal actions to be taken in case of non-compliant recovery agencies and / or their agents, etc. The policy must also incorporate provisions relating to compensation to the borrowers / guarantors for loss arising on account of recovery-related actions of the NBFC or the recovery agencies inconsistent with these directions.
• NBFCs must undertake a due diligence process prior to engaging recovery agencies, in conformity with the Reserve Bank of India (Non-Banking Financial Companies – Managing Risks in Outsourcing) Directions, 2025, as amended from time to time.
• NBFC are required to maintain and publish an up-to-date list of empanelled or engaged recovery agencies across all prominent customer facing channels, viz., branches / offices or digital platforms such as website, mobile app, etc., as applicable. This list must be updated within seven (7) calendar days of any modification. However, in the event of termination of an agreement with a recovery agency, the NBFC must immediately update such list.

Link Here

RBI amends Investment Fluctuation Reserve requirements and Capital Adequacy directions for payment banks:

May, 2026: The RBI has issued amendments to the following Master Directions governing payment banks.

• Reserve Bank of India (Payments Banks - Classification, Valuation, and Operation of Investment Portfolio) Amendment Directions, 2026: The amendment direction dated May 18, 2026 revises the Investment Fluctuation Reserve (IFR) requirements for payments banks. The IFR is a reserve that banks are required to maintain to guard against any possible reversal of interest rate environment in future due to unexpected developments. Under the existing framework, payments banks were required to build this reserve on a continuing basis by transferring an amount not less than the lower of the following (i) net profit on sale of investments during the year; or (ii) net profit for the year, after mandatory appropriations, until the reserve reached at least 2% of the Available for Sale (AFS) and Fair Value through Profit and Loss (FVTPL) (including Held for Trading (HFT) portfolio. The amendment direction relaxes this framework by removing the mandatory transfer and instead requires payments banks to create IFR out of realised gains on sale of investments, subject to availability of net profit until the IFR balance reaches the 2% threshold. Notably, the assessment of the minimum IFR requirement has been shifted from a continuing basis to an annual assessment based on AFS and FVTPL portfolio values as of the balance sheet date and transfers to the IFR are to be made from net profit after mandatory appropriations.

Link Here

• Reserve Bank of India (Payments Banks - Prudential Norms on Capital Adequacy) Second Amendment Directions, 2026: the amendment direction dated May 8, 2026, amends the provisions governing the inclusion of quarterly profits in Common Equity Tier 1 (CET1) capital by payments banks for the purpose of Capital to Risk Weighted Assets Ratio (CRAR) calculation. Under the amended provision, payments bank may reckon profits earned during the current financial year for CRAR calculation on a quarterly basis, subject to: (i) the financial statements being audited or subjected to limited review on a quarterly basis; and (ii) the eligible profit up to the quarter being computed as follows wherein the net profit earned up to that quarter is reduced by a proportionate share of the average annual dividend paid over the last three (3) years ensuring that only profits genuinely available for capital purposes, after accounting for expected dividend payouts, are included. Any cumulative net loss up to the quarter end must be fully deducted while calculating CET1 capital for the relevant quarter.

Link Here

Judgements

The Calcutta High Court held ChatGPT (OpenAI Inc) to be an "Originator" and not an "Intermediary" under the Information Technology Act, 2000.

May 20, 2026: In Indiamart Inter Mesh Ltd. v. Open AI Inc. & Ors. (IA No. GA-COM/1/2025 in IP-COM/57/2025), the Calcutta High Court (CHC) held that ChatGPT is prima facia an “originator” rather than an “intermediary” under the Information Technology Act, 2000 (IT Act).

Facts of the case: The petitioner primarily contended that it was denied the “right of visibility” on the ChatGPT platform. It argued that ChatGPT’s responses reflected a deliberate intent to exclude the petitioner, particularly when users posed queries related to listings available on its platform. According to the petitioner, ChatGPT rendered the petitioner’s platform effectively inaccessible by bypassing it and instead providing direct links to third-party sellers’ websites. For instance, when a query referencing results from IndiaMART was made, ChatGPT furnished direct website links of the individual sellers listed on the IndiaMART platform, thereby circumventing the platform itself. However, when similar queries were made on ChatGPT for other platforms, links to those platforms were provided. The petitioner alleged that this differential treatment amounted to a conscious exclusion, resulting in the diversion of prospective buyers and consequently causing financial loss to the petitioner.

The petitioner further submitted that ChatGPT qualifies as an “intermediary” under Sections 2(1)(w) and 79(2)(c) of the IT Act and is therefore obligated to act in accordance with the statutory duties prescribed therein. It was also contended that, insofar as ChatGPT performs functions analogous to a search engine, it is bound by the requirement of non-discrimination under Rule 3(1)(n) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and cannot arbitrarily exclude the petitioner’s platform. Additionally, the petitioner alleged that such conduct amounts to a violation of its fundamental rights guaranteed under Articles 14, 19, and 21 of the Constitution of India.

OpenAI, in turn, submitted that the petitioner’s claim is premised on an alleged “right to visibility” on the ChatGPT platform; however, the petitioner has failed to establish the existence of such a right under any contract, statutory provision, or constitutional framework. OpenAI further contended that no cause of action arises under the IT Act, as ChatGPT does not qualify as an “intermediary” and is therefore not subject to the obligations imposed on intermediaries under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. It was additionally argued that ChatGPT does not function as a search engine but operates as an “originator” within the meaning of Section 2(1)(za) of the IT Act, inasmuch as it generates and transmits electronic messages. Under the IT Act, an “originator” refers to a person who sends, generates, stores, or transmits any electronic message, or causes such message to be sent, generated, stored, or transmitted to any person.

Judgment: The CHC observed that ChatGPT's responses are direct and synthesized, and that they provide more dynamic than static functions. The CHC held that ChatGPT cannot, prima facie, be a search engine, as it functions far beyond that. ChatGPT and its generative qualities make it fall within the scope of an “originator” under Section 2(za) of the IT Act.

The CHC also noted that generative AI systems do not fit into the IT Act as it was drafted before modern AI systems existed, and this would ultimately require legislative intervention.

The CHC stated that even assuming that ChatGPT is an intermediary under the IT Act, the petitioner has been unable to demonstrate breach of any positive obligation. There is no right which the petitioner has been able to demonstrate which has been infringed. Subsequently, the CHC dismissed the application seeking protection of IP rights as the petitioner failed to demonstrate any prima facie case in its support.

Link Here

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.